Privacy Policy

Gleam & Sip — Toronto, Ontario, Canada
Effective Date: April 6, 2026

Gleam & Sip ("we", "our", or "us") operates the Gleam & Sip mobile application (the "App") and the physical cafe located in Toronto, Ontario. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our App and related services.

By using the App, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the App.

1. Information We Collect

We collect only the information necessary to provide our ordering and loyalty services. Much of this information is optional and provided at your discretion.

• Phone number (optional) — Used to identify your loyalty stamp card and link rewards to your account.
• Name (optional) — Used to identify your order for pickup.
• Email address (optional) — Used for account authentication via magic link (passwordless login).
• Order history — Records of items you have ordered, including dates, items, and order totals.
• Push notification tokens — Device tokens used to send you order status updates and, with your consent, promotional notifications.

We do not collect precise geolocation data, contacts, browsing history, or any biometric information.

2. Information We Do Not Store

Payment processing is handled entirely by Stripe, Inc. We do not collect, store, or have access to your credit card numbers, debit card numbers, or other payment card details. All payment information is transmitted directly to Stripe and is subject to Stripe's Privacy Policy.

3. How We Use Your Information

We use the information we collect for the following purposes:

• To process and fulfill your mobile orders.
• To maintain your loyalty stamp card and apply rewards.
• To send order status notifications (e.g., "Your order is ready for pickup").
• To authenticate your account via magic link email.
• To improve our menu, service, and App functionality based on aggregate usage patterns.
• To communicate important service updates or changes.

4. Third-Party Service Providers

We share your information only with the following third-party providers, solely to the extent necessary to operate our services:

• Stripe, Inc. — Payment processing. Stripe receives your payment details directly. See Stripe's Privacy Policy.
• Cloudflare, Inc. — Application hosting, content delivery, and security. See Cloudflare's Privacy Policy.

These providers are contractually obligated to protect your data and may only use it to perform services on our behalf.

5. Data Sharing and Selling

We do not sell, rent, trade, or otherwise share your personal information with third parties for their marketing or advertising purposes. We will never monetize your data.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with our services. Specifically:

• Account information (name, email, phone number) is retained until you request deletion.
• Order history is retained for up to 24 months from the date of each order for loyalty and customer service purposes.
• Push notification tokens are retained only while your App is installed and active; tokens are removed when they become invalid.

We may retain certain anonymized or aggregated data that cannot be used to identify you for analytical purposes indefinitely.

7. Data Security

We implement commercially reasonable technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These include encrypted data transmission (TLS/SSL), secure server infrastructure, and limited access controls. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your Rights and Data Deletion

You have the right to:

• Access the personal information we hold about you.
• Correct any inaccurate or incomplete information.
• Delete your account and all associated personal information.
• Withdraw consent for push notifications at any time through your device settings.

To request access to, correction of, or deletion of your personal data, please contact us at [email protected]. We will respond to your request within 30 days.

9. Children's Privacy

The App is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will take steps to delete that information promptly. If you believe a child under 13 has provided us with personal information, please contact us at [email protected].

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you through the App or by other reasonable means prior to the changes taking effect. The "Effective Date" at the top of this policy indicates when it was last revised. Your continued use of the App after any changes constitutes your acceptance of the updated policy.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: [email protected]
• Business: Gleam & Sip, Toronto, Ontario, Canada

This Privacy Policy is effective as of April 6, 2026.