Privacy Policy

Welcome to Starbird Chicken. We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website starbirdfood.rest, place orders, use our mobile applications, or otherwise interact with our services. Please read this policy carefully. If you disagree with its terms, please discontinue use of our site and services.

This Privacy Policy applies to all personal data collected by Starbird Chicken through our online and offline channels, including our website, mobile apps, in-store interactions, loyalty programs, email communications, and social media platforms. We operate in accordance with applicable United States federal and state privacy laws, including the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), the Federal Trade Commission (FTC) Act, and other applicable regulations.

1. Who We Are

Starbird Chicken is a food service company dedicated to providing high-quality, responsibly sourced chicken and related food products to our customers across the United States. We operate physical restaurant locations, an e-commerce ordering platform, and various digital channels to serve our customers.

For any privacy-related questions, concerns, or requests, please contact us using the information provided above or through the dedicated contact details in Section 14 of this policy.

2. Information We Collect

We collect various types of information depending on how you interact with us. The categories below describe what we collect and from what sources.

2.1 Personal Information You Provide Directly

We collect information that you voluntarily provide to us, including:

• Contact Information: Full name, email address, phone number, and mailing or delivery address.
• Account Information: Username, password (stored in encrypted form), and account preferences when you register for an online account or loyalty program.
• Order Information: Food items ordered, order history, special dietary requests, delivery instructions, and payment-related information.
• Payment Data: Credit card numbers, debit card numbers, billing addresses, and other payment details. Note: Full payment card numbers are not stored by us directly — they are processed by our PCI-DSS-compliant third-party payment processors.
• Communications: Messages, feedback, reviews, complaints, or other communications you send us via email, contact forms, social media, or in-person interactions.
• Marketing Preferences: Your preferences regarding receiving promotional emails, SMS messages, push notifications, and other marketing communications.
• Loyalty Program Data: Points balance, redemption history, reward preferences, and participation history if you are enrolled in our loyalty or rewards program.
• Survey and Contest Data: Responses to surveys, sweepstakes entries, contest submissions, and promotional participation information.

2.2 Usage and Technical Data Collected Automatically

When you visit our website or use our mobile app, we automatically collect certain technical information, including:

• Log Data: IP address, browser type and version, operating system, referring URLs, pages visited, time spent on pages, and the date and time of your visit.
• Device Information: Device type (desktop, smartphone, tablet), device identifiers (device ID, advertising ID), screen resolution, and hardware model.
• Location Data: If you permit us to access your device's location services, we may collect precise geolocation data to help you find nearby Starbird Chicken locations or to facilitate delivery services. You may disable location services in your device settings at any time.
• Clickstream Data: Information about your navigation path through our website and app, including which pages you visit, links you click, buttons you interact with, and the order of those interactions.
• Performance Data: Crash reports, loading times, error logs, and other diagnostic information used to maintain and improve our digital services.

2.3 Cookies and Tracking Technologies

We use cookies, web beacons, pixel tags, local storage, and similar tracking technologies to collect information about your interactions with our website and emails. For detailed information on the types of cookies we use, your choices, and how to manage your cookie preferences, please refer to our Cookie Policy. In summary:

• Essential Cookies: Necessary for the website to function properly (e.g., shopping cart functionality, login sessions).
• Analytics Cookies: Help us understand how visitors use our site so we can improve the user experience (e.g., Google Analytics).
• Marketing and Advertising Cookies: Enable us and our advertising partners to deliver relevant ads to you based on your browsing behavior.
• Functional Cookies: Remember your preferences and settings to enhance your experience.

2.4 Information from Third Parties

We may also receive information about you from third parties, including:

• Social media platforms when you connect your account, log in using social credentials, or interact with our social media pages.
• Third-party food delivery platforms (such as DoorDash, Uber Eats, or Grubhub) that process orders on your behalf.
• Advertising partners and data analytics providers who help us understand customer demographics and behavior.
• Fraud prevention and identity verification services.
• Publicly available sources and data aggregators where permitted by law.

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 Service Provision and Order Fulfillment

• To process and fulfill your food orders, including managing delivery logistics and in-store pickup.
• To create and manage your customer account and loyalty program membership.
• To process payments securely and send order confirmations, receipts, and delivery status updates.
• To respond to your customer service inquiries, complaints, and feedback.
• To communicate essential service information such as changes to our menu, operating hours, or policies.

3.2 Analytics and Service Improvement

• To analyze how customers use our website, app, and in-store services so we can improve functionality, design, and the overall customer experience.
• To conduct internal research and development to enhance our menu offerings, service delivery, and technology platforms.
• To measure the effectiveness of our promotions, advertising campaigns, and marketing initiatives.
• To detect, investigate, and prevent fraudulent transactions, abuse, and other illegal activities.
• To conduct A/B testing and user experience optimization.

3.3 Marketing and Promotional Communications

• To send you promotional emails, SMS messages, push notifications, and direct mail about new menu items, special offers, discounts, and events — but only when you have given us consent or where otherwise permitted by applicable law.
• To personalize your experience on our website and app, including displaying relevant menu recommendations and targeted promotions based on your order history and preferences.
• To deliver interest-based advertising on third-party platforms and social media networks.
• To administer loyalty points, rewards, contests, sweepstakes, and other promotional programs.

Opt-Out: You may opt out of marketing communications at any time by clicking the "unsubscribe" link in any marketing email, replying "STOP" to any SMS message, or adjusting your communication preferences in your account settings. Please note that even if you opt out of marketing, we may still send you transactional or operational messages related to your orders or account.

3.4 Legal Compliance and Safety

• To comply with applicable federal, state, and local laws and regulations.
• To respond to lawful requests from law enforcement, government authorities, or courts.
• To enforce our Terms of Service and other agreements.
• To protect the rights, safety, and property of Starbird Chicken, our customers, employees, and the public.

4. Legal Basis for Processing

While the United States does not have a single overarching federal privacy law analogous to the European GDPR, we are committed to processing your data in a lawful and fair manner under applicable law. Our processing activities are grounded in the following bases:

• Contractual Necessity: Processing necessary to fulfill your orders, manage your account, and deliver our services.
• Legitimate Business Interests: Processing for fraud prevention, security, analytics, and service improvement, where such interests do not override your fundamental rights.
• Legal Obligation: Processing required to comply with applicable laws and regulations.
• Consent: Processing for marketing communications and certain cookie-based tracking, where you have provided explicit consent and may withdraw it at any time.

5. Sharing Your Information with Third Parties

We do not sell your personal information to third parties for their own marketing purposes. However, we do share your information in the following circumstances:

5.1 Service Providers and Business Partners

We work with trusted third-party companies and individuals to provide services on our behalf. These service providers have access to your personal information only to perform specific tasks and are obligated to protect your information and not use it for any other purpose. Service providers include:

• Payment processors (e.g., Stripe, Square, or similar PCI-DSS-compliant processors)
• Cloud hosting and infrastructure providers (e.g., Amazon Web Services, Google Cloud)
• Email marketing platforms (e.g., Mailchimp, Klaviyo)
• SMS and push notification providers
• Customer relationship management (CRM) software providers
• Analytics providers (e.g., Google Analytics, Mixpanel)
• Delivery logistics and courier partners
• Loyalty and rewards program technology providers
• Fraud detection and cybersecurity services
• Legal, accounting, and professional advisory firms

5.2 Third-Party Ordering Platforms

If you place an order through a third-party delivery platform (such as DoorDash, Uber Eats, Grubhub, or similar services), that platform's own privacy policy governs the collection and use of your information on their platform. We may receive order details from such platforms to fulfill your order, but we encourage you to review their privacy policies independently.

5.3 Advertising and Social Media Partners

We may share limited data (such as email addresses in hashed form or device identifiers) with social media platforms like Meta (Facebook and Instagram) and Google for the purpose of delivering targeted advertising to you or to find new customers with similar interests (lookalike audiences). You can manage your advertising preferences through those platforms' privacy settings.

5.4 Business Transfers

If Starbird Chicken undergoes a merger, acquisition, restructuring, sale of assets, bankruptcy, or similar corporate transaction, your personal information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our website if such a transfer occurs and your information becomes subject to a different privacy policy.

5.5 Legal Requirements and Law Enforcement

We may disclose your personal information if required to do so by law or in response to valid legal process, such as a subpoena, court order, or government request. We may also disclose information when we believe in good faith that disclosure is necessary to: (a) protect our legal rights or property; (b) prevent or investigate possible wrongdoing; (c) protect the personal safety of our users or the public; or (d) protect against legal liability.

5.6 Aggregated and De-Identified Data

We may share aggregated or de-identified information that cannot reasonably be used to identify you with third parties for research, marketing, analytics, and other purposes. For example, we may share overall sales trends, general demographic information, or aggregate website traffic statistics.

6. Data Security

Protecting your personal information is a top priority for Starbird Chicken. We implement a variety of technical, administrative, and physical security measures designed to safeguard your information from unauthorized access, use, alteration, and disclosure. These measures include:

• Encryption: Transmission of sensitive data (including payment information and login credentials) is protected using industry-standard SSL/TLS encryption.
• Access Controls: Access to personal data is restricted to authorized employees, contractors, and service providers who need it to perform their job functions.
• Password Security: User passwords are stored using strong cryptographic hashing algorithms and are never stored in plain text.
• Payment Security: We comply with the Payment Card Industry Data Security Standard (PCI-DSS) for all payment processing activities.
• Regular Security Audits: We conduct periodic security assessments, penetration testing, and vulnerability scans to identify and remediate potential weaknesses.
• Incident Response: We maintain a documented data breach response plan and will notify affected individuals and relevant authorities in the event of a breach as required by applicable law.
• Employee Training: All employees with access to personal data receive regular training on data privacy and security best practices.

7. Your Privacy Rights

Depending on your state of residence within the United States, you may have certain rights regarding your personal information. We respect and honor these rights to the extent required by applicable law.

7.1 Rights Under California Law (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: You have the right to request disclosure of the categories and specific pieces of personal information we have collected about you, the sources from which it was collected, the purposes for which it is used, and the categories of third parties with whom we share it.
• Right to Delete: You have the right to request that we delete your personal information, subject to certain exceptions (e.g., information needed to complete a transaction or comply with legal obligations).
• Right to Correct: You have the right to request correction of inaccurate personal information we maintain about you.
• Right to Opt-Out of Sale or Sharing: You have the right to opt out of the sale or sharing of your personal information for cross-context behavioral advertising. To exercise this right, click the "Do Not Sell or Share My Personal Information" link on our website.
• Right to Limit Use of Sensitive Personal Information: Where applicable, you have the right to limit our use of sensitive personal information to only that which is necessary to provide services to you.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights. This means we will not deny you services, charge you different prices, or provide a lower quality of service because you exercised a privacy right.
• Right to Data Portability: You may request a copy of your personal information in a portable, readily usable format.

7.2 Rights Available to All U.S. Customers

Regardless of your state of residence, we offer all customers the following rights as a matter of good practice:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete personal information.
• Deletion: Request deletion of your personal information in certain circumstances.
• Opt-Out of Marketing: Opt out of receiving marketing and promotional communications at any time.
• Account Deactivation: Request deactivation or closure of your customer account.

7.3 How to Exercise Your Rights

To exercise any of the rights described above, you may:

• Submit a request via email to: [email protected]
• Visit our website at: starbirdfood.rest and use the privacy request form in your account settings.

We will verify your identity before processing your request to protect your privacy and prevent unauthorized access. We will respond to your request within 45 days, or within the time period required by applicable law. In some cases, we may need to extend this period, in which case we will notify you. We may deny certain requests where permitted by law, and we will explain the reason for any denial.

You may designate an authorized agent to submit requests on your behalf. Authorized agents must provide written authorization from you and may be required to provide proof of their own identity.

8. Cookie Policy Summary

We use cookies and similar tracking technologies on our website and mobile applications to enhance your experience, analyze site usage, and deliver targeted advertising. Cookies are small text files stored on your device when you visit a website.

We use the following categories of cookies:

• Strictly Necessary Cookies: Essential for core website functionality such as maintaining your session, login state, and shopping cart.
• Performance and Analytics Cookies: Help us understand how visitors interact with our website so we can improve its performance and content.
• Functional Cookies: Allow us to remember your preferences, such as your preferred language or location.
• Targeting and Advertising Cookies: Used by us and our advertising partners to build a profile of your interests and show you relevant ads on our website and other sites.

You can manage or disable cookies through your browser settings or through our cookie consent management tool available on our website. Please note that disabling certain cookies may affect the functionality of our website and services. For full details, please review our Cookie Policy.

9. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required or permitted by applicable law. The specific retention periods vary depending on the type of data and the purpose for which it is held:

When your data is no longer needed, we will securely delete, anonymize, or de-identify it in accordance with our data retention schedule and applicable legal requirements.

10. Children's Privacy

Starbird Chicken's website, mobile application, online ordering system, and loyalty programs are not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13 in violation of the Children's Online Privacy Protection Act (COPPA). We also strongly discourage use of our online services by individuals under the age of 18 without the supervision or involvement of a parent or legal guardian.

If you believe that we have inadvertently collected personal information from a child under the age of 13, please contact us immediately at [email protected] so that we can take prompt steps to delete such information from our records. Parents and legal guardians who discover that their child has provided us with personal information without consent may also contact us to request deletion of that information.

We may offer certain in-restaurant programs or activities that involve younger family members, but these programs are always conducted with parental supervision and do not involve independent collection of children's personal data through digital means.

11. International Data Transfers

Starbird Chicken is headquartered in the United States and primarily operates within the United States. However, some of our third-party service providers may be located in, or process data in, countries other than the United States, including countries in the European Union, the United Kingdom, Canada, or elsewhere.

When your personal information is transferred outside the United States, we take steps to ensure that your data receives appropriate protection. These steps may include:

• Requiring service providers to agree to contractual data protection obligations equivalent to applicable U.S. standards.
• Using service providers who have adopted recognized privacy frameworks or self-certification programs, where applicable.
• Implementing additional technical and organizational safeguards to protect data in transit and at rest.

By using our services, you acknowledge that your information may be transferred to and processed in the United States and potentially other countries. The data protection laws in these countries may differ from those in your country of residence.

If you are located outside the United States and are visiting our website or using our services, please be aware that your information will be transferred to, stored, and processed in the United States in accordance with this Privacy Policy and applicable U.S. law.

12. Third-Party Websites and Links

Our website and mobile application may contain links to third-party websites, social media platforms, and services that are not owned or controlled by Starbird Chicken. This Privacy Policy applies only to our own services. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party websites or services.

We encourage you to review the privacy policies of every website you visit and every application you use. Third-party sites linked from our platform — including social media sites like Instagram, Facebook, Twitter (X), and TikTok, and delivery platforms like DoorDash and Uber Eats — have their own privacy policies that govern their collection and use of your data independently of this policy.

13. Changes to This Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time to reflect changes in our business practices, legal requirements, or technological developments. When we make material changes to this policy, we will:

• Update the "Last Updated" date at the top of this page.
• Post a prominent notice on our website or app informing you of the changes.
• Where required by law or where we consider it appropriate, send you a direct notification via email or push notification.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information. Your continued use of our services after any changes to this policy have been posted constitutes your acceptance of the updated terms, to the extent permitted by applicable law.

If we make changes that materially affect your rights or how we use your sensitive personal information, we will seek your consent as required by applicable law before implementing those changes.

14. Contact Us — Privacy Inquiries

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please do not hesitate to contact us. We are committed to responding to all privacy inquiries promptly and transparently.

When you contact us regarding a privacy matter, please provide as much detail as possible about your request, including your full name, contact information, and a description of your inquiry. This will help us respond to you accurately and efficiently. We aim to respond to all privacy requests within 30 business days, or within the legally required timeframe where applicable.

15. How to File a Complaint with a Data Protection Authority

We are committed to resolving any privacy concerns you may have directly and transparently. However, if you believe that we have not adequately addressed your privacy concerns, you have the right to file a complaint with the appropriate regulatory or supervisory authority.

15.1 California Residents

California residents who believe their rights under the CCPA/CPRA have been violated may file a complaint with the California Privacy Protection Agency (CPPA) or the California Attorney General's Office:

• California Privacy Protection Agency (CPPA): https://cppa.ca.gov/
• California Attorney General: https://oag.ca.gov/privacy/ccpa

15.2 All U.S. Residents

Consumers throughout the United States who believe they have experienced unfair or deceptive data practices may file a complaint with the Federal Trade Commission (FTC), which enforces consumer protection and privacy laws under the FTC Act:

• Federal Trade Commission (FTC): https://www.ftc.gov/complaint | Phone: 1-877-382-4357

15.3 State-Specific Authorities

Many U.S. states have enacted their own consumer privacy laws and have corresponding enforcement authorities. If you reside in a state with a comprehensive consumer privacy law — such as Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), or others — you may have additional rights and may contact your state's attorney general office for assistance. We encourage you to research the specific laws and regulatory bodies applicable in your state of residence.

Before filing a formal complaint with any authority, we encourage you to contact us directly at [email protected] so we have the opportunity to address your concern informally and as quickly as possible.

16. Do Not Track Signals

Some web browsers may transmit "Do Not Track" (DNT) signals to websites. Because there is currently no established universal standard for how websites should respond to DNT signals, our website does not currently respond to DNT browser signals in a specific manner. We will continue to monitor developments in this area and update our practices as industry standards evolve.

California residents may also make a "Global Privacy Control" (GPC) signal request. Where technically feasible and where required by California law, we will honor GPC signals as requests to opt out of the sale or sharing of personal information.

17. Shine the Light Law — California Residents

Under California Civil Code Section 1798.83 (known as the "Shine the Light" law), California residents who have an established business relationship with us may request information about whether we have shared their personal information with any third parties for those third parties' direct marketing purposes. If you are a California resident and wish to make such a request, please send your inquiry to [email protected] with the subject line "California Shine the Light Request." We will respond within 30 days.