Privacy Policy

Privacy Policy

Effective date: {{effective_date}} · Last updated: {{last_updated}}

This Privacy Policy explains what personal information Carthage Food by Aimen LLC, doing business as Carthage Kitchen ("Carthage", "we", "us"), collects when you visit our websites, ask for a quote, book an Event, use the Portal or apply to work with us as a Partner; how we use and share it; and the choices you have. It is posted under the California Online Privacy Protection Act (Cal. Bus. & Prof. Code §22575).

Contact: Carthage Kitchen, 1100 E 14th Pl, Unit 9, Los Angeles, CA 90021 · eat@carthagekitchen.com

Capitalised words (Event, Proposal, Event Agreement, Portal, Partner, Client Data) have the meanings given in our Catering Services Terms.

1. Information we collect

1.1 Information you give us.

1.2 Information collected automatically.

(a) Acceptance records. When you accept a Proposal or Change Order we record your account and user ID, verified email, the time (UTC), your IP address and your browser and device information, together with the exact version of the documents and text shown to you. We keep this to prove the agreement was made (see our Event Agreement documents).

(b) Security and service logs. Our hosting, database and sign-in systems record IP addresses, browser information, pages requested and errors, to keep the service secure and working.

(c) Analytics technologies. Unless you opt out (section 7), our public website uses:

• Google Analytics 4 — to measure visits, pages viewed, approximate location, device type and referring sites; and
• Microsoft Clarity — to understand how visitors use pages through heatmaps and session recordings. Text typed into

form fields is masked, and session recording is switched off in the Portal and on sign-in pages.

We may also use Cloudflare Web Analytics, a privacy-oriented traffic measurement service.

Our website contains code for the Meta Pixel (a Facebook and Instagram advertising-measurement tool), but it is not enabled. We will use it only if we enable it, and we will update this Policy before we do.

These providers set cookies or similar technologies and may collect information about your activity on our site and, under their own policies, across other websites over time.

1.3 Information from others. We may receive information about you from a person booking an Event on your behalf (for example a planner, an employer or a family member giving guest dietary information), from venues, and from our payment processor (payment status — never your full card number).

1.4 Sensitive information. Allergy, dietary and religious-diet information can be sensitive. We use it only to prepare and serve food safely for the Event, share it only with the people preparing and serving that food, and do not use it for marketing.

2. How we use information

We use personal information to:

(a) respond to enquiries and prepare Proposals;

(b) form, perform and administer Event Agreements, including planning menus, managing allergies and dietary needs, staffing, delivery, setup and service;

(c) take payments, issue invoices and receipts, and keep accounting and tax records;

(d) keep acceptance records that evidence our agreements;

(e) communicate with you about your Event by email and, where you give a mobile number for it, by text;

(f) send marketing emails (you can unsubscribe at any time) and, only with your prior express written consent, marketing text messages;

(g) with your consent only, use photographs of food and setup from your Event in our marketing;

(h) verify, approve and pay Partners, and check that their licences, permits and insurance are current;

(i) understand and improve our website and, if we enable advertising measurement, measure our advertising, unless you opt out;

(j) keep our systems secure, prevent fraud and comply with law, including food-safety, tax, public-contract and record-keeping obligations; and

(k) establish, exercise or defend legal claims.

3. How we share information

3.1 We do not sell personal information. We do not sell personal information for money or other valuable consideration, and we do not sell Client Data to anyone.

3.2 Service providers. We share personal information with companies that provide services to us, who may use it only to provide those services and must keep it confidential. They include:

3.3 Partners performing your Event. Carthage may use vetted Partners — such as food producers, staffing agencies, delivery and logistics firms, rental and equipment suppliers, event-services providers, and licensed security providers — to perform parts of an Event. We share with a Partner only the information it needs for its part of the Event, for example:

• a delivery Partner receives the delivery address, timings and on-site contact;
• a food-producing Partner receives the menu, counts and allergy and dietary information for the dishes it prepares;
• a staffing Partner receives the venue, timings and service brief.

Every Partner is bound by confidentiality obligations in its Master Partner Agreement, may use the information only for that Event, and may not contact you to sell its own services. Partners never receive your payment-card details.

3.4 Providers you contract with directly. If you ask us to introduce a licensed bar provider or another provider that contracts with you directly, we share your contact and Event details with that provider only with your agreement.

3.5 Venues. We share necessary Event logistics (and our insurance certificate) with your venue.

3.6 Public agencies. If you are, or book through, a public agency, records of the contract may be subject to public records and audit laws.

3.7 Legal and safety. We may disclose information where required by law, legal process or a government request, to enforce our agreements, or to protect the safety of any person — for example to a health authority investigating a food-safety concern.

3.8 Business transfer. If our business is sold or reorganised, personal information may transfer to the successor, which will remain bound by this Policy for information collected under it.

4. Advertising, analytics and "sharing"

4.1 The Meta Pixel is not enabled on our website. If we enable it, or use advertising features in Google Analytics, that could involve disclosing identifiers and browsing information to those companies for advertising measurement, which California law may treat as "sharing" for cross-context behavioural advertising. We will update this Policy before enabling the Meta Pixel, and you can stop any such sharing at any time using the choices in section 7.

4.2 We do not use cookies or analytics in the Portal for advertising. In the Portal, Google Analytics counts visits only, and Microsoft Clarity session recording does not run.

5. Retention

5.1 We keep personal information only for as long as we need it for the purposes in section 2, and then delete or anonymise it. In particular:

(a) Enquiries that do not become bookings are kept for as long as needed to respond and follow up, and then deleted or anonymised;

(b) Event Agreements, acceptance records and Change Orders are kept for at least 7 years after the Event, or longer if a public contract requires; invoices and payment records are kept for at least as long, and for any longer period tax and accounting law requires;

(c) Partner agreements, Work Orders and Purchase Orders are kept for at least 7 years after the job or the end of the Partner relationship, or longer if a public contract requires;

(d) Allergy and dietary information is kept with the Event record for food-safety traceability and then deleted or anonymised with it; and

(e) Analytics data is kept by our analytics providers under the retention settings we choose in their tools.

6. Security

6.1 We protect personal information with measures appropriate to its sensitivity, including encrypted connections (HTTPS), access controls that limit staff and Partner access to what each needs, database-level access rules, verified sign-in for the Portal, and payment processing by a specialist processor so that we do not hold full card numbers.

6.2 No system is completely secure. If a security incident affects your personal information, we will notify you and the authorities as required by law.

7. Your choices

7.1 Analytics and advertising cookies. Analytics and advertising technologies on our public website run from your first visit unless you opt out. You can opt out in any of three ways, each of which stops them immediately:

(a) choose Decline on the cookie banner;

(b) use the "Your Privacy Choices" link in the footer of every page; or

(c) turn on Global Privacy Control (GPC) in your browser or extension, which our site honours.

Essential cookies needed to run the site and the Portal (for example to keep you signed in) cannot be switched off.

7.2 Global Privacy Control. We honour GPC automatically. When your browser sends a GPC signal, we treat it as a decline before analytics or advertising technologies load, for that browser.

7.3 Do Not Track. Our website does not respond to the older browser "Do Not Track" (DNT) signal, because there is no common standard for it. We do honour Global Privacy Control as described in 7.2. Third parties named in section 1.2(c) may collect information about your online activity over time and across different websites when you use our site, unless you opt out under 7.1.

7.4 Marketing emails. Every marketing email has an unsubscribe link; we honour opt-outs promptly and in any case within 10 business days (15 U.S.C. §7704). We still send transactional messages about an Event you have booked.

7.5 Text messages. We send marketing texts only with your prior express written consent, which is never a condition of purchase (47 U.S.C. §227; 47 C.F.R. §64.1200). Reply STOP to any text to stop further texts of that kind.

7.6 Photographs. You can withdraw photography consent at any time by writing to eat@carthagekitchen.com.

8. Reviewing, correcting and deleting your information

8.1 Review and correction. You can review and update your account and contact details in the Portal at any time. To ask for a copy of the personal information we hold about you, or to correct anything you cannot change yourself, email eat@carthagekitchen.com.

8.2 Deletion. You can ask us to delete your personal information. We will delete it except where we must keep it — for example signed agreements, acceptance records, invoices and tax records, records required by a public-agency contract, or information needed to establish or defend legal claims — and will tell you what we have kept and why.

8.3 Verification. To protect you, we verify requests by confirming them from the email address on your account, or by other reasonable means if you do not have one. We respond within a reasonable time and will tell you if we need more.

8.4 No discrimination. We will not refuse service or charge a different price because you exercised any of these choices.

8.5 California Consumer Privacy Act (CCPA) status. The CCPA applies to a for-profit business that does business in California and meets at least one threshold: annual gross revenue above $26,625,000 (the CPI-adjusted figure in effect from 1 January 2025); buying, selling or sharing the personal information of 100,000 or more consumers or households; or deriving 50% or more of annual revenue from selling or sharing personal information (Cal. Civ. Code §1798.140(d)). Based on its current size and activities, Carthage does not believe it meets these thresholds and so is not currently subject to the CCPA. We nevertheless honour requests to know, access, correct and delete personal information voluntarily, as described in this section, and we honour Global Privacy Control. If Carthage becomes subject to the CCPA, it will comply with it in full, including by updating this Policy and its contracts with service providers and Partners as the CCPA requires.

9. Children

Our websites and services are intended for adults and organisations. We do not knowingly collect personal information directly from children under 13. Where a parent or organiser gives us information about a child guest (for example a name and allergy for a child's birthday party), we use it only to cater the Event safely. If you believe a child has given us personal information directly, contact us and we will delete it.

10. Changes to this Policy

10.1 We may update this Policy. The effective date at the top shows when it last changed.

10.2 If we make a material change — for example to the categories of information we collect or the categories of third parties we share it with — we will post the updated Policy here and, where we have your email address because you have an account or a booking with us, email you a notice before the change takes effect. Changes apply to information collected after the effective date unless you agree otherwise.

11. Contact

Questions, requests and complaints about privacy:

Carthage Kitchen (Carthage Food by Aimen LLC) 1100 E 14th Pl, Unit 9, Los Angeles, CA 90021 eat@carthagekitchen.com

Effective date: {{effective_date}}