Fresh Dash Privacy Policy

Effective Date: May 11, 2026

Last Updated: May 11, 2026

Notice for California Residents: This Privacy Policy includes additional disclosures required by the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). See Sections 2.1, 2.2, the Retention table, and "Your California Privacy Rights" for details. To exercise your rights, visit our Your Privacy Choices page or email hi@freshdashmarket.com.

1. Introduction

Welcome to Fresh Dash! This Privacy Policy describes how Fresh Dash LLC ("Fresh Dash," "we," "us," or "our") collects, uses, shares, and protects your personal information when you visit our website freshdashmarket.com (the "Site"), use our mobile applications (if any), or otherwise interact with our services (collectively, the "Services").

We are committed to protecting your privacy. Please read this policy carefully to understand our practices regarding your information and how we will treat it. By using our Services, you agree to the collection, use, and sharing of your information as described in this Privacy Policy. If you do not agree, please do not use our Services.

2. Information We Collect

We collect information about you in various ways when you use our Services. This information may include:

Information You Provide Directly:

• Account Information: When you create an account, we may collect your name, email address, phone number, password, and delivery address(es).
• Order Information: When you place an order, we collect information about the products you purchase, payment information (processed by our third-party payment processors), delivery instructions, and recipient details if different from yours.
• Communications: When you contact us via email (including hi@freshdashmarket.com), phone, or other channels, we collect the information in your communications.
• Promotions and Surveys: Information you provide when participating in surveys, contests, or promotional offers.
• User Content: Reviews, ratings, photos, or other content you submit through the Services.

Information Collected Automatically:

• Device and Usage Information: When you access our Site or Services, we automatically collect information about your device (IP address, operating system, browser type, device identifiers) and your usage patterns (pages visited, time spent, links clicked, search queries, referring URL).
• Location Information: We may collect your general location (e.g., based on IP address) or precise location (e.g., through device settings, if you grant permission) to provide location-based services like identifying service availability or estimating delivery times.
• Cookies and Similar Technologies: We use cookies, web beacons, pixels, and other technologies to collect information about your browsing activities, personalize your experience, and analyze traffic. Please see our Cookie Policy or Section 5 below for more details.

Information from Third Parties:

• Service Providers: We may receive information from third-party service providers, such as payment processors (transaction confirmation, not full payment details) or delivery partners.
• Marketing Partners: We may receive information from marketing or advertising partners.
• Social Media: If you interact with us on social media platforms or use social login, we may receive information from those platforms according to your privacy settings.

2.1 Categories of Personal Information Collected (CCPA / CPRA)

The following table summarizes the categories of personal information ("PI") we have collected in the past 12 months under the CCPA's statutory categories, including the sources, business purposes, third parties we disclose to, and the retention period for each category.

We do not collect biometric information (Category E), sensory data (Category H), professional / employment-related information (Category I), education information (Category J), or protected classification characteristics (Category C — such as race, religion, sexual orientation, etc.).

2.2 Sensitive Personal Information (SPI)

Under the California Privacy Rights Act (CPRA), certain types of personal information are categorized as "sensitive." We collect the following sensitive PI strictly to provide our Services, and we do not use or disclose sensitive PI for the purpose of inferring characteristics about you:

• Account login credentials: Email + password. Passwords are cryptographically hashed and are never stored in plain text. Used solely for authentication.
• Precise geolocation: Only when you grant browser permission, used for delivery routing and identifying nearby pickup points. Not retained beyond the session.
• Payment-related information: Card brand and last four digits. The full card number, expiration date, and CVC are collected and processed directly by Stripe and never reach Fresh Dash's servers (see "Payment Data Processing" below).

You have the right to limit our use and disclosure of your sensitive PI to those purposes necessary to provide the Services. To exercise this right, visit our Your Privacy Choices page or email hi@freshdashmarket.com with the subject "Limit Sensitive PI". We will respond within 15 business days.

2.3 Payment Data Processing

Fresh Dash uses Stripe, Inc. ("Stripe", a Delaware corporation) as our payment processor for all transactions on the Services.

What Stripe Collects Directly

When you provide payment information through our checkout, the following data is collected and transmitted directly to Stripe's secure servers, never touching Fresh Dash systems:

• Full card number, expiration date, and CVC (or equivalent details for non-card methods such as Apple Pay, Google Pay, Alipay, WeChat Pay)
• Billing name and billing address
• Device fingerprint and IP address (used by Stripe Radar for fraud prevention)

What Fresh Dash Receives From Stripe

• Transaction status (succeeded, processing, failed)
• Payment method brand and last four digits (for display on order receipts)
• Stripe transaction / PaymentIntent identifier (for refunds and reconciliation)
• Risk assessment summary from Stripe Radar (e.g., normal / elevated risk) — used to decide whether to approve, hold, or decline an order

What Fresh Dash Shares With Stripe

• Customer name, email address, and phone number (for receipts and fraud prevention)
• Order amount, currency, and delivery address (for fraud screening and tax compliance)
• Order identifier and order history (for refund processing and dispute resolution)

Stripe and its sub-processors may store and process your data on servers located in the United States and other countries. By using our payment functionality, you acknowledge that your payment data may be transferred outside your country of residence. Stripe is certified under PCI DSS Level 1, SOC 2 Type II, and ISO 27001. For details on Stripe's data practices, see Stripe's Privacy Policy.

PCI DSS Scope: Because Fresh Dash uses Stripe's hosted payment elements, we do not store, process, or transmit full cardholder data. Our PCI DSS compliance scope is limited to SAQ-A.

SMS & Text Messaging Privacy:

When you opt in to receive text messages (SMS) from FreshDashMarket, we collect and store your mobile phone number, your carrier's name, and the date/time of your opt‑in consent. This information is used only to deliver the text messages you have requested (e.g., order updates, promotional offers, or alerts).

We will never sell, rent, or share your mobile opt‑in data or consent status with any third party or affiliate for their own marketing purposes. Your consent to receive SMS messages is not shared with any outside organization.

No third‑party lead lists or purchased phone numbers are used for SMS marketing. All SMS recipients have provided direct, explicit consent to FreshDashMarket through a compliant opt‑in mechanism (e.g., checking an unchecked box on our website or mobile app).

You may revoke your consent at any time by replying STOP to any message. For help, reply HELP. Standard message and data rates may apply. For questions about how we handle SMS data, contact us at hi@freshdashmarket.com.

3. How We Use Your Information

We use the information we collect for various purposes, including:

• Providing and Improving Services: To operate, maintain, and improve our Site and Services, process your orders, manage deliveries, and manage your account.
• Personalization: To personalize your experience, such as showing relevant products or offers.
• Communication: To communicate with you about your orders, account, updates to our Services or policies, and respond to your inquiries sent to hi@freshdashmarket.com or other channels.
• Marketing and Advertising: To send you promotional communications, newsletters, and offers (you can opt-out as described in Section 6).
• Analytics: To understand how users interact with our Services, monitor and analyze trends, and improve our offerings.
• Security and Fraud Prevention: To detect, prevent, and respond to fraud, abuse, security risks, and technical issues.
• Legal Compliance: To comply with legal obligations, resolve disputes, and enforce our agreements (including our Terms of Service).

4. How We Share Your Information

We do not sell or share your personal information as those terms are defined under the CCPA / CPRA, including for cross-context behavioral advertising. We do not currently use any third-party advertising pixels (such as Meta Pixel, TikTok Pixel, or Google Ads conversion tracking). Should this change in the future, we will update this Privacy Policy and provide a clearly labeled opt-out before any such sharing begins.

We disclose your information to the following recipients, distinguishing between Service Providers (bound by written contracts limiting use to the services they provide for us) and Third Parties (independent recipients):

Service Providers (not "sale" or "share" under CCPA / CPRA)

• Stripe, Inc. — payment processing, fraud prevention (Radar), refund and chargeback management
• Mapbox — address geocoding, map rendering, route planning
• Cloudflare — web infrastructure, content delivery, image storage (R2 buckets)
• PostHog — product analytics. Configured in identified_only mode (anonymous visitors are not tracked into person profiles); traffic is routed through our own reverse proxy (g.freshdashglobal.com); session recording is disabled; the SDK honors Global Privacy Control (GPC) signals automatically
• Delivery and logistics partners — order fulfillment
• Email / SMS / push notification providers (transactional communications)
• Customer support tooling (operated by us or under written DPA)

Other Recipients

• Business Transfers: If Fresh Dash is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction.
• Legal Requirements: We may disclose your information if required by law, subpoena, or other legal process, or if we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.
• With Your Consent: We may share your information for other purposes with your explicit consent.
• Aggregated or De-identified Data: We may share aggregated or de-identified information that cannot reasonably be used to identify you.

5. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect information about your interaction with our Services. Cookies are small data files stored on your device. We may use session cookies (expire when you close your browser) and persistent cookies (remain until deleted). These technologies help us operate our Services, remember your preferences, analyze usage, and for advertising purposes.

You can typically control cookies through your browser settings. However, disabling cookies may affect the functionality of our Services.

For more information on how we use cookies, please see our Cookie Policy.

5.1 Retention of Personal Information

We retain personal information only as long as necessary to fulfill the purposes for which it was collected, comply with our legal obligations, resolve disputes, and enforce our agreements. The following table summarizes our standard retention periods:

Where we are subject to overriding legal obligations (such as ongoing litigation, government investigation, or fraud investigation), data may be retained beyond the standard periods until those obligations are satisfied.

6. Data Security

We implement reasonable administrative, technical, and physical safeguards designed to protect the personal information we collect against unauthorized access, use, disclosure, alteration, or destruction. However, no internet transmission or electronic storage is completely secure. Therefore, we cannot guarantee its absolute security.

7. Your Choices and General Rights

You have certain choices and rights regarding your personal information:

• Account Information: You can review and update your account information by logging into your account settings.
• Marketing Communications: You can opt-out of receiving promotional emails from us by following the unsubscribe instructions in those emails or by contacting us at hi@freshdashmarket.com. You may still receive non-promotional communications regarding your account or orders.
• Location Information: You can disable location sharing through your device settings.
• Cookies: You can manage cookies through your browser settings and learn more through our Cookie Policy.

7.1 Your California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

Right to Know

You may request to know what categories of personal information we have collected, the sources of that information, the business or commercial purposes for collection, the categories of third parties with whom we share PI, and the specific pieces of PI we hold about you. See Section 2.1 above for the categorical disclosures.

Right to Delete

You may request that we delete personal information we have collected from you, subject to exceptions permitted by law (e.g., legal retention obligations for tax records, fraud prevention, completion of pending transactions).

Right to Correct

You may request that we correct inaccurate personal information we maintain about you. Upon receiving a verifiable request, we will use commercially reasonable efforts to correct the inaccurate information and respond within 45 days. You can also self-correct most account information by signing in to your account.

Right to Opt-Out of Sale or Sharing

You may opt out of the sale or sharing of your personal information at any time. As stated in Section 4, we do not currently sell or share your PI for cross-context behavioral advertising, but we provide an opt-out mechanism regardless:

• Visit our Your Privacy Choices page to submit an opt-out request
• We honor Global Privacy Control (GPC) signals (Sec-GPC: 1) sent by your browser as a valid opt-out request

Right to Limit Use of Sensitive Personal Information

You may request that we limit our use and disclosure of your sensitive PI (as described in Section 2.2) to the purposes necessary to provide the Services. We do not currently use sensitive PI for purposes beyond what is necessary, but you may still submit a request via our Your Privacy Choices page.

Right to Non-Discrimination

We will not discriminate against you for exercising any of your CCPA / CPRA rights. You will not receive different prices, lower quality of service, or be denied access to our Services solely for exercising your rights, except where we are permitted by law to offer a different price tied to a clearly disclosed financial incentive (see our Notice of Financial Incentive).

How to Submit a Request

1. Email hi@freshdashmarket.com with the subject "Privacy Request — [Right Name]", or submit through our Your Privacy Choices page
2. Provide enough information to verify your identity, including the email associated with your account and recent order numbers (if applicable)
3. We will acknowledge your request within 10 business days and respond substantively within 45 days. Complex requests may require an additional 45 days, in which case we will notify you of the extension and the reason

Identity Verification

We verify your identity based on the sensitivity of the request:

• Right to Know / Access: Reasonable degree of certainty. Typically we match the email associated with your account plus recent order details.
• Right to Delete or Correct: Reasonably high degree of certainty. We may request additional information such as a government-issued ID or matching recent transaction data. We minimize and securely delete any verification information after use.

Authorized Agent

You may designate an authorized agent to submit requests on your behalf. We require:

• Written authorization signed by you naming the agent
• Proof of the agent's identity
• We may still contact you directly to verify the request

Shine the Light

Under California Civil Code §1798.83, California residents may request, once per year, information regarding our disclosures (if any) of personal information to third parties for their direct marketing purposes. To submit such a request, email hi@freshdashmarket.com with the subject "Shine the Light".

Do Not Track and Global Privacy Control

Our Services do not currently respond to "Do Not Track" (DNT) signals. However, we honor Global Privacy Control (GPC) signals as a valid opt-out of any sale or sharing of personal information, in accordance with the California Attorney General's enforcement guidance.

7.2 Other Region-Specific Rights

• European Economic Area (EEA), UK, Switzerland Residents: If you are located in these regions, under the General Data Protection Regulation (GDPR) or similar laws, you may have rights including the right to access, rectify, erase, restrict processing, object to processing, and data portability. Please contact hi@freshdashmarket.com to exercise these rights.

8. Children's Privacy

Our Services are intended for users 16 years of age and older.

• Under 13: We do not knowingly collect personal information from children under 13. If we become aware that we have collected such information without verifiable parental consent, we will take steps to delete it. This complies with the Children's Online Privacy Protection Act (COPPA).
• Ages 13–16 (California residents): Under California Civil Code §1798.120(c), we will not sell or share the personal information of consumers under 16 without affirmative authorization (opt-in). For consumers between 13 and 16, this opt-in must come from the consumer themselves; for consumers under 13, opt-in must come from a parent or guardian. As stated in Section 4, we do not currently sell or share personal information.

If you believe we have inadvertently collected information from a child without proper consent, please contact hi@freshdashmarket.com and we will promptly delete it.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated policy on the Site, updating the "Effective Date," and/or through other appropriate communication channels. We encourage you to review this policy periodically.

10. Accessibility

We are committed to digital accessibility for all users, including people with disabilities. We strive to conform to the Web Content Accessibility Guidelines (WCAG) 2.1, Level AA. If you experience a barrier on our website, or need help completing an order in another way, please email hi@freshdashmarket.com and we will respond within one business day. For our full statement, see our Accessibility Statement.

11. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at:

Email: hi@freshdashmarket.com
Mailing Address: Fresh Dash LLC, 1119 N KRAEMER BLVD, ANAHEIM, CA 92806