NIBBLS INC
Privacy Policy
Last Updated: July 6, 2026
1. INTRODUCTION AND SCOPE
1.1 About This Policy
This Privacy Policy explains how NIBBLS INC ("NIBBLS," "we," "us," or "our") collects, uses, shares, and protects personal information when you use the NIBBLS platform, including our website at nibbls.app, our mobile applications, and related services (together, the "Service"). It applies to Diners, Restaurants, Creators, and visitors who use the Service.
1.2 What This Policy Does Not Cover
This Policy does not cover the practices of Restaurants, payment processors, or other third parties that operate their own services, and it does not cover any site or service that has its own privacy policy. Your use of the Service is also governed by our Terms of Service.
1.3 Effective Date
This Policy is effective as of July 6, 2026.
2. WHO THIS POLICY COVERS
2.1 User Roles
The Service connects three groups of users. Diners browse and order food. Restaurants list menus and fulfill orders. Creators post food-related video content and may earn commissions when their content drives orders. The information we collect and how we use it depends in part on your role.
2.2 How Roles Affect This Policy
Where a practice applies only to a particular role, we say so. Otherwise, the practice applies generally to users of the Service.
3. INFORMATION WE COLLECT
3.1 Account and Contact Information
Name, email address, phone number, username, password, and similar details you provide when you create or manage an account. We also collect a mobile number when you enter one at checkout, including when you check out without an account. Checkout requires an email address on every order, including a guest order. We use that email to prefill Stripe checkout and, when we send one, to send an order confirmation. Entering the email does not by itself create an account. If you check out as a guest and choose to create an account, we also use the email and phone you entered to create that account. We do not put your email in the Restaurant’s Square order note. If you enter a delivery address, we use it to quote and perform delivery and to share the dropoff with the Restaurant and the courier.
3.2 Order Information
The restaurants and items you order, order history, pickup or delivery details, special instructions, and related communications.
3.3 Payment Information
Limited payment details needed to process a transaction, such as payment tokens, the type of payment method, and transaction status. We do not store full payment card numbers. See Section 8 for more on payments.
3.4 Creator Information
For Creators, profile details, social handles, the content you post, attribution links or codes, performance data, and payout and tax information needed to pay commissions.
3.5 Restaurant Information
For Restaurants, business contact details, representative information, menu and order data, and information from point-of-sale integrations.
3.6 Public Content
Videos, captions, comments, profile information, and other content that users post through the Service.
3.7 Device and Usage Information
IP address, device identifiers, browser and app information, and information about how you interact with the Service, including attribution events that link content to orders.
3.8 Location Information
Approximate location and, with your permission, precise location, as described in Section 11.
3.9 Communications
Messages, support requests, survey responses, and related records when you contact us or we contact you.
3.10 Sensitive Information
We do not seek to collect sensitive information beyond what is needed to operate the Service. We treat precise location and account credentials as sensitive and handle them accordingly.
3.11 Checkout choices
At checkout we may ask you to make separate choices. A box that is shown unchecked is off until you turn it on.
- An email address is required to place an order. It is sent to Stripe so card checkout can prefill it. It is not, by itself, consent to create an account or to join a directory.
- Creating an account is optional if you are not already signed in.
- Saving your name, email, and phone in the Restaurant’s Square customer directory, and enrolling your phone in that Restaurant’s rewards when a program is active, happens only if you check that box.
- Order-status texts are sent only if you check that box, and only for the messages described in Section 5.5.
- Promotional email or promotional texts are sent only if we offer that choice and you select it. We do not offer that choice today. Choosing an account, a directory, or an order-status text is not consent to marketing.
We still send your name and phone to the Restaurant’s Square account so the Order can be prepared and handed over, even when you do not check the directory box. We do not put your email in the Square order note.
3.12 Shared carts
A shared cart is built and is not enabled in this beta. If one is offered, people who have the join link can see the cart name, each participant’s display name, the items and modifiers, each item note, and the order note. There is no setting to hide an item, a note, or a display name from that group. We store those details for the life of the cart. The person who starts the cart pays. Item notes we send to the Restaurant are prefixed with the participant’s display name, so the Restaurant sees that name with the note. A later control to hide some of this from the group is not in the product. When a shared cart is on, the group sees all of it.
4. SOURCES OF INFORMATION
We collect information directly from you when you use the Service, automatically through your device and our technologies, and from third parties such as Restaurants, point-of-sale providers, payment and payout processors, analytics providers, and, where you connect them, social platforms.
5. HOW WE USE INFORMATION
5.1 Operating the Service
To create and manage accounts, display menus, process and fulfill orders, sync restaurant point-of-sale systems, and enable content and discovery.
5.2 Payments and Payouts
To process Diner payments and to calculate and pay Creator commissions.
5.3 Attribution
To determine whether a Creator's content drove an order, calculate commissions, and report performance.
5.4 Safety and Fraud Prevention
To verify users, detect and prevent fraud and abuse, and protect the Service and its users.
5.5 Support and Communications
To respond to your requests and send transactional messages about your account and orders. Order-status text messages (order confirmation, pickup time, ready for pickup, delay, and cancellation) are sent only after you check an optional unchecked box at checkout. Entering a phone number without that box is not consent. These texts are not promotional. Message frequency varies. Message and data rates may apply. If we later offer promotional email or promotional texts, we will send them only after a separate choice, and you will be able to stop marketing without stopping order-status texts. That offer is not available now.
5.6 Analytics and Improvement
To understand how the Service is used and to improve it.
5.7 Marketing
To send promotional messages, subject to your choices and applicable law.
5.8 Legal and Compliance
To comply with law, enforce our terms, and establish or defend legal claims.
6. HOW WE SHARE INFORMATION
6.1 Restaurants
When you place an Order, we share the information the Restaurant needs to prepare and fulfill it. If a third-party courier delivers your Order, we also share the details needed to complete the delivery. In New York City, we share order-customer information with the fulfilling Restaurant unless you tell us not to, as described in Section 14. When the Restaurant uses Square to receive the order, we send your name and phone number to that Restaurant’s Square account so the order can be prepared and handed over. We do not put your email address in the Square order note. When you choose delivery, we share the dropoff address and the contact details needed to complete delivery with the Restaurant and with the courier provider that quoted and performs that delivery.
6.2 Creators
We share limited attribution and performance information with Creators so they can understand which content drove orders. We do not share your payment details with Creators.
6.3 Service Providers
We share information with vendors that perform services for us, such as hosting, payment and payout processing, point-of-sale integration, text-message delivery, analytics, customer support, and fraud prevention. We require these providers by contract to keep the information confidential and to use it only to provide services to us. Mobile numbers and SMS opt-in data are not shared with third parties or affiliates for their own marketing. The restaurant fulfilling the Order and the text-message provider may receive a mobile number to perform the Order or to send the text you opted into.
We use the following providers for the purposes in this Policy:
- Square, for the restaurant’s menu and kitchen ticket, and for the customer directory and rewards when you opt in. Square does not take the card payment.
- Stripe, for card payments in embedded checkout (including the email used to prefill checkout) and for creator payouts.
- A text-message provider (Twilio), when we send an order-status text you opted into, or a verification text for your account. We do not send promotional texts.
- A courier provider (Nash), when delivery is offered, to quote and perform delivery.
- Analytics and diagnostics providers named in Section 10, when those tools are in use.
- Google, for Google Sign-In and for reCAPTCHA bot defense on forms.
- Hosting, customer support, and fraud-prevention providers under contract.
6.4 Legal and Protective
We may disclose information to comply with law, respond to lawful requests, enforce our terms, or protect the rights, safety, and property of NIBBLS, our users, or others.
6.5 Business Transfers
We may disclose information in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy or a successor policy.
6.6 Professional Advisors
We may share information with our auditors, lawyers, and similar advisors as needed.
7. SALE, SHARING, AND TARGETED ADVERTISING
We do not sell your personal information for money. We do not share your personal information for cross-context behavioral advertising, and we do not use it to serve you targeted advertising across unaffiliated websites or apps. We use analytics providers to understand and improve the Service. Where the law gives you the right to opt out of certain sharing or targeted advertising, or requires us to honor browser or device signals such as Global Privacy Control, we will do so. If our practices change, we will update this Policy and provide the choices the law requires.
8. PAYMENTS
You submit your card to Stripe in embedded checkout. We send Stripe the email from checkout so that form can prefill it. Nibbls receives limited information such as payment status, amount, and what we need for refunds, fraud prevention, and tax reporting. A tip you select is part of that charge. We do not store full payment card numbers. Creator payouts are processed by Stripe.
We save your name, email address, and phone number in the Restaurant’s Square customer directory, and we may enroll your phone number in that Restaurant’s Square rewards program, only if you check the optional box at checkout. Leaving that box unchecked means we do not create that directory profile. Your name and phone number are still sent for the order, as described in Section 6.1.
Creator payouts are processed by Stripe. When you receive a payout, Stripe handles that information under its own terms. We receive limited information needed for payouts and tax reporting.
9. PUBLIC CONTENT AND ATTRIBUTION
9.1 Public Content
Content that Creators and Restaurants post, including videos, captions, profile details, and comments, is visible to others and may be promoted within the Service. Do not post anything you want to keep private or that you do not have permission from all visible persons or entities involved to post or share.
9.2 Attribution
We use links, codes, and interaction data to determine whether a Creator's content drove an order. We use this information to calculate commissions, detect fraud, and report performance.
10. COOKIES AND TRACKING TECHNOLOGIES
We and our providers use cookies and similar technologies to keep you signed in, remember your preferences, measure and analyze use of the Service, and support security and fraud prevention. You can control cookies through your browser or device settings, and where required we will present choices for non-essential technologies. Some features may not work properly if you disable certain cookies.
When you allow analytics, we use those technologies to understand how the Service is used and to keep it reliable. Depending on what is enabled, that includes:
- RudderStack, which receives product usage events from us and sends them to Google Analytics 4 and Mixpanel. The pages you use do not load a Google Analytics tag or a Mixpanel tag directly.
- Mux, for video playback quality.
- Sentry, for error diagnostics in the browser.
We do not use these tools to serve ads across other companies’ sites. A marketing-cookie category exists and is off. We do not load advertising pixels. You can reject analytics in cookie settings. Where your browser sends Global Privacy Control, we treat that as an opt-out of analytics. Necessary cookies, including sign-in and bot defense, stay on. Google Sign-In and reCAPTCHA are described in Section 6.3. They are not this analytics list.
11. LOCATION INFORMATION
We use approximate location, such as from your IP address, to show nearby restaurants and relevant content. With your permission, we may use precise location from your device to improve discovery, support delivery or pickup, and help prevent fraud. You can turn off precise location in your device settings, though some features may be limited.
12. DATA RETENTION
We keep personal information for as long as needed to provide the Service and for the purposes described in this Policy. How long we keep information depends on the type of information and the reason we have it, including the life of your account, completing and recording transactions, resolving support issues, preventing fraud, and meeting legal, tax, and accounting obligations. When we no longer need information, we delete it or deidentify it, subject to backups and legal holds. We may create aggregated or deidentified information and use it for any lawful purpose. We keep that information deidentified and do not try to reidentify it.
13. SECURITY
We use reasonable administrative, technical, and physical safeguards designed to protect personal information, including access controls and encryption where appropriate. No method of storage or transmission is completely secure, so we cannot guarantee absolute security. If a security incident affects your information, we will notify you as required by law.
14. YOUR PRIVACY RIGHTS AND CHOICES
14.1 Your Choices
You can update your account information and adjust your device permissions. You can reject analytics in cookie settings. We do not send promotional email or promotional texts. If we do later, you will be able to unsubscribe without stopping transactional messages about your account or orders, and without stopping order-status texts you opted into. You can stop order-status texts by replying STOP. STOP cancels order-status texts for that mobile number. It does not delete the number or close your account. Reply HELP for help.
14.2 New York City Order Data
If you order in New York City, you may ask us not to share your order-customer information with the fulfilling Restaurant by contacting us at the address in Section 19.
14.3 Rights
Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to opt out of certain processing, to limit the use of sensitive information, and to appeal a decision on your request. Section 15 describes these rights further.
14.4 How to Exercise Rights
You can submit a request through the Service or by contacting us at the address in Section 19. We will verify your request using information associated with your account and respond within the time the law requires. You may use an authorized agent where the law allows, and we may take steps to confirm the agent's authority.
14.5 No Retaliation
We will not deny you service, charge you a different price, or provide a different level of service because you exercised your privacy rights, except as the law allows.
15. STATE-SPECIFIC RIGHTS
Some states give residents specific privacy rights. Depending on your state, these may include the right to know and access the personal information we hold about you, to correct or delete it, to obtain a portable copy, to opt out of the sale or sharing of personal information and of targeted advertising, to limit the use of sensitive personal information, and to appeal our response to a request. As described in Section 7, we do not sell personal information for money or use it for targeted advertising across unaffiliated sites. To exercise any right, use the channels in Section 14. If we deny your request, you may appeal by contacting us at the address in Section 19, and you may contact your state regulator if you are not satisfied.
16. CHILDREN'S PRIVACY
The Service is not directed to children under 13, and we do not knowingly collect their personal information. Diners must be at least 13, and if under 18 may use the Service only with the involvement of a parent or guardian. Creators and Restaurant account holders must be at least 18. If we learn that we have collected information from a child under 13, we will delete it. Parents and guardians may contact us at the address in Section 19.
17. INTERNATIONAL USERS
The Service is intended for users in the United States. If you access it from outside the United States, you understand that your information will be processed in the United States, where privacy laws may differ from those in your location.
18. CHANGES TO THIS POLICY
We may update this Policy from time to time. We will post the updated version, revise the effective date, and, where the changes are material, provide additional notice.
19. CONTACT US
555 5th Ave, 14th Floor
New York, NY 10017
Privacy: privacy@nibbls.app