Ovenward privacy and messaging notice

Ovenward is a brand operated by KED LLC, organized in Utah, with a mailing address at 34 Marcia Rd, Wilmington, MA 01887, United States. Contact klay@kedapps.com for privacy questions, requests, or support.

This notice covers Ovenward websites, accounts, storefronts, and supported services. Independent merchants also handle information about their customers to sell food and fulfill orders. A merchant is responsible for its own uses and notices. Contact the merchant about its products, fulfillment, or use of information outside Ovenward; contact us about the platform or help identifying the appropriate recipient of a privacy request.

KED LLC uses certain information for its own platform operations, account security, fraud prevention, billing, and legal obligations. It also processes merchant customer information to provide the services requested by the merchant. The respective legal roles depend on the processing and applicable law, as addressed in the merchant agreement.

Accounts and business setup. We collect a phone number, account identifiers, verification and security records, business profile details, and information supplied by an owner or authorized staff member. Staff access records identify which business and functions a person may use. We also retain the versions of terms accepted and relevant consent choices when collected.

Orders and customers. We process products and quantities ordered, totals and discounts, payment and refund status, pickup choices, order references, contact details supplied for the order, optional notes, and the merchant's fulfillment updates. Features such as Stars, reviews, waitlists, and saved businesses create related records when used. Information a merchant imports may include historical orders and customer details, subject to its authority to provide them.

Payments. Stripe processes payment credentials and connected-account onboarding through its supported interfaces. Ovenward processes the references, status, amounts, fees, refunds, tax calculation results, and other information needed to operate the transaction. Do not send full card numbers, bank passwords, or identity documents through ordinary order notes or support messages. Stripe's own privacy notice covers its independent processing.

Communications. We process inquiries, support correspondence, enabled merchant messages, delivery status, and consent and opt-out records. When you choose an optional text program, we record the choice needed to administer it. Responding to a support question does not automatically subscribe you to marketing.

Device and service information. Our infrastructure receives connection information necessary to deliver and protect requests, including network addresses and browser or device information. We may keep security, error, and operational logs. Public activity totals and optional detailed analytics are described separately below; the absence of identifying information in a counter does not mean the infrastructure receives no connection information.

Connected services and public content. When a supported integration is enabled and you authorize it, we process the account references, permissions, protected access credentials, and content needed for that connection. Merchant storefronts display content the merchant publishes. A private or unlisted drop can still be opened by someone who receives its link; it is not a password-protected secret.

We use information to authenticate accounts, maintain business access, provide storefronts and checkout, fulfill merchant instructions, process payment and refund status, calculate configured tax, support customers and merchants, deliver authorized messages, enforce preferences, prevent abuse, investigate errors, and meet legal obligations. We use the separate analytics choices described below to measure use and improve the product.

We do not treat a purchase, phone verification, acceptance of terms, or an imported customer record as permission for optional marketing. We do not authorize one merchant to use another merchant's customer list.

The merchant from whom you order and its authorized staff receive the information needed for that business's customer relationship and fulfillment. Information can also be disclosed to providers that perform a service for Ovenward or participate directly in your transaction, including Google/Firebase for hosting and authentication, Stripe for payments, and Twilio for enabled messaging. Authorized support and operational tools may process information needed to investigate or manage the service.

We may disclose information to comply with lawful requests, protect rights or safety, investigate fraud or security incidents, or carry out a business transaction such as a reorganization, subject to applicable protections. We do not promise absolute confidentiality for information you choose to publish publicly.

We do not sell mobile contact information or transfer SMS opt-in records to other businesses for their promotional use. Messaging providers and authorized service providers may process relevant information to operate the program and honor suppression.

Ovenward uses necessary account and security storage, cart recovery records, and saved preferences to operate the service. Blocking necessary browser storage may prevent a feature from working. These functions are separate from optional detailed analytics.

Anonymous counting records shared totals for fixed page or interaction names and public business or drop references. Those counters do not contain visitor, account, device, or session identifiers, contact details, payment details, IP addresses, full URLs, or form entries, and are not individual browsing histories.

You can turn anonymous totals off through Privacy choices where offered. Saving that choice stores the preference; the counting itself does not require a tracking cookie. We expire counter data after up to 30 days and reporting aggregates after 13 months.

Where offered, you may choose to allow Firebase Analytics, a Google service, through Privacy choices. This choice is separate from marketing-message consent and does not determine whether you can sign in or buy food. You may withdraw the choice on the browser or device where it was made.

When enabled, analytics can use pseudonymous browser or app identifiers, measured sessions, device and browser information, approximate location, coarse referral categories, and opaque business, drop, and order references. Our analytics instrumentation excludes names, phone numbers, emails, form entries, payment details, and full referral URLs from event fields. Google still processes connection information to provide its service.

Ovenward may join measured checkout references to confirmed order records for conversion reporting. Merchants receive aggregate reports for their own businesses, and authorized Ovenward administrators receive platform reports. People who decline or block optional analytics are absent from those measured visitor and conversion reports. Anonymous totals remain a separate measurement.

Our reporting export keeps individual export events for 30 days and aggregates for 13 months. In Google Analytics, detailed events are retained for two months and user-level data for 14 months, with user retention renewed by activity. Google's standard aggregate reports follow its separate retention policy. Advertising personalization and Google signals are disabled.

Website analytics preferences currently last up to six months. Withdrawal stops future optional collection on that browser or app; it does not automatically delete information already retained. See Google's explanation of information from partner sites. Applicable rights requests are described below.

Merchants can create QR links that redirect to a destination they choose. QR reporting keeps aggregate visit counts without individual browsing histories, visitor fingerprints, or tracking cookies. Those counts do not identify unique people. The destination has its own policies, and infrastructure still processes requests to deliver the link.

When you connect or follow a link to Stripe, Instagram, or another third-party service, its own terms and privacy practices may apply. An integration is available only when enabled for your account. Disconnecting an integration does not by itself erase orders or unrelated Ovenward records. Separate deletion requests and any provider callback are handled through the applicable supported process.

We retain information for the purposes described here, including account operation, fulfillment, payment and refund reconciliation, disputes, consent and suppression, security, and legal obligations. The period depends on the record, its purpose, and applicable requirements. We use these criteria to review retention and deletion requests:

We do not retain personal information indefinitely merely because it may be useful later. We review the purpose and applicable obligations, remove or deidentify information when no longer needed, and restrict information preserved for a legal hold. The analytics periods described above apply separately. Contact us for the treatment of a particular record or request.

We use access controls and technical and organizational safeguards designed to protect information. No service can guarantee that every security incident will be prevented. Send a suspected account or privacy issue to klay@kedapps.com without including unnecessary sensitive information.

Contact klay@kedapps.com to request access, correction, deletion, or assistance with other privacy rights that apply to you. We will take reasonable steps to verify the request and protect another person's information. Identify the account or merchant involved and the action requested; do not email a password, verification code, or full payment number.

Where a merchant controls the requested records, we may refer you to that merchant or assist it with the request. Some information may need to be retained for a legal obligation, unresolved payment or dispute, security need, or suppression. We will explain an applicable limitation rather than describe an account as completely erased when records remain.

Depending on applicable law, you may have rights to know or access information, obtain a portable copy, correct inaccuracies, request deletion, or opt out of certain processing. You may use an authorized agent where permitted, subject to verification of authority. We respond within the applicable legal deadline and explain a permitted extension or refusal. To appeal a refusal where an appeal right applies, email klay@kedapps.com with “Privacy appeal” and the request reference. We will not discriminate against you for exercising a protected privacy right. Contact us if you need an accessible way to submit a request.

Ovenward account creation is intended for adults and the service is not directed to children under 13. If you believe a child has supplied personal information improperly, contact klay@kedapps.com.

Ovenward is available only in the United States, with supported merchant payments in USD. Service providers may process information in more than one location, including outside the United States, subject to applicable contractual and legal protections.

We will identify the current version and effective date and provide notice of material changes as required. Updated wording does not itself authorize a new use requiring separate consent. Questions about this notice may be sent to klay@kedapps.com.

These terms cover enabled Ovenward messaging programs. Program availability depends on the merchant, provider approval, and your consent and suppression choices. Accepting the commercial terms is not consent to any optional text program.

Authentication. When you request a phone verification code, the code is used to establish account access. Requesting a code does not subscribe you to merchant promotions or recurring Ovenward updates.

Order updates. A separate order choice governs supported confirmation and pickup messages. Refusing optional order texts does not itself stop checkout; you can use the on-screen order information. Existing recipient or sender suppression may prevent delivery even after an order-specific choice.

Merchant drop alerts. A merchant's optional program may send supported drop-opening or similar promotional notices for that merchant. Consent is not required to purchase. A subscription for one merchant does not subscribe you to another.

Ovenward account updates. If offered, a separate optional program may send direct account, payment, security, service, and support updates from Ovenward. It does not enroll you in merchant marketing. You may use the service without choosing this program.

Message frequency varies and message and data rates may apply. Delivery depends on your carrier and other providers and is not guaranteed. Contact klay@kedapps.com for help with an Ovenward program, or the merchant for an order or its products. Help instructions also appear in the applicable message.

Follow the opt-out instructions in the actual message. For a shared Ovenward sender, UNSUB followed by the displayed merchant code stops that merchant's messages; UNSUBALL or STOP stops messages from the shared sender across its merchants. For a dedicated sender, STOP applies to that sender. HELP requests available assistance. A broad opt-out can stop order updates as well as promotional texts from the affected sender.

Opting out does not cancel an order, issue a refund, or delete your account. Do not rely on a text alone to track an order. A later request to restart messages must satisfy the applicable consent and suppression process; merely placing another order or requesting an authentication code does not erase a prior marketing opt-out.