Eggs & MilksEat Local, Explore Global
Draft for legal review. This text is not yet in effect. Highlighted items in [brackets] are still to be completed.

Privacy Policy

Last updated: [EFFECTIVE DATE]

Plain-language summary. The full Privacy Policy below gives the details.

1. Who We Are and What This Policy Covers

1.1 Who we are. [COMPANY LEGAL NAME], doing business as "Eggs & Milks" ("Eggs & Milks", "we", "us", "our"), is a company organized in New Jersey. Our address is [COMPANY ADDRESS]. We decide how and why the personal information described in this Privacy Policy is used.

1.2 Scope. This Privacy Policy explains how we collect, use, share and keep personal information when you use the Eggs & Milks Customer app, the Seller app, the Delivery partner app (the "Delivery app"), our website at https://eggsandmilks.com (the "Website") and our support channels. Together these are the "Services". They include food ordering (Scheduled, Instant, Shippable and Catering), E&M Ride and E&M Adventure.

1.3 Words we use.

1.4 Other documents. This Privacy Policy works together with the Customer Terms of Service, the Seller Agreement and the Delivery Partner Agreement, whichever applies to you. Like those documents, it is governed by the laws of the State of New Jersey, except where the privacy law of your own state gives you rights that cannot be waived.

1.5 What is not covered. Third parties that collect information on their own behalf, such as Stripe, shipping carriers and app stores, have their own privacy notices. Sellers and Hosts are independent businesses and are responsible for how they handle information outside the Services.

1.6 United States, adults only. The Services are offered in the United States at launch and are for people who are 18 or older.

2. Information We Collect

We collect information in three ways: you give it to us, we collect it automatically, and we receive it from third parties.

2.1 Everyone with an account (you provide).

2.2 Customers (you provide).

2.3 Sellers and Hosts (you provide).

2.4 Delivery Partners and Drivers (you provide).

2.5 Collected automatically (all users). Push notification token, app version, device type, IP address, and server logs of the requests your app or browser makes to our systems. There are no cookies and no advertising trackers in our apps.

2.6 From third parties.

2.7 If you do not provide information. Some information is required. We cannot deliver without an address, and we cannot approve a Seller, Delivery Partner or Driver without the required documents.

3. Precise Location

3.1 Customers. The Customer app uses your device's location only when you tap "use my location", for example to fill in your address or ZIP code. We do not track Customers in the background. You can always type your address instead.

3.2 Delivery Partners and Drivers. The Delivery app collects your precise location while the app is open and you are online or on a job. We use it to offer you nearby jobs, to guide pickups and drop-offs, to show the Customer the progress of a delivery or ride, to confirm completed jobs, and for safety and fraud prevention. We do not collect your location when you are offline and not on a job.

3.3 Addresses. Delivery addresses and ride pickup and drop-off points are locations you type or select. We need them to perform the service you asked for.

3.4 How to turn location off. In your device settings, find the app and set the Location permission to "Never" or "Ask next time". Delivery Partners and Drivers can also go offline in the Delivery app to stop collection between jobs. Without the location permission, the Delivery app cannot take you online or send you job offers.

4. Camera and Photos

4.1 Our apps ask for access to your camera or photo library only when you choose to add an image. We use this access for:

4.2 We receive only the images you choose to take or upload. We do not browse your photo library. You can turn off camera and photo access in your device settings, but some features will then not work.

5. How We Use Information

5.1 To provide the Services. Managing your account; showing products available in your ZIP code; taking and fulfilling orders; arranging pickups, hub handling, deliveries and shipments; running rides, adventures and trips; and checking handover codes and ride PINs.

5.2 Payments. Charging Customers, issuing refunds and credits, calculating fees and taxes, and paying Sellers, Hosts, Delivery Partners and Drivers through Stripe.

5.3 Safety and fraud prevention. Verifying Sellers, Hosts, Delivery Partners and Drivers; reviewing documents, background-check results and product listings; detecting and preventing fraud, abuse, unsafe food, unsafe conduct and breaches of our agreements; and protecting our users, the public and Eggs & Milks.

5.4 Support. Answering questions, resolving reported problems and deciding refunds.

5.5 Legal compliance. Keeping tax and transaction records, meeting legal requirements that apply to us, responding to lawful requests, and establishing or defending legal claims.

5.6 Service messages. Order confirmations, status updates, job offers, receipts, security notices and notices of changes to our terms or this Privacy Policy.

5.7 Improving the Services. Fixing errors, measuring how features perform, planning delivery coverage by ZIP code and developing new features, using combined or de-identified information where we can.

5.8 Marketing. Telling you about Eggs & Milks offers, products and services, only where the law allows and, where required, with your consent. You can opt out at any time (Section 9).

5.9 New purposes. If we want to use your information for a materially different purpose, we will tell you first and, where the law requires, ask for your consent.

6. How We Share Information

6.1 Between users, as needed to complete an order, ride or booking.

Users may use this information only to complete the order, delivery, ride or adventure.

6.2 With service providers. These companies process information for us under contracts that limit what they may do with it:

6.3 For legal reasons. We may disclose information when we believe in good faith that it is reasonably necessary to comply with a law, court order, subpoena or lawful request from a public authority or regulator; to enforce our agreements; to detect, prevent or respond to fraud or security problems; or to protect the rights, property or safety of our users, the public or Eggs & Milks.

6.4 In a business transfer. If Eggs & Milks is involved in a merger, acquisition, financing, reorganization, bankruptcy or sale of all or part of its business, personal information may be transferred as part of it. The recipient must honor this Privacy Policy for that information, or give you the notice and choice the law requires before changing how it is handled.

6.5 With advisers. We may share information with our lawyers, accountants, auditors and insurers under duties of confidentiality.

6.6 With your consent. We share information in other ways when you ask us to or agree to it.

6.7 De-identified information. We may use and share information that cannot reasonably be linked to you, such as total orders per ZIP code. We will not try to re-identify it.

6.8 Text message consent is never shared. All the above categories exclude text messaging originator opt-in data and consent; this information won't be shared with any third parties.

7. We Do Not Sell Your Personal Information

7.1 Eggs & Milks does not sell personal information, whether for money or for other valuable consideration.

7.2 Eggs & Milks does not share personal information with third parties for cross-context behavioral advertising, also called targeted advertising.

7.3 If this ever changes, we will update this Privacy Policy first and give you the notices and opt-out choices the law requires.

8. Payments by Stripe

8.1 Payments are processed by Stripe. Your card details go directly from your device to Stripe. They do not reach Eggs & Milks servers, and we do not store card numbers.

8.2 We keep payment IDs, amounts, payment and refund status and, if Stripe provides them, card brand and last four digits, so that we can show receipts and handle refunds.

8.3 Sellers, Hosts, Delivery Partners and Drivers are paid through Stripe Connect Express accounts. You must accept Stripe's Connected Account Agreement and complete Stripe's identity verification. Stripe collects the identity and bank information it needs directly from you and tells us whether your account can receive payouts.

8.4 Stripe also uses information for its own purposes, such as fraud prevention, as described in Stripe's privacy policy.

9. Push Notifications, Email and Text Messages

9.1 Push notifications. We send push notifications about orders, job offers, bookings and status changes. You can turn them off in your device settings. Sellers, Delivery Partners and Drivers who do so may miss orders or job offers.

9.2 Email. Service emails, such as receipts and account or legal notices, are needed to run your account and cannot be switched off while it is open. Marketing emails include an unsubscribe link.

9.3 Text messages and calls. We may use your phone number to contact you about an order, delivery, ride, booking or your account. If we offer text messages, we will send marketing texts only with the consent the law requires, and you can reply STOP to end them. Message and data rates may apply.

9.4 Eggs & Milks Team Alerts. Members of the Eggs & Milks team who agree to it receive operational alerts by text message, such as new orders, bookings and sign-ups. We use their mobile number only to send these alerts, and they can reply STOP at any time to stop them. Details: https://eggsandmilks.com/sms.html

9.5 Contact between users. A Delivery Partner or Driver may call or message a Customer only where needed to complete a delivery or ride.

10. Cookies and Analytics on the Website

10.1 Our apps do not use cookies. The Website uses only essential cookies, meaning those needed for it to work, to stay secure or to remember a choice you made. We do not use advertising cookies.

10.2 If we add analytics to the Website, we will use it only to understand and improve the Website, not to advertise to you elsewhere, and we will update this section first.

10.3 You can block or delete cookies in your browser. Parts of the Website may then not work.

10.4 Because we do not sell personal information or share it for targeted advertising, there is nothing for a browser opt-out signal, such as the Global Privacy Control, to switch off. If that changes, we will honor those signals as the law requires. We do not respond to "Do Not Track" signals.

11. How Long We Keep Information

11.1 We keep personal information only as long as we need it for the purposes in this Privacy Policy, or as the law requires.

11.2 When you delete your account. Your personal details are erased or anonymized. Transaction records are kept as the law requires.

11.3 Longer retention. We may keep information longer where the law requires it, where there is an open dispute, claim or investigation, or where needed to prevent fraud or protect safety.

12. Security

12.1 We use reasonable administrative, technical and physical measures designed to protect personal information. These include storing passwords only in hashed form; sending card details directly to Stripe; limiting access to personal information, including verification documents, to staff and service providers who need it; access controls on our Management Panel; and contracts that require our service providers to protect the information they handle.

12.2 Limits. No app, website, network or storage system is completely secure. We cannot guarantee that information will never be accessed, disclosed, changed or destroyed in breach of our safeguards.

12.3 Your part. Use a strong, unique password, keep your device locked, and tell us at once, at the support address for your account type in Section 21.2, if you think someone has accessed your account.

13. Your Choices and Rights

13.1 What you can ask for. Whatever state you live in, you can ask us to:

13.2 Deleting your account in the app. Go to Account > Delete my account. This is available when you have no orders, rides or bookings in progress. If you cannot use the app, email privacy@eggsandmilks.com.

13.3 Exceptions. We may keep information where the law allows or requires it, for example transaction and tax records, or information needed to complete an order in progress, to prevent fraud or security incidents, to meet a legal duty, or to establish or defend legal claims.

13.4 How to make a request. Email privacy@eggsandmilks.com or write to the address in Section 21. Tell us which right you want to use and the email or phone number on your account. Requests are free unless they are clearly unfounded, excessive or repetitive.

14. US State Privacy Rights

14.1 Who this section is for. Several US states give their residents specific privacy rights. Some of these laws apply only to businesses above a certain size. This section describes those rights and how we handle requests. It adds to Section 13.

14.2 Submitting and verifying requests. Send your request to privacy@eggsandmilks.com or to the address in Section 21. To confirm that the request comes from you, we will normally ask you to confirm from the email or phone number on your account or to sign in. For sensitive information or specific pieces of information we may ask for more proof, which we use only for verification. We will respond within the time the law requires. If the law allows an extension and we need one, we will tell you why. [NOTE TO COUNSEL: the earlier draft promised a response within 45 days with one 45-day extension, which matches the California and New Jersey statutes but is not in the fact sheet. Decide whether to state the number of days here.]

14.3 Authorized agents. You may use an authorized agent. We will ask the agent for your signed written permission and may ask you to verify your identity with us directly, unless the agent holds a valid power of attorney.

14.4 Appeals. If we decline your request, we will tell you why. You may appeal by emailing privacy@eggsandmilks.com with the subject line "Privacy Appeal". We will answer in writing within the time your state's law requires. If we deny the appeal, we will tell you how to complain to your state's Attorney General.

14.5 No discrimination or retaliation. We will not deny you the Services, charge a different price, or provide a different level of quality because you used a privacy right. Sellers, Hosts, Delivery Partners and Drivers will not be penalized for doing so.

14.6 California: categories we collect. This notice is for California residents under the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"). In the past 12 months, and going forward, we collect these categories. Details are in Section 2.

14.7 California: sources, purposes, disclosures and retention. We collect these categories from you, from your device and from the third parties in Section 2.6. We use each category for the business purposes in Section 5. We disclose them to the service providers in Section 6.2 as needed for their work and to other users as set out in Section 6.1. We keep them for the periods in Section 11.

14.8 California: no sale and no sharing. We do not sell personal information or share it for cross-context behavioral advertising, and have not done so in the past 12 months. We have no actual knowledge of selling or sharing the personal information of anyone under 16.

14.9 California: your rights. You have the right to know what personal information we collected about you, including the categories, sources, purposes, recipients and specific pieces; to delete it, subject to legal exceptions; to correct it; to receive it in a portable format; to opt out of sale or sharing, which we do not do; to limit the use of sensitive personal information; and not to be discriminated or retaliated against.

14.10 California: right to limit. We use sensitive personal information only for purposes the CCPA allows without offering a right to limit: providing the Services you asked for, verifying identity and eligibility, security, fraud prevention and legal compliance. We do not use it to infer characteristics about you. If that changes, we will give you a way to limit that use.

14.11 California: Shine the Light. We do not disclose personal information to third parties for their own direct marketing.

14.12 New Jersey. Under the New Jersey Data Privacy Act, New Jersey residents have the right to confirm whether we process their personal information and to access it; to correct inaccuracies; to delete it; to obtain a portable copy; and to opt out of sale, targeted advertising, and profiling used for decisions with legal or similarly significant effects. We do not do any of these three. We process sensitive data as New Jersey law defines it, including precise location, only with your consent, which you can withdraw as described in Sections 3 and 13. If we deny an appeal under Section 14.4, you may contact the New Jersey Division of Consumer Affairs in the Office of the Attorney General.

14.13 Virginia, Colorado, Connecticut and other states. If your state has a comprehensive consumer privacy law that applies to us, you have similar rights: to confirm and access, correct, delete, obtain a portable copy, and opt out of sale, targeted advertising and certain profiling. Some states also give you the right to a list of the third parties, or categories of third parties, that received your information. Where your state requires consent to process sensitive data, we collect it only with your consent. You may appeal under Section 14.4 and may complain to your state's Attorney General if the appeal is denied.

15. Sensitive Information

15.1 What we collect. We collect a small amount of information that many laws treat as sensitive: government-issued ID and driver's license (from Delivery Partners and Drivers and, where it applies, Sellers and Hosts); background-check status; and precise location as described in Section 3.

15.2 Limited use. We use it only to verify who you are and that you are eligible to sell, deliver or drive; to dispatch and complete deliveries and rides; for safety and fraud prevention; and to meet legal duties. We do not use it for marketing, we do not sell it, and we do not use it to draw conclusions about your personal characteristics.

15.3 Limited access. Only staff who review applications or handle safety and support matters, and the service providers in Section 6.2, may see these documents.

15.4 What we do not ask for. We do not ask for information about your health, religion, race or ethnic origin, sexual orientation or immigration status. Please do not put such information in delivery notes, listings or support messages.

16. Children

16.1 The Services are not directed to anyone under 18. You must be 18 or older to create an account.

16.2 We do not knowingly collect personal information from children under 13, or from anyone under 16 without the consent the law requires.

16.3 If we learn that we hold personal information from someone under 18 without a valid basis, we will delete it and close the account. If you believe a child has given us personal information, contact privacy@eggsandmilks.com.

17. International Users and Trips Abroad

17.1 Processing in the United States. Personal information is processed and stored in the United States, where privacy laws may differ from those of other countries. If you use the Services from outside the United States, your information will be transferred to and processed in the United States.

17.2 Trips abroad. Some E&M Adventure trips take place in other countries. To run them we share Guest details with local hosts and local providers as needed for your booking, normally your name, your booking dates and what they need to know to look after you. These recipients are outside the United States and are subject to their own local laws.

17.3 Passports. For trips abroad we record your confirmation that you hold a valid passport. If a trip requires further travel document details, we will tell you before you provide them.

18. Automated Decisions

18.1 We use automated systems in a few limited ways:

18.2 People make the important decisions. Approving, rejecting or suspending a Seller, Host, Delivery Partner or Driver, approving a product and deciding a refund request are reviewed by our team. We do not make decisions with legal or similarly significant effects on you by automated means alone.

18.3 Ask for a review. If you think an automated check treated you wrongly, contact us and a person will look at it.

19. Data Breach Notification

19.1 If we learn of a security breach that affects your personal information, we will investigate and contain it, and notify you and the relevant authorities as the law requires and without unreasonable delay.

19.2 Our notice will explain, as far as we know at the time, what happened, what information was involved, what we are doing about it and what you can do to protect yourself. We will normally send it to the email address on your account.

20. Changes to This Privacy Policy

20.1 We may update this Privacy Policy from time to time. The "Last updated" date shows when it was last changed.

20.2 If we make a material change, we will tell you before it takes effect, by email, by a notice in the app, or both. Where the law requires your consent to a change, we will ask for it.

20.3 If you continue to use the Services after a change takes effect, the updated Privacy Policy applies to you. If you do not agree, you can stop using the Services and delete your account.

21. Contact Us

21.1 For questions about this Privacy Policy, or to use your privacy rights, contact us at:

21.2 For general help, Customers can write to support@eggsandmilks.com, Sellers and Hosts to sellers@eggsandmilks.com, and Delivery Partners and Drivers to couriers@eggsandmilks.com.