Privacy Policy

Account and profile. Your name, email address, phone number, optional delivery ZIP code, email-verification status, and account dates. We store a one-way password hash—not your readable password— along with short-lived verification, password-reset, and email-change tokens. We also keep your email notification preferences—whether you receive promotional offers, and whether you have opted in to new pop-up announcements and delivery-availability notices.

Orders and fulfillment. Items, options, quantities, promo code, prices, tax, fulfillment type and slot, contact details, delivery address, delivery instructions, and notes you choose to provide, including allergy or dietary information.

Payment and refund records. Square payment and order references, payment status, receipt URL, card brand and last four digits, refund reference and status, and payment/refund dates. Your full card number and security code are entered into Square's payment form and are not received or stored by our servers.

Catering and support. Information submitted in the catering form—name, email, optional phone, event date, estimated guest count, and message—and any information you send when contacting us. Catering inquiries are saved to our records so we can respond and manage them; if you are signed in when you submit, the inquiry is linked to your account.

Device and security data. IP address and basic request data used for security, troubleshooting, and rate limits; authentication and anti-forgery cookies; and service logs maintained by our hosting and infrastructure providers.

Cart on your device. Your cart contents are stored in your browser's local storage under “ngo-cart” so they remain available after a refresh. This cart is sent to us only when needed for checkout. You can remove it by clearing the cart or your browser's site data.

Most information comes directly from you when you register, update your profile, build a cart, check out, or contact us. We also receive transaction and refund information from Square, address results from the services described below, and technical information automatically when your browser communicates with the site.

• Create and secure your account; verify your email; and support password resets.
• Validate, price, accept, prepare, deliver, and keep a history of your orders.
• Process payments, receipts, cancellations, refunds, tax, and accounting records.
• Send order confirmations, status notices, and service-related account emails.
• Send promotional offers and news to account holders, which you can turn off at any time in Member Settings or from the unsubscribe link in any such email.
• With your opt-in, announce new pop-ups or delivery opening in your area.
• Respond to catering inquiries, support requests, allergies, and delivery instructions.
• Enforce slot, promo, cart, and request limits and protect the service from fraud or abuse.
• Diagnose failures, maintain the website, and comply with legal obligations.

We do not sell personal information and do not use it for cross-context behavioral advertising.

We disclose only the information reasonably needed for the following services:

Square. Processes card payments, calculates the Square order, generates receipts, and handles refunds. Square receives the payment token and order details such as items, options, price, tax, discount, delivery fee, and our order reference.

Resend. Delivers account, order, status, and catering emails, promotional emails you have not unsubscribed from, and announcement emails you have opted in to. It receives the recipient address, email content, and related delivery metadata. Catering form submissions are emailed to the Ngõ owner and are not published.

Vercel and our database host. Provide website hosting, server execution, operational logs, and PostgreSQL storage for account, ordering, schedule, and security records.

Photon / OpenStreetMap. Provides delivery-address suggestions. When you use autocomplete, the partial address text you type is sent from our server to Photon. We use the results only to show possible Washington addresses.

Washington Department of Revenue. Receives a delivery street address and ZIP code to verify the address and determine the applicable destination sales-tax rate. Pickup tax is based on the pickup location.

We may also disclose information to professional advisers, authorities, or another party when reasonably necessary to comply with law, respond to valid legal process, protect customers or the public, investigate fraud or security incidents, enforce our agreements, or complete a business reorganization. We do not disclose customer information merely because someone asks for it.

We use essential cookies for sign-in sessions and request security. These cookies are necessary for account and checkout features. The cart uses local storage as described above; local storage is not a cookie and remains on your device until the cart or site data is cleared.

We currently do not use advertising pixels, third-party ad cookies, or third-party analytics trackers. Because the site does not use data for targeted advertising, it does not currently respond differently to “Do Not Track” or Global Privacy Control signals.

We use the following practical retention rules rather than keeping every record indefinitely:

• Account and profile information is kept while the account is active and until a valid deletion request is completed.
• Order, payment, refund, tax, and related contact records are kept as needed for fulfillment, disputes, fraud prevention, and legal, tax, and accounting obligations.
• Catering inquiries and support correspondence are kept while we respond and for a reasonable follow-up and business-record period.
• Verification and reset tokens expire or are replaced; rate-limit records expire after their security window; provider logs follow the relevant provider's retention settings.

When deletion is appropriate, we delete or de-identify information. We may retain limited records where required by law or necessary to document a transaction, resolve a dispute, prevent fraud, or enforce an agreement.

You can review and correct your name, email, phone number, ZIP code, and password from Member Settings. You can also ask us to provide, correct, or delete personal information associated with your account, or object to a use you believe is improper, by emailing ngo.seattle2024@gmail.com.

You control marketing and announcement emails separately in Member Settings, or from the unsubscribe link included in those emails. Promotional offers are on for account holders and can be switched off at any time; new pop-up announcements and delivery-availability notices are off until you turn them on. Order confirmations, status updates, and other service emails are necessary to run your orders and are not marketing.

Include the email address used for your account and enough detail for us to understand the request. We may verify that you control the account before acting. We will respond as required by applicable law and explain if we must retain specific transaction records or cannot fulfill part of a request. We will not discriminate against you for making a privacy request.

We use HTTPS, hashed passwords, signed authentication sessions, request-origin checks, access controls, rate limits, payment tokenization, and restricted owner tools. No online service can promise absolute security. Use a unique password and contact us promptly if you believe your account or order information has been compromised.

The site is not directed to children under 13, and we do not knowingly create accounts for or collect personal information directly from children under 13. If you believe a child has provided information to us, contact us so we can review and remove it where appropriate.

We may revise this policy when our practices or service providers change. We will update the effective date above and provide additional notice when required by law. The version posted when information is collected describes how we handled it at that time.

For privacy questions or requests, email ngo.seattle2024@gmail.com. For ordinary order questions, you may also reach us on Instagram at @ngo.seattle.