# Privacy Policy

Last Updated: October 5, 2026

This Privacy Policy explains how TinyGiantLabs LLC, doing business as Parsley ("Parsley," "we," "us," or "our"), collects, uses, shares, and protects personal information, and the choices and rights you have.

## Who we are and when this policy applies

Parsley is a technology company. We build and run the online ordering and marketing tools that restaurants ("Restaurants") use to sell to their own guests. We are not a restaurant and we do not prepare, sell, or deliver food.

This policy applies to:

- **Restaurant ordering websites powered by Parsley.** These are branded with the Restaurant's name and live at the Restaurant's own domain or at an address ending in `withparsley.com`. They show "Powered by Parsley" in the footer.
- **Ordering kiosks** in Restaurants that run Parsley software.
- **Phone ordering** handled by a Parsley AI voice assistant on a Restaurant's behalf.
- **Mobile applications** powered by Parsley.
- **Messages** we send on a Restaurant's behalf (sign-in codes, order confirmations, receipts, review requests, and marketing emails the Restaurant chooses to send).
- **Parsley's business tools** for Restaurants and their staff (the Parsley dashboard, the Parsley Manager app, the AI assistant, and connectors to third-party AI apps).
- **Our own websites**, such as withparsley.com and help.withparsley.com.

We call all of these the "Services." Your use of the ordering Services is also governed by our [Platform Terms of Service](/legal/platform-terms).

**Parsley and Restaurants.** When you order from a Restaurant, both Parsley and that Restaurant receive your information. We process it to run the Services, as described in this policy. The Restaurant uses it to make and deliver your order and to manage its relationship with you, and may also send you marketing. How the Restaurant uses your information on its own (for example, in its in-store systems or its own marketing tools outside Parsley) is governed by the Restaurant's own privacy practices. Questions about those practices should go to the Restaurant.

## Summary

- We collect what you give us when you order (contact details, order details, delivery address), information from your device and browser, and information from our partners such as Stripe and delivery couriers.
- **We never see your full card number.** Card details are entered directly into Stripe, our payment processor.
- We share your order information with the Restaurant you order from and, for courier deliveries, with DoorDash or Uber.
- Restaurants can add advertising and analytics tools such as Google Analytics, Google Ads, Meta Pixel, and TikTok Pixel to their ordering websites. These tools can receive information about your visit and your order. See [Cookies, analytics, and advertising](#cookies-analytics-and-advertising).
- We record how visitors use our ordering websites, including session replays, to fix problems and improve the product.
- Phone calls answered by our AI voice assistant are transcribed, and they may also be recorded.
- **We do not sell personal information for money.**
- You can ask us to access, correct, or delete your information by emailing [support@withparsley.com](mailto:support@withparsley.com).

## Information we collect

### Information you give us

**Ordering and checkout.** When you place an order we collect:

- your name, email address, and phone number
- the items you order, customizations, and special instructions for the order or for individual items
- the order type (pickup, curbside, delivery, dine-in, or catering), scheduled time, and tip
- for delivery: your delivery address and delivery instructions (for example, a gate code)
- for curbside pickup: the vehicle details you provide, which can include make, model, color, and license plate
- for dine-in: your table number and party size

Some Restaurants let several people add items to one order through a shared link (a "group order"). Participants only give a name; the host places and pays for the order.

**Your account with a Restaurant.** You sign in with your mobile phone number and a one-time code we text to you. Your account is specific to each Restaurant: ordering from two Restaurants creates two separate accounts, and we don't link them. Your profile may also include:

- your email address
- saved delivery addresses
- optional details you choose to add, such as date of birth (used for birthday rewards), gender, and dietary restrictions
- your marketing preferences

**Payment information.** When you pay by card, Apple Pay, or Google Pay, your card details go directly to Stripe, our payment processor. We never receive or store your full card number or security code. We do receive and store a Stripe customer identifier and limited card details, such as card brand and the last four digits. If you choose to save a card for future orders, Stripe stores it and we keep a reference to it.

**Loyalty programs, gift cards, and promotions.**
- **Loyalty:** if you join a Restaurant's loyalty program, we keep your points balance, tier, rewards, and loyalty activity.
- **Gift cards:** if you buy a gift card, we collect your name and contact details, the recipient's name, email address, and phone number, and any message you write.
- **Promotions:** we record coupons and promotions applied to your orders.

**Reviews and feedback.** After an order we may email you, on the Restaurant's behalf, to ask about your experience. If you respond, we collect your rating and comments and share them with the Restaurant.

**Support conversations.** If a Restaurant offers in-app support chat, we store the messages you exchange with the Restaurant's staff, linked to your order.

**Forms on Restaurant websites.** Restaurants can add their own forms to their websites, such as catering inquiries or contact forms. We collect what you submit and pass it to the Restaurant.

**Phone calls to our AI voice assistant.** When a Restaurant uses our AI voice assistant to answer its phone, we collect:
- your phone number (caller ID)
- what you say during the call, as a transcript
- a summary of the call
- any details you give, such as your name, order, delivery address, or a message for the Restaurant

The assistant tells you at the start of every call that it is an AI assistant and that the call may be recorded. If the Restaurant has turned on call recording, we also store an audio recording. Some Restaurants let the assistant recognize returning callers, in which case we keep a caller profile with your name, phone number, past call summaries, and usual orders.

The assistant never asks for card numbers. If you pay by phone, we text you a secure payment link. If you say card details aloud anyway, we mask them in the transcript, but they may remain in a recording.

**Kiosks.** If you order at a Parsley-powered kiosk, we collect your order and any contact details you enter: for example, your name and email address for a receipt, or your phone number to sign in and earn loyalty rewards. Card payments at a kiosk are processed by Stripe through the card reader.

**Contacting Parsley.** If you contact us (for example, through the contact form on withparsley.com, by email, or by phone), we collect your name, email address, restaurant name, and anything else you include.

### Information we collect automatically

**Device and usage information.** When you use our websites, we and our service providers automatically collect:
- your IP address, browser type and version, device type, and operating system
- the pages you visit, the referring page, and the date and time of your visit
- how you interact with the page, such as clicks, scrolling, page performance, and the steps you take while ordering

**Session replays.** On Restaurant ordering websites and the Parsley dashboard, we use a session replay tool to record how you interact with pages, including mouse movements, clicks, scrolling, and what you type into form fields. We use these recordings to find bugs and improve the experience. Card details entered into Stripe's secure payment fields are not captured. When you are signed in, these recordings and usage events are linked to your account, including your name, email address, and phone number.

**Accessibility settings.** Restaurant ordering websites include an accessibility menu. Your settings are stored on your device. We also record which accessibility options you turn on in our analytics, to improve the feature.

**Website traffic statistics.** To show Restaurants how their websites perform, we assign each browser a random visitor identifier. We record page views with that identifier, along with the page visited, the referring website, your IP address, and your browser type. If you arrive through a link that contains a referral or campaign tag (for example, `?ref=` or `utm_source=`), we store that tag with your cart and order.

**Email engagement.** Some marketing emails, such as abandoned-cart and birthday emails, contain a small tracking image and tracked links. These tell us whether the email was opened and which links were clicked.

**Location information.** We do not collect your device's precise location from your browser, and our apps do not request location access from customers. We convert the addresses you enter into map coordinates so we can find nearby locations, check delivery zones, and send deliveries. The Parsley Manager app, used by Restaurant staff, may use the device's location to connect to card readers. If a Restaurant uses DoorDash or Uber for delivery, we receive the courier's location while your order is on its way.

**Cookies and similar technologies.** We use cookies, local storage, and similar technologies as described in [Cookies, analytics, and advertising](#cookies-analytics-and-advertising).

### Information from others

- **Restaurants.** Restaurants can add or update information about you. For example, staff may create a guest record when you order in person, add notes to your profile, or record a refund.
- **Payment processor.** Stripe sends us payment status, card brand and last four digits, refund and dispute details, and fraud-related signals.
- **Delivery couriers.** DoorDash and Uber send us delivery status, courier name and phone number, courier location, vehicle details, and proof-of-delivery photos.
- **Google.** If a Restaurant connects its Google Business Profile, we receive the public reviews posted about that Restaurant on Google, including each reviewer's display name and profile photo.
- **Voice technology partners.** If a Restaurant uses a voice partner that works with Parsley, we may receive call transcripts and the contact details callers provide.

## Information about Restaurant owners and staff

If you are a Restaurant owner, employee, or one of our reseller partners, we collect:

- **Account details:** your name, email address, phone number, profile photo, role, and permissions.
- **Sign-in details:** if you sign in with Google, your Google account email and profile. We also keep a history of your sign-ins, including IP address and browser type.
- **Business details:** your restaurant's name, locations, addresses, phone numbers, menus, hours, and settings, including your website content and tracking tool IDs.
- **Billing details:** billing contact, billing address, and payment method details provided through Stripe, such as bank name or card brand and last four digits. Identity verification and payout bank details for receiving payments are collected and held by Stripe, not by us.
- **Activity records:** records of changes made in the dashboard (an audit log, with the person, time, IP address, and what changed), usage analytics and session replays of the dashboard, and records of actions taken through connected AI apps.
- **Connected accounts:** if you connect your Google Business Profile or social media accounts, we store the access tokens that let us act on your behalf, as described below.
- **POS employees:** for staff who use the Parsley Manager app, we store their name, job title, and a hashed PIN.

## How we use information

We use personal information to:

- **Provide the Services:**
  - process and send your order to the Restaurant
  - take payment through Stripe
  - arrange delivery
  - run loyalty programs, gift cards, and promotions
  - sign you in and keep your account secure
- **Send messages you need:** sign-in codes, order confirmations and updates, receipts, refund notices, and gift card deliveries. These come from the Restaurant's name and are sent through Parsley.
- **Send marketing emails on behalf of Restaurants** you've ordered from, if you've agreed to receive them. Examples include promotions, abandoned-cart reminders, birthday offers, and loyalty updates. See [Your choices](#your-choices).
- **Ask for feedback:** we send a review request after an order and share your response with the Restaurant.
- **Answer phone calls** for Restaurants with the AI voice assistant, take orders and messages, and send you payment or ordering links by text.
- **Group guests into segments** for Restaurants, such as new, regular, VIP, or at-risk guests. Segments are based on order history (how often, how much, and how recently you order) and are used for the Restaurant's marketing and loyalty programs. We do not use them to make decisions that have legal or similarly significant effects on you.
- **Provide AI features** (see [AI features](#ai-features)).
- **Understand and improve the Services:** analyze usage, measure performance, fix bugs, and develop new features.
- **Give Restaurants reports** about their sales, guests, and website traffic.
- **Keep the Services safe:**
  - prevent fraud and abuse
  - investigate and resolve disputes, chargebacks, and support issues
  - enforce our terms
- **Comply with law:** meet legal, tax, accounting, and regulatory obligations, and respond to lawful requests.
- **Other purposes** we describe to you when we collect the information, or with your consent.

## AI features

We use artificial intelligence to power several features. Your information may be processed by the AI providers listed in [Service providers](#service-providers).

- **AI voice assistant.** When a Restaurant uses it to answer calls, your speech is converted to text, processed by a large language model to understand your request, and answered with a computer-generated voice. Each call starts with a disclosure that you are speaking with an AI assistant and that the call may be recorded. You can ask to be transferred to the Restaurant where the Restaurant has enabled transfers. We automatically delete call transcripts after the period the Restaurant sets, which is 90 days by default and never more than 365 days. Audio recordings are deleted after the Restaurant's retention period or 30 days, whichever is sooner. If the Restaurant uses the returning-caller feature, the caller profile described above is kept until the Restaurant or Parsley removes it or you ask us to delete it.
- **Support chat assistance.** When you message a Restaurant through support chat, the Restaurant's staff may use AI to summarize the conversation and suggest replies. A person at the Restaurant decides what to send.
- **Review replies.** Restaurants can use AI to draft replies to reviews posted on Google. This sends the review text and the reviewer's display name to an AI provider. The Restaurant decides whether to post the reply.
- **AI assistant for Restaurants.** Restaurant staff can ask the Parsley AI assistant questions about their business. To answer, the assistant may access the Restaurant's data, including guest names, contact details, and order history.
- **Connectors to third-party AI apps.** Restaurant staff can connect AI apps such as Claude or ChatGPT to their Parsley account. A person on the Restaurant's team must approve each connection and choose what it can access, which may include guest profiles and order history. Once connected, the Restaurant's chosen AI app receives that data, and the app's own terms and privacy policy apply to it. Connected AI apps cannot place, change, or refund orders, move money, or message guests through Parsley.

We do not use AI to make decisions that produce legal or similarly significant effects about you.

## How we share information

We do not sell personal information for money. We share personal information as follows:

- **With the Restaurant you order from or interact with.** The Restaurant receives your name, contact details, order details, delivery address, special instructions, reviews and feedback, support messages, loyalty activity, and marketing preferences. Restaurant staff can see your guest profile and order history with that Restaurant. Restaurants use this information to prepare and deliver your order, provide customer service, run their loyalty programs, and, if you've agreed, send you marketing.
- **With delivery couriers.** If a Restaurant sends your order through a third-party delivery service (currently DoorDash Drive or Uber Direct), we share your name, phone number, delivery address and instructions, and order items with that service so a courier can deliver it.
- **With our payment processor.** Stripe processes payments, refunds, and disputes, and helps prevent fraud. Stripe's use of your information is governed by the [Stripe Privacy Policy](https://stripe.com/privacy).
- **With service providers.** Companies that host, operate, and support the Services for us receive the information they need to do that work for us. See [Service providers](#service-providers).
- **Through advertising and analytics tools a Restaurant chooses.** If a Restaurant adds tools such as Google Analytics, Google Ads, Google Tag Manager, Meta Pixel, TikTok Pixel, or Hotjar to its ordering website, those providers receive information directly from your browser. See [Cookies, analytics, and advertising](#cookies-analytics-and-advertising).
- **With AI apps a Restaurant connects,** as described in [AI features](#ai-features).
- **With our reseller partners,** who help Restaurants set up and manage their Parsley accounts. A reseller may access a Restaurant's dashboard, including guest information, when the reseller works on that Restaurant's account.
- **For legal reasons.** We may disclose information if we believe it is required by law, subpoena, court order, or other legal process, or that it is needed to protect the rights, property, or safety of you, Parsley, Restaurants, or others.
- **In a business transfer.** If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred as part of that transaction, subject to this policy.
- **With your consent** or at your direction.

We may also share information that has been aggregated or de-identified so that it can no longer reasonably be linked to you.

## Service providers

We use the following categories of service providers. We may change providers over time.

| Purpose | Providers | Information involved |
|---|---|---|
| Hosting, storage, and infrastructure | Cloud hosting and infrastructure providers in the United States | All information stored by the Services |
| Payments | Stripe | Payment details, name, email address, phone number, order amounts |
| Email delivery | Email delivery providers | Email addresses, names, and message content |
| Text messages and sign-in codes | Text messaging providers | Phone numbers and message content |
| Delivery | DoorDash Drive, Uber Direct | Name, phone number, delivery address and instructions, order items |
| Address search, maps, and location data | Mapping and address search providers | Addresses you type; device and session identifiers in your browser |
| Product analytics and session replay | Product analytics providers | Usage events, session replays, device information, and account details when you are signed in |
| Error monitoring | Error monitoring providers | Technical error details, which can include information from the request that caused the error |
| AI voice assistant | Telephony, real-time communication, speech recognition, voice generation, and AI model providers | Call audio, phone numbers, transcripts, and order details |
| AI features | AI model providers | Text the feature needs, such as support messages, reviews, guest records requested by Restaurant staff, or business information |
| Google Business Profile | Google | Restaurant business information, reviews, and replies |
| Social media publishing | Social media publishing providers | Restaurant posts and connected social accounts |
| Fonts and embedded media | Font and video hosting providers | Your IP address and browser information when a Restaurant's website loads its chosen fonts or videos |
| Website contact form | Form handling providers | What you submit through the withparsley.com contact form |
| Internal notifications | Team messaging providers | Order alerts for our team, which include the guest's name and order total |

## Cookies, analytics, and advertising

### Cookies and storage used by Parsley

We use the following on Restaurant ordering websites and on our own websites:

| Name | What it does | How long it lasts |
|---|---|---|
| `sf_access_token`, `sf_refresh_token`, `sf_customer_id` | Keep you signed in to a Restaurant's ordering website | 30 minutes (access); 7 days (refresh, customer ID) |
| `munch_cart_id`, `munch_cart_id_catering` | Remember your cart | 7 days |
| `munch_group_token`, `munch_group_participant_id` | Let you join and contribute to a group order | 24 hours |
| `munch_menu_type` | Remember whether you're browsing the regular or catering menu | 7 days |
| `munch_referral` | Remember the referral or campaign tag you arrived with, for order attribution | 7 days |
| `munch_alid`, `munch_abandoned_cart` | Link an order to the marketing email that brought you back | 24 hours |
| `munch_visitor_id` (cookie and local storage) | Random identifier used to count website visits for the Restaurant | 1 year |
| `munch_a11y` (local storage) | Remember your accessibility settings | Until you clear it |
| `munch_modal_seen_*` (local or session storage) | Avoid showing the same pop-up twice | Varies |
| Product analytics identifiers (cookie and local storage) | Product analytics and session replay | 1 year |
| Address search identifiers (local storage) | Address search and maps | Until you clear it |
| Payment processor cookies | Set by Stripe on checkout pages for payments and fraud prevention | Up to 1 year |

The Parsley dashboard for Restaurant staff uses similar cookies to keep you signed in (`munch_access_token`, `munch_refresh_token`) and to remember your selected restaurant and preferences.

### Tools added by Restaurants

Restaurants can add their own analytics and advertising tools to their ordering websites. The tools available today are Google Analytics, Google Ads, Google Tag Manager, Meta (Facebook and Instagram) Pixel, TikTok Pixel, and Hotjar. When a Restaurant turns one on, the tool's code runs on that Restaurant's website and the provider may set its own cookies, such as `_ga`, `_gcl_au`, `_fbp`, `_ttp`, or `_hj*`.

When enabled, these tools can receive:

- the pages you visit and your device and browser information
- ordering events: items you view, items you add to your cart, when you start checkout, and your purchase (including the order number, items, and amounts)
- **for Google Ads and TikTok, when you complete a purchase:** your email address and phone number. **Google Ads** also receives your name and, for delivery orders, your address. These are used to match your purchase to an ad you saw. Google's and TikTok's code converts these details into a hashed (scrambled) form before sending them.
- **for Google Tag Manager, when you complete a purchase:** the same contact details are made available to the Restaurant's Tag Manager setup, and the Restaurant decides which tags receive them

Restaurants use these tools to measure and improve their own advertising, and the providers may use the information for their own purposes as described in their privacy policies. The Restaurant decides whether to use these tools and is responsible for how it configures them. These tools are not loaded on the pages Restaurants use to preview their websites inside the Parsley dashboard.

### Your controls

- **Browser settings.** You can block or delete cookies in your browser settings. If you block our cookies, sign-in, carts, and group orders may not work.
- **Advertising tools.** You can limit or opt out of interest-based advertising through your Google, Meta, and TikTok account settings, and through industry tools such as [YourAdChoices](https://youradchoices.com) and the [Network Advertising Initiative opt-out](https://optout.networkadvertising.org).
- **Analytics.** Google offers a [browser add-on](https://tools.google.com/dlpage/gaoptout) to opt out of Google Analytics.
- **Do Not Track and Global Privacy Control.** The Services do not currently change their behavior in response to Do Not Track signals or the Global Privacy Control signal.

## Your choices

**Marketing emails.** At checkout and in your account profile you can choose whether to receive promotional emails from a Restaurant. You can change this at any time by clicking "unsubscribe" in any marketing email, turning off promotional emails in your account profile, or contacting us at [support@withparsley.com](mailto:support@withparsley.com).

Opting out of a Restaurant's marketing emails does not affect other Restaurants, and it does not stop messages you need, such as order confirmations, receipts, and refund notices. Agreeing to marketing is never a condition of purchase.

**Text messages.** We only send text messages that relate to your account or orders: sign-in codes, order updates, and payment or ordering links when you order by phone. We do not send marketing text messages. Message and data rates may apply.

**Saved cards and addresses.** You can remove saved cards and addresses from your account at any time.

**Loyalty programs.** You can ask a Restaurant or us to remove you from a loyalty program.

**Phone calls.** You can end a call with the AI voice assistant at any time, or ask to be transferred to the Restaurant where available.

## How long we keep information

We keep personal information for as long as we need it for the purposes in this policy, unless the law requires or allows us to keep it longer. For example:

| Information | How long we keep it |
|---|---|
| Orders, payments, refunds, and related records | As long as the Restaurant uses Parsley, and as long as needed for tax, accounting, and legal purposes. This is generally at least seven years for financial records. |
| Guest profiles and loyalty records | As long as the Restaurant uses Parsley, unless you or the Restaurant ask us to delete them |
| AI voice assistant transcripts and call summaries | The Restaurant's chosen period: 90 days by default, and never more than 365 days |
| Call audio recordings (if enabled) | The Restaurant's chosen period or 30 days, whichever is shorter |
| Technical request logs (these can include information you submit) | 7 days |
| Records of actions taken through connected AI apps | 90 days |
| Website traffic statistics, sign-in history, and audit logs | As long as needed for security, fraud prevention, and reporting |

When we no longer need information, we delete it or de-identify it. Some deleted information may remain in backups for a limited time.

## Your privacy rights

Depending on where you live, you may have the right to:

- **Know and access:** learn what personal information we have about you and get a copy, including in a portable format
- **Correct** inaccurate personal information
- **Delete** personal information about you
- **Opt out of profiling** used for decisions with legal or similarly significant effects. We do not do this kind of profiling.
- **Limit** the use of sensitive personal information
- **Appeal** our decision about your request
- **Not be discriminated against** for exercising these rights

Residents of many US states have some or all of these rights, including California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia.

**How to make a request.** Send an email to [support@withparsley.com](mailto:support@withparsley.com) with the subject "Privacy request." We handle all privacy requests, including deletion requests, by email.

- **Tell us:** what you are asking for, the Restaurant(s) you have ordered from, and the phone number and email address you used, so we can find your records.
- **Verification:** we will verify your request by confirming you control that phone number or email address.
- **Response time:** we will respond within the time required by law, generally 45 days.
- **Authorized agents:** you may use an authorized agent to make a request for you. We will ask the agent for proof of your written permission, and we may ask you to verify your identity directly.

Some requests involve information that a Restaurant also holds. When you ask us to delete information, we delete it from the Services, including the Restaurant's view of it in Parsley. We may need to keep some information, for example records of completed orders that we or the Restaurant must keep for tax or legal reasons, or information needed to resolve a dispute or prevent fraud. To ask a Restaurant to delete information it holds outside Parsley, contact that Restaurant.

**Appeals.** If we deny your request, you can appeal by emailing [legal@withparsley.com](mailto:legal@withparsley.com) with the subject "Privacy appeal" within 60 days of our decision. We will respond within the time required by law. If you are not satisfied with the result, you can contact your state attorney general.

## Sale, sharing, and targeted advertising

We do not sell personal information for money, and we do not knowingly sell or share the personal information of anyone under 16.

When a Restaurant adds advertising tools such as Google Ads, Meta Pixel, or TikTok Pixel to its ordering website, information about your visit and purchase goes to those advertising companies, as described in [Tools added by Restaurants](#tools-added-by-restaurants). Under some state laws this counts as "selling," "sharing," or "targeted advertising." You can limit how these companies use your information with the browser and advertising controls described in [Your controls](#your-controls).

## Sensitive personal information

Some information we process may be considered sensitive under certain state laws:

- **Dietary information:** dietary restrictions you add to your profile, and food allergy or health details you include in order instructions or support messages
- **Accessibility settings:** the accessibility options you select on ordering websites
- **Call recordings:** audio recordings of calls to the AI voice assistant, where the Restaurant has turned recording on

We use sensitive personal information only to provide the Services you request, to keep the Services secure, and as otherwise permitted by law. We do not use it to infer characteristics about you. We do not create voiceprints or use call audio to identify you.

## Additional information for California residents

This section gives California residents the additional details required by the California Consumer Privacy Act, as amended. It covers the 12 months before the "Last Updated" date above.

**Categories of personal information.** In that period:

| Category | Examples | Disclosed for business purposes to | Sold or shared with |
|---|---|---|---|
| Identifiers | Name, email address, phone number, postal address, IP address, account and device identifiers | Restaurants, Stripe, delivery couriers, service providers | Advertising tools Restaurants add to their websites |
| Customer records | Name, contact details, card brand and last four digits | Restaurants, Stripe, delivery couriers, service providers | Advertising tools Restaurants add to their websites (contact details only) |
| Commercial information | Orders, purchase history, loyalty activity, gift cards | Restaurants, Stripe, delivery couriers, service providers | Advertising tools Restaurants add to their websites (items and purchase amounts) |
| Internet and other electronic network activity | Pages viewed, clicks, session replays, email opens | Restaurants, service providers | Analytics and advertising tools Restaurants add to their websites |
| Geolocation data | Location derived from the delivery address you provide | Restaurants, delivery couriers, service providers | Not sold or shared |
| Audio and electronic information | AI voice assistant transcripts and call recordings | Restaurants, service providers | Not sold or shared |
| Inferences | Guest segments, such as "regular" or "at risk," and usual orders | Restaurants | Not sold or shared |
| Sensitive personal information | Accessibility settings, dietary information | Restaurants (dietary information), service providers | Not sold or shared |
| Professional information (Restaurant staff only) | Employer, role, and permissions | Service providers | Not sold or shared |

- **Sources** are described in [Information we collect](#information-we-collect).
- **Purposes** for collecting, using, selling, and sharing are described in [How we use information](#how-we-use-information) and [Cookies, analytics, and advertising](#cookies-analytics-and-advertising).
- **Retention** is described in [How long we keep information](#how-long-we-keep-information).

**Your California rights.** You have the rights listed in [Your privacy rights](#your-privacy-rights), including to know, access, correct, and delete personal information, and to limit the use of sensitive personal information. We use sensitive personal information only for the purposes that California law allows without offering a right to limit.

**Notice of financial incentive.** Restaurants may offer loyalty programs, birthday rewards, and promotions through Parsley in exchange for your contact details, order history, and, for birthday rewards, your date of birth. We consider these programs a financial incentive under California law.

- **How you join:** by choosing to join, and you can leave at any time by contacting the Restaurant or us. The program terms are set by each Restaurant and shown on its loyalty page.
- **Value of your data:** we estimate it is reasonably related to the value of the rewards offered, based on the Restaurant's expected revenue from repeat orders by members, minus the cost of rewards.

**Shine the Light.** California residents may request information about disclosures of personal information to third parties for their direct marketing purposes. We do not share personal information with third parties for their own direct marketing. Restaurants receive your information as described above and, if you have agreed, may send you their own marketing.

**Minors.** If you are a California resident under 18 and have posted content to the Services, you can ask us to remove it by emailing [support@withparsley.com](mailto:support@withparsley.com). This does not ensure complete removal, for example if someone else has copied it.

## Security

We use administrative, technical, and physical safeguards designed to protect personal information. These include:

- encrypting data in transit
- handling card details only through Stripe
- hashing passwords
- role-based access controls for Restaurant staff
- audit logs of account changes

No method of transmission or storage is completely secure, so we cannot guarantee the security of your information. If you think your account has been compromised, contact us right away.

## Children

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. Our Platform Terms require users who place orders to be at least 18. If you believe a child has given us personal information, contact us at [legal@withparsley.com](mailto:legal@withparsley.com) and we will delete it.

## Where we process information

Parsley is based in the United States and the Services are intended for people in the United States. We store and process information in the United States, mainly in our cloud hosting providers' data centers. Some of our service providers may process information in other countries.

## Third-party websites and services

The Services link to and integrate with services we don't control, including Restaurants' own websites, Google, social media platforms, delivery services, and AI apps that Restaurants connect. Their privacy practices are governed by their own policies.

## Changes to this policy

We may update this policy from time to time. We will post the new version on this page and update the "Last Updated" date. If we make material changes, we will give additional notice, such as a notice in the Services or an email, before the changes take effect.

## Contact us

If you have questions about this policy or our privacy practices, contact us:

TinyGiantLabs LLC, d/b/a Parsley  
Louisville, Kentucky  
Phone: (855) 933-5474  
Email: [support@withparsley.com](mailto:support@withparsley.com)  
Legal and privacy appeals: [legal@withparsley.com](mailto:legal@withparsley.com)

Page: https://www.joinmunch.com/legal/privacy-policy