Effective Date: October 13, 2026

EatStreet, Inc and all our affiliated companies and subsidiaries ("EatStreet", "we", "us", or "our") are committed to protecting the privacy of our users. This Privacy Policy ("Policy") describes how we collect, use, disclose and protect personal information we collect or receive in connection with: (1) the operation of our websites that link to this Policy, including, but not limited to eatstreet.com, along with the features, functionalities, applications, browser extensions and other services available through our websites (collectively, our "Websites"); (2) the operation of our mobile applications, including, but not limited to, the EatStreet App available through the Google Play Store and the Apple App Store, along with the features, functionalities, applications, browser extensions and other services available through our mobile applications (collectively, our "Apps"); (3) our business operations related to the operation of our Websites and Apps (our "Operations"); (4) personal information we obtain from any third party site connected to our Websites or Apps or where we post content or invite your feedback or participation, including, without limitation, Facebook, X and Instagram (collectively, "Third Party Sites"); and (5) our services that let you find restaurants, build an order and go to our checkout through third-party AI assistants, such as ChatGPT, Claude and Gemini (our "AI Assistant Services"). Our Websites, Apps, Operations, Third Party Sites and AI Assistant Services are collectively referred to as our "Platform."

You can access and interact with our Platform in many ways, including from a computer or mobile device. This Policy applies regardless of how you access or interact with our Platform. Depending on how you interact with our Platform, there may be some cases where we need to provide you with additional information about how we use your personal information and/or what options you have regarding our use of your personal information. We may provide this additional information via notices on the Platform or via direct communications with you. If we do this, unless we tell you otherwise, the additional information will apply in addition to what is described in this Privacy Policy.

Please read this Policy carefully. If you do not want us to collect, use or disclose your personal information in the ways described in this Policy, please do not use our Platform, provide us with personal information or authorize a third party to make your personal information available to us. By using our Platform, you acknowledge that you understand that we may use your personal information as described in this Policy. Please note, as described in this Policy, we may receive your personal information from third parties that have not expressly told you that they will provide your personal information to us. If you have any questions about how we collect, use, protect or disclose your personal information, please contact us by email at customer.service@eatstreet.com.

IF YOU ARE A CALIFORNIA RESIDENT, PLEASE SEE THE SECTION ENTITLED ?ADDITIONAL INFORMATION FOR CALIFORNIA RESIDENTS? BELOW FOR ADDITIONAL INFORMATION THAT MAY APPLY TO YOU.

Protecting Your Personal Information

We are committed to protecting your personal information. We maintain commercially reasonable safeguards to maintain the security and privacy of personal information we collect and use in connection with our Platform, which may include, without limitation, the use of encryption to protect personal information being sent to and received on our Platform. Nevertheless, when disclosing personal information, you should remain mindful that there is an inherent risk in transmitting information via email and the internet. Your personal information could be intercepted without our knowledge or consent, collected illegally and/or used by third parties that are not affiliated with and/or controlled by us. We cannot guarantee the security of any information, including your personal information, and any information you disclose is at your own risk.

Categories of Personal Information We Collect

When we refer to "personal information" in this Policy, we mean any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Please see the table below for more details about the categories of personal information we collect.

The following table lists the categories of personal information we collect and a description of the types of data collected in each category.

Sources of the Personal Information We Collect

A large portion of the personal information we collect about you in connection with our Platform is collected directly from you or in connection with your access to, use of or interaction with our Platform (including personal information we automatically collect). You have the option not to provide any personal information we ask you to provide in connection with your access to, use of or interaction with our Platform. However, there are some features on our Platform where we have to collect certain personal information, and, if you do not provide us with the required personal information, you will not be able to access, use or interact with that feature. This is especially true for features where we are legally required to collect certain personal information (for example, we are required to collect certain personal information to verify your age if you attempt to purchase an age-restricted product through our Platform) and where it is impossible for the feature to operate without certain personal information (for example, it is impossible for us to complete any order you place through our Platform unless you tell us where to deliver the order, what items to include in your order and you provide us payment information to pay for the order).

We also may collect information (which may include personal information) about you from third parties, including, without limitation, online and offline sources, social media platforms, advertising networks, or other public or commercial sources (collectively, "Third Party Sources"). As described below, we may also disclose personal information to these Third Party Sources. The following table provides additional information about the Third Party Sources we may interact with in connection with your personal information:

Ordering through AI assistants

You can use EatStreet through AI assistants, such as ChatGPT, Claude and Gemini, that connect to our AI Assistant Services. When you do, the assistant sends us what you ask for, such as the kind of food or the dishes you want, your choices, and the place you want food from. If you have not named a place, the assistant may share an approximate location, such as your city. If you want delivery, the assistant sends us the street address you give it, which we use to check which restaurants deliver to you and to price your order.

We use this information to find restaurants, show menus and prices, build your cart and send you to EatStreet's checkout, where you place and pay for your order. The rest of this Policy applies to the order you place there.

We keep a record of each request your assistant makes to us, to operate, secure and improve the service. These records leave out your name, address, phone number, notes and other text you provide; they keep the type of request, identifiers for the restaurants and dishes involved, and a code for the conversation. When a search finds no restaurants, we may keep the area searched, rounded to a few miles. We keep these request records for as long as we use them to operate, secure and improve the service, and we decide how long that is using the criteria described in "How long we retain personal information" below. If you place an order, the order records which assistant it came from and that conversation code, and the rest of this Policy applies to that order.

The AI assistant you use is operated by its own provider, such as OpenAI, Anthropic and Google, under its own privacy policy. What you share with the assistant is governed by that policy, not this one.

To delete information from your use of EatStreet through an AI assistant, see "Deleting your account and personal information" below.

Purposes for which we collect personal information

The following table describes the purposes for which we may collect personal information about you in connection with our Platform, along with the categories of personal information we collect for those purposes, and who we collect, or receive, that personal information from.

How long we retain personal information

We retain personal information only as long as we have a legitimate business purpose to keep it. These purposes may include retaining personal information to:

• Complete the transaction for which the personal information was collected;
• Continue our ongoing business relationship with you;
• Ensure the security and integrity of our Platform; and
• Satisfy any legal, regulatory, tax, accounting, or reporting requirements

To determine the appropriate retention period for individual categories of personal information we collect, we consider the nature and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of the personal information, the purposes for which we process that personal information and whether we can fulfill those purposes through other means, and applicable legal, regulatory, tax, accounting, reporting, or other requirements.

Personal information we disclose to third party sources

In order to operate our Platform and carry out other activities permitted by applicable laws, we may disclose certain personal information we have collected or received to certain Third Party Sources. The following table identifies the categories of personal information we may disclose to each category of Third Party Source and the purpose for those disclosures. Please note, these disclosures are in addition to any disclosures to third parties you authorize or instruct us to make.

Additional Information about Analytics

We may use, or permit the use of, analytics tools, including, without limitation, third party cookies, web beacons, clear gifs, pixel tags, or other similar technologies provided by our Analytics Providers. This section provides additional information about the types of third party analytics tools that, subject to your choices and any exercise of rights available to you, may collect information about you in connection with your access to or use of our Websites and Apps.

How we use Google Analytics

We may use Google Analytics, a web analytics service provided by Google LLC ("Google"), to assist us in understanding how our Websites and Apps are used. Google Analytics will place cookies on your computer or mobile device that will generate information that we select about your use of the Websites and Apps, including your computer's or mobile device's IP address. That information will be transmitted directly to and stored by Google. The information will be used for the purposes of evaluating use of our Websites and Apps, compiling reports on activity on our Websites and Apps for our use and providing other services relating to activity on, and usage of, our Websites and Apps. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google's behalf. You may refuse the use of cookies by selecting the appropriate settings on your browser. Please note that by doing so, you may not be able to use the full functionality of our Websites and Apps. Google's practices with respect to the personal information collected through Google Analytics is covered by Google's privacy policy, available at https://policies.google.com/privacy. Google allows you to opt out of Google Analytics. You may opt-out by visiting https://tools.google.com/dlpage/gaoptout.

How we use Google Tag Manager

We may use Google Tag Manager ("GTM"), a tag management system that allows JavaScript and HTML tags to be quickly deployed and updated on portions of our Websites and Apps for tracking and analytics. We use GTM on our Websites and Apps to include Google Analytics. If you have opted out of Google Analytics, GTM takes this opt out into account. For more information about Google's privacy practices applicable to GTM, please refer to https://policies.google.com/privacy and the terms of use at https://www.google.com/analytics/tag-manager/use-policy.

How we use Mixpanel Analytics

We may use Mixpanel Analytics, a web analytics service provided by Mixpanel, Inc. ("Mixpanel"), to collect information we select about how you interact with and use our Websites and Apps, such as how often users visit our Websites and Apps, what pages they visit, and other sites they visited prior to accessing our Websites and Apps. We use this information to maintain and improve our Platform. Mixpanel's Terms of Use are available at https://mixpanel.com/legal/terms-of-use/. Mixpanel does not sell, lease, rent or otherwise share, for money or other consideration, the information they receive through Mixpanel Analytics and are subject to certain restrictions with respect to how they use and disclose that information.

How we use Bandwidth

We may use text messaging services provided by Bandwidth, Inc. ("Bandwidth") to send you marketing text messages where you have signed up or otherwise provided your consent to receive marketing text messages from us. As part of the text messaging services, Bandwidth collects certain information on our behalf from and about you, such as your mobile phone number, your user or screen name, and any other information that you included in messages that you send to us in connection with the marketing text messages we send. For more information about Bandwidth's privacy practices, please refer to their privacy policy, available at https://www.bandwidth.com/legal/privacy.

How we use Facebook Services

We may use services provided by Meta Platforms, Inc. ("Meta"), including, without limitation, Facebook Pixel, that enable us to measure the effectiveness of campaigns served on Facebook. The information collected through those services, which may include the use of cookies or other tracking technologies placed on our Websites and Apps by Meta, will be transmitted directly to and stored by Meta. For more information about Meta's privacy practices, please refer to their privacy policy, available at https://www.facebook.com/privacy/policy. To opt out, please visit https://www.meta.com/legal/united-states.

How we use TikTok Pixel

We may use the TikTok Pixel, a marketing service provided by TikTok, to measure the effectiveness of our advertising on TikTok and to deliver targeted advertising. The TikTok Pixel uses cookies and similar technologies on our Websites to collect information about your use of our Websites, such as the pages you view, the actions you take and your device's IP address, and sends that information to TikTok. For more information about TikTok's privacy practices, please refer to their privacy policy, available at https://www.tiktok.com/legal/page/us/privacy-policy/en.

How we use Google Ads

We may use Google Ads, an advertising service provided by Google LLC ("Google"), to show our advertisements on Google and other websites and to measure how many people visit our Websites or place orders after seeing or clicking one of our advertisements. Google Ads uses cookies and similar technologies to collect this information. For more information about how Google uses information from advertising, and how to manage the advertising you see, please refer to https://policies.google.com/technologies/ads.

How we use Images for Age Verification

In certain circumstances, we will capture image data for the purposes of age verification on the condition that a customer is receiving an age-restricted item, like alcohol.

Use and disclosure of aggregated, de-identified information

We may collect, use, share, transfer and otherwise process de-identified and aggregated information that we receive or create for any purposes in our sole discretion, in compliance with applicable laws. We are the sole and exclusive owner of such de-identified and aggregated information, including if we de-identify personal information so that it is no longer considered personal information under applicable laws. We commit to maintaining and using de-identified and aggregated information in its de-identified form and not to reidentify the information except for the sole purpose of determining whether our de-identification processes satisfy the requirements under applicable laws.

Your Choices

We offer you several choices with respect to how we use and disclose your personal information. This section describes the mechanisms available to you to control the personal information we use about you in connection with our Platform.

Updating your personal information

If you want to update any personal information you have provided us, update your preferences, or otherwise contact us about our use of your personal information, you can:

• update your account information, such as your name, email address and phone number on the My Account information page, available at https://eatstreet.com/account/info;
• contact us using the applicable contact information provided on our Contact Us page, available at https://eatstreet.com/contact;
• contact us by mail at 2921 Landmark Place, Suite 215, Madison, WI 53713; or
• email us at privacy@eatstreet.com.

Deleting your account and personal information

If you have an EatStreet account, you can delete it at any time by signing in, going to https://eatstreet.com/account/info and selecting "Delete Account." To ask us to delete other personal information we hold about you, email privacy@eatstreet.com with the subject line "Data Deletion Request" and include your full name, the email address associated with your EatStreet account, and a brief statement asking us to delete your personal information. We will verify your identity and delete your personal information as required by applicable law. We may keep some information where permitted or required, such as for fraud prevention, security or legal compliance.

Requests made on your behalf

You may ask someone else, such as a company that manages privacy requests for you, to ask us to delete your account or to access, delete or correct your personal information. The request must be emailed to privacy@eatstreet.com with "Authorized Agent Request" in the subject line, and must include (a) your name and email address and those of the person making the request, (b) written permission signed by you, or proof of a power of attorney, and (c) the specific request being made. Before we act, we will contact you at the email address on your EatStreet account and may require you to sign in to confirm that you authorized the request. We will contact you only through the contact information on your EatStreet account, not through information provided by the person making the request. If you no longer have access to that email address, contact us directly at privacy@eatstreet.com and we will verify your identity another way, such as by asking about your recent orders. We may deny a request made on your behalf if it is incomplete or if we cannot confirm that you authorized it.

Tools for Communications

To manage the communications we send to you:

• For email communications you receive from us, you can opt-out of receiving such communications by following the unsubscribe instructions contained in most email messages from us. Your unsubscribe request or email preference changes will be processed promptly, though this process may take several days. During that processing period, you may receive additional emails from us. Please note, opting out of email communications will only apply to marketing and other promotional emails and will not apply to any email or other communications sent for non-marketing purposes, including, but not limited to, emails and other communications about your orders and other interactions with our Platform.
• If you have provided us with your prior express consent to receive text messages via an automatic telephone system (autodialer), we may use your information to send promotional, personalized advertising and other text messages to any mobile device connected to your mobile phone number. You can opt out from receiving future text messages at any time by replying STOP to any text message you receive from us, or by emailing us at privacy@eatstreet.com with the subject line "STOP" and including your phone number in the email. Once you opt out, we will send one additional confirmation text message stating that you have opted out of receiving automated text messages from us. For more information about text messages we may send, please review our Terms of Use, available at https://eatstreet.com/terms.
• For push notifications delivered on your mobile device through our Apps, you can unsubscribe by updating the system settings on your device to prevent our Apps from providing push notifications or by uninstalling our Apps from your mobile device.

Targeted Advertising

If you wish to limit third-party advertising, you can visit the National Advertising Initiative Consumer Opt-Out page and the Digital Advertising Alliance?s Consumer Choice Tool. In addition, the electronic device you use to visit our Websites or Apps offer additional privacy settings when using our Websites or Apps; please see the device settings for details. Please note that even if you opt-out of receiving interest-based advertising, you will still receive advertisements, but they will be more general in nature.

Protection of Children's Personal Information

EatStreet does not direct or target any piece of our Platform to children under the age of 13. If you believe a child has provided us with personal information other than an email address, please contact us at privacy@eatstreet.com. We will make reasonable efforts to remove such information from our databases.

Links to other websites

This Policy does not apply to any personal information that you provide to, or that is collected by, any third-party website operator or third-party product.

We are active on social media sites, including Facebook, YouTube, Instagram, X, and LinkedIn. Anything you post on our social media sites is public information and will not be treated confidentially. We may post (or re-post) on the Site, or our social media pages any comments or content that you post on our social media pages.

Our Site may include social media features such as Facebook or X buttons (such as "Like" or "Post"). These websites may automatically record information about your browsing behavior every time you visit a website that has a social media button, regardless of whether you click on the button. Your use of these features is governed by the privacy policy of the company providing the social media feature, not by this Policy. We recommend that you review your privacy settings on the social media sites that you use.

Additional Information for California Residents

If you are a California resident, California law provides you with certain rights with respect to your personal information. Please note, if you are not a California resident, the rights in this section do not apply to you. In the event of a conflict between this section and the remainder of the Policy, this section shall take precedence for California residents.

The collection, source, purpose and sharing of your personal information

• To learn the categories of personal information we collect, see the "Categories of personal information we collect" section above
• To learn the categories of sources from which your personal information is collected, our purpose for collecting it, and how long we keep it, see the "Purposes for which we collect personal information" and "How long we retain personal information" sections above.
• To learn the categories of third parties and service providers with whom we share your personal information, see the "Personal information we disclose to third party sources" section above.

Categories of personal information we have collected

During the past 12 months, we have collected the following categories of personal information

• Identifiers
• Protected Classification Information
• Commercial Information
• Internet or Electronic Network Activity Information
• Non-Sensitive Geolocation Information
• Sensory Information
• Inferences Drawn from Other Personal Information

Categories of sensitive personal information we have collected

During the past 12 months, we have collected the following categories of sensitive personal information

• Driver's license or state identification card
• Account log-in credentials
• Precise geolocation

Categories of personal information disclosed for a business purpose

During the past 12 months, we have disclosed the following categories of personal information for a business purpose

• Identifiers
• Protected Classification Information
• Commercial Information
• Internet or Electronic Network Activity Information
• Non-Sensitive Geolocation Information
• Sensory Information
• Inferences Drawn from Other Personal Information

Categories of sensitive personal information we have disclosed for a business purpose

During the past 12 months, we have disclosed the following categories of sensitive personal information for a business purpose

• Driver's license or state identification card
• Account log-in credentials
• Precise geolocation

Categories of personal information we have sold or shared

In the last 12 months we have not sold, rented, leased or otherwise disclosed, released, disseminated, transferred or made personal information available to a third party for monetary compensation or other valuable consideration.

During the past 12 months, we have shared the following categories of personal information with third parties for the purpose of serving targeted advertising

• Identifiers
• Commercial Information
• Internet or Electronic Network Activity Information
• Non-Sensitive Geolocation Information
• Inferences Drawn from Other Personal Information

You have the right to opt-out of the sale or sharing of your personal information by going to https://eatstreet.com/account/info and changing your account preferences.

Additional uses or disclosures of sensitive personal information

We do not use or disclose sensitive personal information for any purpose other than our business purposes, as specified under CPRA

Your California privacy rights

Under the California Consumer Privacy Act of 2018, as amended ("CCPA") California residents have certain additional privacy rights, with certain exceptions. If you live in California, you may exercise those California privacy rights listed below.

Right to Know

You have a right to request that we disclose certain information about you and our collection of your personal information over the last 12 months.

Once we receive your request and confirm your identity, we will disclose to you as required under the CCPA:

• the categories of personal information we have collected from or about you;
• the categories of sources from which the personal information was collected;
• the business or commercial purpose for collecting, disclosing, sharing, or selling your personal information
• the categories of Third Party Sources with which we have disclosed your personal information.
• the specific pieces of personal information we have collected about you
• the categories of personal information that we sold, shared or disclosed for a business purpose; and
• the categories of Third Party Sources to whom it is sold, shared or disclosed for a business purpose

Right to request deletion

You have a right to request that we delete personal information we collected from or about you. We will comply with such request, and direct our service providers or third parties to do the same, subject to certain exceptions permitted by applicable law. To make a request, see "Deleting your account and personal information" in the "Your Choices" section above.

To exercise your rights, see https://eatstreet.com/privacy#ccpa-form.

Right to correct

You have the right to correct inaccurate personal information that we collect about you. If we receive a verifiable request, we will consider it, taking into account the nature of the personal information and the purposes of the processing of the personal information. We may deny your request if we are unable to verify your identity or if we determine that the contested personal information is more likely than not accurate based on the totality of the circumstances. We may request that you provide us with documentation that is relevant to your request.

To exercise your rights, see https://eatstreet.com/privacy#ccpa-form.

Please note, we may choose to delete the contested personal information as an alternative to correcting it if doing so would not negatively impact you or your consent to our deletion.

Right to opt-out of sale or sharing of personal information

You have the right to opt-out of selling and sharing your personal information with a third party. To make this request, go to your account page at https://eatstreet.com/account/info, select "Edit Info" ? Settings ? check "Opt out of data collection" ? save your settings

Non-discrimination

You have a right to not receive discriminatory treatment for exercising any of your rights under the CCPA.

How to exercise your California privacy rights

In addition to any other options provided in this Policy, to exercise your rights under the CCPA, you may also:

• send us a verifiable consumer rights request to us via email to privacy@eatstreet.com.

Who may exercise your rights

If you are a California resident, only you or a person that you authorize to act on your behalf may make a request related to your personal information. See the section titled "Using an authorized agent" below for more information. A parent or legal guardian may make a request on behalf of their child.

Verifiable consumer request

You must provide sufficient information to allow us to reasonably verify you are the person about whom we collected personal information, and you must describe your request with sufficient detail to allow us to properly understand, evaluate, and respond to your request.

When we receive your request to exercise your rights under the CCPA, we will: (a) acknowledge receipt of your request; (b) try to match the information you provide in making the request with information we already maintain about you; (c) if required to verify your identity, we may ask you to provide additional information, including personal information; and (d) consider various factors when determining how to verify your identity, such as the sensitivity and value of the data, the risk of harm, the likelihood of fraud, etc.

We will only use personal information we collect during the verification process for the purpose of verifying your identity. If you maintain an account with us, we may use that account to respond to your request and/or verify your identity. If we are unable to verify your identity as required by applicable laws and regulations, we will decline to comply with your request, and let you know why.

When we will respond to your request

We will try to respond to your request within 45 days. If we require additional time, we will inform you of the reason and extension period. Any disclosures we provide will only cover the 12-month period preceding our receipt of your request. For right to know requests, we will select a format to provide your personal information to you. We may charge a fee to process or respond to your request if it is excessive, repetitive, or manifestly unfounded.

Using an authorized agent

You may submit requests under the CCPA through an authorized agent. See "Requests made on your behalf" in the "Your Choices" section above for how to do so.

Honoring opt-out preference signals

If you provide us an opt-out preference signal ("Signal") when you visit our Websites, you can opt out of the sale or sharing of your personal information without having to make an individualized request to us. You must use a valid opt-out preference signal in a format commonly used and recognized by us such as an HTTP header field.

If we receive or detect a Signal, we will treat the Signal as a valid request to opt-out of the sale or sharing of your personal information for that browser or device, and, if known, for you. We will display on our Websites "Opt-Out Preference Signal Honored" when a browser, device or consumer using a Signal visits our Websites, or display through a toggle or radio button that they have opted out of the sale or sharing of their personal information with third parties.

California Shine the Light

Under California's Shine the Light Law (California Civil Code Section 1798.83) you have the right to request the following information regarding our disclosure of your personal information to third parties for direct marketing purposes: (i) the categories of personal information we disclosed to third parties for their direct marketing purposes during the preceding calendar year; (ii) the names and addresses of the third parties that received the information; and (iii) if the nature of the third party's business cannot be determined from their name, examples of the products or services they marketed. This information may be provided in a standardized form that is not specific to you.

You are permitted to obtain this information from us once a year, free of charge. To make such a request, please submit your request in writing to:

EatStreet
Attn: CA Privacy Rights Request
2921 Landmark Place, Suite 215
Madison, WI 53713

International Transfers

Our Platform is solely intended for use by individuals located within certain portions of the United States where the services provided through our Platform are available. Personal information collected in connection with the use and operation of our Platform is stored and processed in the United States. If you access or use our Platform or otherwise engage with us from outside the United States, you expressly consent to any transfer of your personal information outside of such country to the United States. Please note, the United States has not been assessed as having adequate privacy laws by some countries and economic regions.

Changes and Updates to this Policy

Because the methods used to protect your personal information and the services we provide are continually evolving, this Policy may change at any time. Unless otherwise noted, those changes will be effective as soon as they are posted. If changes are made to this Policy, we will make it known on our Platform or by email and will indicate the last date it was updated above. Please check back periodically to see if our Policy has been updated.

Your continued use of our Platform after any changes to this Policy become effective, constitutes your continued acknowledgement that you understand that we may continue to use your personal information as described in this Policy.

Contact Us

Questions or Comments should be directed to:

EatStreet
2921 Landmark Place, Suite 215
Madison, WI 53713
privacy@eatstreet.com