Privacy Policy

§ 01What this policy covers

This is the privacy policy for yummy-future.com, the site you're reading, run by Yummy Future Inc. It covers every page here, the forms on them, the shop, and your customer account.

It doesn't cover the app you order from inside our cafés, or a site we link to that belongs to someone else. Those are separate from this one.

§ 02What you give us

Most of what we hold, you typed in yourself:

• Contact details: your name, email address, phone number, and company name, when you fill out a form here (reservations, catering, product interest, partnerships, or a job application).
• What you write: the message you sent us, in your words.
• Files you attach: a resume on a job application, or photos, video and PDFs on the forms that ask for them. They stay with the rest of your inquiry.
• Account details: your email and name if you open a customer account. Your password is handled by the company that runs our sign-in, and we never see it in readable form.
• Order details: if you buy something in the shop, we keep what you ordered, your name and email, and the shipping address you gave at checkout, so the order can be packed and sent.
• Problem reports: if you use the "Report a problem" button, we keep what you wrote. So we can reproduce what you saw, it also sends which page you were on, your screen size, and the browser identifier your browser hands to every site it visits. Leaving your email is optional, and we only use it to reply to you.
• Investor records: if you invested in us through our crowdfunding campaign, we hold the investor list that platform gives us, including who invested and at what level, so your perks page can show what you're owed.

Two things we don't take. Card numbers never reach this site: our payment processor collects them on its own checkout pages. We do use one advertising measurement tool, for our own ads only; § 07 says exactly what it sends and how to switch it off.

§ 03What we collect on our own

Separate from everything above, we watch how the site itself is doing: is a page broken, is it slow, is anyone using it. This part happens without you typing anything.

• Our own measurements, always on: a random session number that isn't tied to your name, the wording of an error when a page breaks, how fast pages loaded and answered, and which pages were viewed. It doesn't collect your name, your email, or anything you type into a form, and it never runs without being disclosed here.
• A third-party analytics service: it tells us which pages get used and how people move through the site, and it records session replays, a playback of the clicks, scrolling and mouse movement on a page.

What a replay does and doesn't show:

• What you type into a form is visible in the replay. That is deliberate: when a booking, an application or a sign-up doesn't go through, it's how we see what went wrong and who it went wrong for.
• Passwords are the exception. They're blanked in your browser before the recording is ever sent, so the real characters never leave your device. Same for a sign-in link or token that lands in the address bar.
• The ordinary text on the page is visible too, so we can tell what you were looking at.
• Replays aren't attached to your account, though a form you filled in will show the details you typed into it.

We also see your IP address, the way every website does, because a page can't be delivered without one. Our own servers use it once to work out a rough country, checking a list stored on the server itself so nothing goes to an outside lookup service, and then drop it. Only the two-letter country code travels onward with the usage data; your IP address doesn't. We remember the region in your browser so we don't have to work it out again on your next visit.

That region decides whether the analytics service hears from us at all:

• EU, UK and EEA visitors: opt-in. We ask with a banner before the analytics service loads or receives anything, replays included. Decline, or don't answer, and only our own always-on measurements keep running.
• Everywhere else, including the US: opt-out by default. Events and replays go out without a banner. If you'd rather they didn't, email us and we'll walk you through switching it off.

§ 04Cookies and what sits in your browser

Most of what we leave in your browser is the site's own working memory:

• whether you picked the light or the dark look
• your answer about analytics, so we stop asking
• the rough region described above
• a random session number
• the campaign tag on the link you first arrived from, if it had one (say, one of our ads), kept for 30 days and sent to us only together with a form you submit
• details you typed into a form, so the next form can fill itself in, plus whatever is in your shop cart
• your sign-in session, if you have an account

All of it sits on your own device. Clearing this site's storage in your browser removes the lot, and you'll be asked about analytics again next time.

The one advertising cookie: where you've allowed analytics and haven't opted out (§ 07), Meta's measurement pixel sets its own cookies, so Meta can tell when someone who clicked one of our ads on Facebook or Instagram later sends us a form. Opt out, or send a Global Privacy Control signal from your browser, and the pixel doesn't load at all.

§ 05How we use it

• To reply to you: answering what you sent is the main reason we have your details at all.
• To run your account and your orders: signing you in, remembering your details so forms pre-fill, showing you your own history, and getting a shop order packed and shipped.
• To follow up on business inquiries: our team may come back to you about catering, a partnership, or a product you asked about.
• To keep the site working: finding what's broken or slow, and fixing it.
• Where the law leaves us no choice: answering a lawful request, or acting to stop abuse and keep people safe.

We don't use your information for anything unrelated to why you gave it to us.

§ 06Who else sees it

A handful of outside companies help us run this site. Each is listed here by the job it does for us:

Apart from the advertising platform, each one works on our instructions, under its own security and privacy commitments, and none of them may use what we send for its own purposes. Meta may also use what it receives to improve how it delivers ads, under its own terms. If you want to know exactly which companies these are, email us and we'll tell you.

We will also hand over information when the law requires it, or when someone's safety is at stake. If this business is ever sold or merged, your information goes with it.

§ 07We don't sell your data

We do not sell your personal information. We do share a little with Meta so we can measure our own ads, and California law counts that as "sharing" for advertising. Where you've allowed it, Meta gets:

• that a page was viewed, or that a form was sent, along with which kind of form it was, or that you opened an account after coming from our investor page
• a scrambled copy of the email and phone number on that form (scrambled one way, so the original can't be read back), which lets Meta match the form to an ad click
• Meta's own cookie and ad-click codes, your IP address and your browser identifier
• later, when the inquiry moves on: that we got in touch, sent a quote, or closed a sale

Nothing else from your form goes: not your name, your message, your company or your files. Visitors in the EU, UK and EEA get none of this unless they accept analytics.

§ 08How long we keep it

We keep what you sent for as long as it takes to serve the purpose you sent it for, and delete it when that's done or when you ask us to. In practice:

• Inquiries, applications and orders: while we're dealing with them, and afterwards in our records the way any business keeps its correspondence.
• Your account: as long as you keep it. Delete the account and the record goes with it.
• Technical logs: short-lived, and not kept as a record of you.
• Session replays: they expire on their own after about a month.

§ 09How we look after it

Everything on this site travels over an encrypted connection. Access to what you send is limited to the people who need it to answer you, and to the providers in § 06 under their own security commitments. Your password is never stored anywhere we can read it.

No system is perfectly secure, and we won't claim ours is. If something went wrong in a way that affected your information, we'd tell you and say what happened.

§ 10Your choices

Wherever you live, you can:

• Ask what we hold about you, and get a copy.
• Ask us to correct anything that's wrong.
• Ask us to delete what we hold. You can also delete your account yourself, from your account page.
• Turn the analytics off, as described in § 03 and § 04.
• Stop the ad sharing, under Your Privacy Choices in § 07.
• Tell us to stop emailing you. Reply to anything we send and say so.

Email business@yummy-future.com for any of it. We'll check it's really you, usually by confirming the email we already have on file.

§ 11If you live in California

The California Consumer Privacy Act gives you these rights, and we'll honor them:

• Know: what personal information we collected about you, where it came from, why we have it, and which kinds of companies we disclosed it to. § 02, § 03 and § 06 answer that in advance.
• Access: a copy of what we hold.
• Correct: fix what's inaccurate.
• Delete: including closing and erasing your account.
• Opt out of sale or sharing: we don't sell. To stop the sharing for ads, use Your Privacy Choices (§ 07), or send a Global Privacy Control signal and we'll treat it as the same request.
• No discrimination: using any of these rights never changes how we treat you or what you pay.

We don't ask for the sensitive categories the law singles out: no government ID numbers, no financial account numbers, no health data, no precise location. A resume you attach holds whatever you chose to put in it.

Email business@yummy-future.com to use any of these. We'll verify it's you and answer within the time the law allows. Someone else may make the request for you if you've authorized them, and we'll ask for proof of that.

§ 12Children

This site is for adults doing business with us, and it isn't aimed at children. We don't knowingly collect anything from a child under 13. If we find out we have, we delete it. A parent or guardian who thinks we hold something about their child can email us and we'll sort it out.

§ 13Sites we link to

We link out to other companies: our social accounts, the platform we ran our crowdfunding on, and the occasional article about us. Once you're on their pages, their rules apply instead of ours.

§ 14Changes to this policy

If we change this policy, we'll update the effective date at the top of this page. If a change meaningfully affects how we handle your information, we'll email account holders before it takes effect.