Privacy Policy

We only collect the information needed to take your order, deliver your food, and run our loyalty program. Specifically:

• Name and phone number — required to place an order and receive SMS updates about its status.
• Email address — used to send you an order receipt and (optionally) loyalty program updates.
• Delivery address — only collected if you choose delivery. Stored on your device and on our server for that order and as a saved address if you opt in.
• Payment information — handled directly by Stripe. We never see or store your full credit card number, CVV, or expiration date.
• Loyalty points history — orders you've placed and rewards you've redeemed, tied to your phone number.
• Device push token — when you sign in to our app, we store a token that lets Apple or Google send you a notification when your order is accepted or ready. The token cannot be used to track you outside our app.
• Basic device information — app version, operating system version, and crash diagnostics. Used to debug issues and improve the app.

• Process and deliver your orders.
• Send you SMS or push notifications about order status.
• Email you a receipt for each order.
• Award loyalty points and redeem rewards.
• Provide customer support if you contact us.
• Improve our menu, app, and service quality.

We do not sell your personal information. We do not use it for third-party advertising.

We use a small set of trusted service providers to operate our business. Each only receives the data they need to do their job:

• Stripe — processes payments. They see your card details and email. See stripe.com/privacy.
• Supabase — hosts our customer database. Your name, phone, email, address, and order history are stored here.
• Twilio — sends SMS order updates and login codes. They see your phone number and the SMS body.
• Resend — delivers our email receipts. They see your email address and the receipt body.
• Apple Push Notification service / Firebase Cloud Messaging — delivers order-status push notifications. They see the push token, the notification title, and the body.
• Uber Direct — fulfills delivery orders. Receives your name, phone, and delivery address.
• Google Places SDK — powers address autocomplete on our delivery form. Receives only the partial address you type while looking up an address.

We never share your information with advertisers, data brokers, or marketers.

Order history is kept for as long as you have an account, plus the time required by tax and accounting laws (typically 7 years). You can request deletion at any time (see below).

You can view, correct, or delete your personal information at any time:

• View and edit your profile — open the Account tab in the iOS or Android app, or sign in on the website.
• Delete your account — open the Account tab → "Delete Account." This permanently removes your profile, order history, and loyalty balance. (We retain anonymized transaction records as required by tax law.)
• Opt out of SMS — reply STOP to any of our text messages.
• Opt out of push notifications — disable notifications for the app in your phone's Settings.
• Email us — for any other request: hello@3seasonsthaibistro.com

California residents have additional rights under the CCPA, including the right to know what personal information we collect about you, the right to delete it, and the right to opt out of any sale of personal information (we don't sell yours). Email us at the address above to exercise these rights.

Our service is not directed at children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child has provided us information, please email us and we'll delete it.

If we change this policy in a material way, we'll update the date at the top and (for material changes affecting current customers) notify you in-app or by email.

Union Thais LLC
DBA 3 Seasons Thai Bistro
1506 Leimert Blvd
Oakland, CA 94602
(510) 479-3339
hello@3seasonsthaibistro.com