Papa Privacy Policy

Effective Date: February 6, 2026
Last Update: February 6, 2026

Papa, Inc. (collectively, “Papa,” “we,” “us,” or “our”) respects the privacy of your information. This Privacy Policy describes how Papa, Inc. collects, uses, shares, and protects personal information, including via our website and mobile application. This Privacy Policy also tells you about your rights and choices with respect to your personal information, and how you can reach us to get answers to your questions.

Information We Collect

We collect information about you in a variety of ways depending on how you interact with us and our websites, mobile applications, and services, including:

  • Directly from you when you provide it to us, such as when you register for an account, sign up to receive communications from us, interact with or use our services, share reviews, or contact us by phone, email, or otherwise.
  • Automatically through the use of cookies, server logs, and other similar technologies when you interact with our websites, mobile applications, advertisements, and emails.
  • From other sources, including, for example, our affiliates, business partners, service providers, online social media networks, and other third parties, or from publicly available sources.

The following provides examples of the type of information that we collect in a variety of contexts and how we use that information.

Context Types of Personal Information Primary Purpose for Collection and Use of Personal Information
Account Registration We collect your name and contact information when you create an account, as well as authentication information such as a username and password. We also collect information relating to the actions that you perform while logged into your account. We use this information to provide account-related functionalities to our users.
Customer Information We collect the name, and contact information, of our customers and their employees with whom we may interact. We use this information to contact our customers and communicate with them concerning normal business administration such as projects, services, and billing.
Your Use of Our Website We use technology to monitor how you interact with our websites. This may include which links you click on, or information that you type into our online forms. Some of these technologies may use “cookies.” Cookies are small pieces of information that a website sends to a computer’s hard drive while a website is viewed. Other types of data we track include your IP address, the website that referred you to our website, and data about the device you use to visit our website. We use this information to make our website operate efficiently. We also use it to understand how you interact with our websites to improve them and understand your preferences. Finally, we use this information to help detect and prevent fraud.
Technology on Our Website for Targeted Advertising We may allow third parties to place technology on our websites (e.g., a cookie or a pixel) that allows them to track you. The third party might also collect data over time and across other websites. They use this data to serve advertisements tailored to your interests, which may include advertisements about our products or services. Our partnerships with third-party service providers allow us to enhance our web content. We permit cookies on our website to participate in behavior-based advertising, which allows us to tailor our advertisements to better suit users’ interests. Where required by law, we base the use of third-party tracking technologies upon consent. Such users should see our Cookie Preference Center for more information.
Biometric Information We may collect biometric information, specifically your faceprint. We use this information to verify your identity against the official source of your ID during the Papa Pal signup process.
Demographic and Personal Characteristic Information We collect personal information, such as your age, location, gender, marital status, and nationality. We use this information to better understand the users of our services and provide tailored services to our users. In some contexts our use is also based upon your consent to provide us with geo location information.
Distance Information When you use one of our mobile apps, we may collect your location from the GPS, Wi-Fi, and/or cellular technology in your device to determine your location. We use this information to understand our users and provide tailored services. In some contexts our use is also based upon your consent to provide us with geo location information.
Email Interconnectivity If you receive email from us, we use certain tools to capture data related to when you open our message,
click on any links or banners it contains and make purchases.		 We use this information to understand how you interact with our communications to you.
Feedback/Support If you provide us feedback or contact us for support we will collect your name and email address, as well as any other content that you send to us, in order to reply. We use this information to receive, and act upon, your feedback or issues.
Health-related Information Some jurisdictions consider certain personal information to be health information. If you receive services from us, we may collect and process certain categories of personal information related to your health with respect to those services. These categories may include (i) individual health conditions, treatments, diseases, or diagnoses; (ii) social, psychological, behavioral, and medical interventions; (iii) use or purchase of prescribed medication; (iv) biometric data; and (v) precise geolocation information that may reveal receipt of health services. We use this information to provide you with our services.
Mailing List When you sign up for one of our mailing lists we collect your email address or postal address. We share information about our products and services with individuals that consent to receive such information.
Mobile Devices We collect information from your mobile device such as unique identifying information broadcast from your device when visiting our website or using our mobile app. We use this information to understand how users interact with us on their mobile devices.
Billing Information We collect your name, billing address, shipping address, email address, phone number, and credit or debit card information when you place an order for our services. We use your information to perform our contract to provide you with products or services.
Partner Promotion We collect information that you provide as part of a co-branded promotion with another company. We use this information to fulfill our promotions.
Public Health and Safety In certain situations where a serious public health threat has been identified, we may collect information from Papa Pals, guests, and other individuals. We use this information to protect the health and safety of our employees, Papa Pals, and other individuals. In some jurisdictions we may be required by law, regulation, or governmental order to collect and retain information related to issues of public health and safety.
Surveys and Reviews When you participate in a survey, we collect information that you provide through the survey. If the survey is provided by a third party service provider, the third party’s privacy policy applies to the collection, use, and disclosure of your information. Additionally, we collect information you provide when leaving comments, reviews, or suggestions. We use this information to understand your opinions, and collect information relevant to our organization.
Website interactions We use technology to monitor how you interact with our website. This may include which links you click on, time spent viewing features and pages, or information that you type into our online forms. This may also include information about your device or browser. We use this information to understand how you interact with our website to better improve it, and to understand your preferences and interests in order to select offerings that you might find most useful. We also use this information to detect and prevent fraud.

Papa may collect biometric identifiers or biometric information, such as faceprints, solely for identity verification, safety, fraud prevention, and platform security purposes, where permitted by law and with appropriate notice and consent.

Retention and Destruction

Biometric information is retained only for as long as necessary to fulfill the purposes for which it was collected, as outlined above, in accordance with Papa’s internal record retention policy or as otherwise required by applicable law.
Biometric information is securely destroyed when it is no longer needed for those purposes or upon satisfaction of the applicable retention period, unless a longer retention period is required by law.

Restrictions on Use

Papa does not sell, lease, trade, or otherwise profit from biometric information. Papa does not disclose biometric information except as permitted by law, with service providers acting on Papa’s behalf, or with your consent.

Cookies and Tracking Technologies

We use cookies and similar tracking technologies on our website to operate and improve our services, remember your preferences, analyze traffic and site usage, and, where permitted, deliver more relevant content and advertising. Cookies are small data files stored on your device that help us recognize you and your preferences when you visit our site.

We classify the cookies we use as follows:

  • Essential Cookies: Required for the website to function and to provide the services you request.
  • Performance and Analytics Cookies: Help us understand how visitors use our site, diagnose technical issues, and improve performance.
  • Functional Cookies: Remember your preferences and enhance your user experience.
  • Advertising and Targeting Cookies: Track your browsing activity to deliver more relevant content and advertising and measure campaign effectiveness.

When you first visit our website, you will see a cookie banner that allows you to accept or reject non-essential cookies.
You can update your preferences at any time by clicking the “Cookie Settings” link at the bottom of our site.
Please note that if you clear your cookies, switch browsers, or use a different device, you will need to set your preferences again.

Rejecting non-essential cookies will limit tracking and targeted advertising based on your browsing behavior but will not affect the operation of cookies that are strictly necessary for the site to function.

How We Use Information

In addition to the purposes and uses described above, we use and process information in the following ways:

  • To identify you when you visit our websites or use our mobile app.
  • To provide services, including outside services (such as transport or meal delivery).
  • To improve our services and offerings.
  • To streamline the payment process.
  • To conduct analytics.
  • To communicate with you, such as to respond to and/or follow-up on your requests, inquiries, issues, or feedback.
  • To send marketing and promotional materials including information relating to our services, sales, or promotions, or those of our business partners.
  • To detect and protect against malicious, deceptive, fraudulent, or illegal activity, including violation of our policies and terms and conditions, security incidents, and harm to the rights, property, or safety of our company and our users, employees, or others.
  • To debug, identify and repair errors that impair existing intended functionality of our website and mobile app.
  • To comply with our legal or regulatory obligations, to establish or exercise our rights, and to defend against a legal claim.
  • For internal administrative purposes, as well as to manage our relationships.
  • For such other purposes as you may consent (from time to time).

Although the sections above describe our primary purpose in collecting your information, in many situations we have more than one purpose.
For example, if you complete a payment online, we may collect your information to perform our contract with you, but we also maintain your information
after your transaction is complete so that we can quickly and easily respond to any questions about your purchased services.

To the extent we maintain and use personal information in a deidentified form, we will not attempt to reidentify the information, except for the purpose of determining whether our deidentification processes satisfy our legal obligations.

Communications and Consent

Papa may communicate with you by phone call, text message, email, or other electronic means in connection with your use of the Services.

Operational Communications

Papa may contact you for operational, transactional, or service-related purposes, such as account notifications, visit coordination, safety messages, responses to inquiries, or other communications necessary to provide the Services. These communications are not marketing and may be sent based on your relationship with Papa.

Marketing Communications

Papa will not send marketing or promotional text messages or automated calls unless Papa has obtained your prior express written consent, as required by the Telephone Consumer Protection Act (TCPA) and other applicable law. Where required by applicable law, Papa sends marketing communications only with appropriate consent. Marketing communications are optional and are not a condition of receiving services.

Opt-Out

You may opt out of marketing text messages at any time by replying “STOP.” Opting out of marketing communications will not affect your ability to receive operational or service-related communications from Papa.

HIPAA and Health Information

Certain Papa services involve information that may constitute Protected Health Information (PHI) under HIPAA. In those cases, Papa acts as a Business Associate to the applicable covered entity, and Papa’s use and disclosure of PHI are governed by the applicable Business Associate Agreement (BAA) and HIPAA, rather than this Privacy Policy. Information processed outside the scope of HIPAA-covered services is governed by this Privacy Policy and applicable law. In the event of a conflict, the BAA controls.

How We Share Information.

In addition to the specific situations discussed elsewhere in this Privacy Policy, we may disclose, and third-parties may process, personal information in the following situations:

  • Affiliates and Acquisitions. We may share information with our corporate affiliates (e.g., parent company, sister companies, subsidiaries, joint ventures, or other companies under common control). If another company acquires, or plans to acquire, our company, business, or our assets, we will also share information with that company,
    including at the negotiation stage.
  • Other Disclosures without Your Consent. We may disclose information in response to subpoenas, warrants, or court orders, or in connection with any legal process, or to comply with relevant laws. We may also share your information to establish or exercise our rights, to defend against a legal claim, to investigate, prevent, or take action regarding possible illegal activities, suspected fraud, safety of person or property, or a violation of our policies, or to comply with your request for the shipment of products to or the provision of services by a third-party intermediary.
  • Public. Some of our websites may provide the opportunity to post comments, or reviews, in a public forum. If you decide to submit information on these pages, that information may be publicly available.
  • Partner Promotion. We may offer promotions with third party partners. We may share information with third party partners for the purposes of providing you with information on goods or services we believe will be of interest to you, such as meal delivery or transportation services. You can, at any time, opt-out of receiving such communications through the mechanism indicated in such communications.
  • Service Providers. We may share your information with service providers. Among other things service providers may help us to administer our website, conduct surveys, provide technical support, process payments, and assist in the fulfillment of services.
  • Other Disclosures with Your Consent. We may disclose your information to other third parties when we have your consent or direction to do so.

The table below describes the categories of personal information we collect, disclose for a business purpose, or “share”; we do not “sell” personal information (as those terms are defined by applicable law).
Please note, in addition to the recipients identified below, we may disclose any of the categories of personal information we collect with government entities, as may be needed to comply with law or prevent illegal activity.
We do not “sell” your personal information for money. As discussed elsewhere in the Privacy Policy, we use cookies and similar tracking technologies for purposes of targeted advertising.
For more information, please see the Cookie Preference Center. For details regarding how we use personal information, please see the Information We Collect section of the Privacy Policy.
For information regarding how long we retain personal information, please refer to the How We Protect and Retain Information section of the Privacy Policy.
Papa does not use health-related information for marketing or promotional purposes without consent, except as permitted by law and with required consent.

Category of Personal Information Disclosures for a Business Purpose Sharing for Cross-Context Behavioral Advertising
Identifiers – this may include real name, alias, postal address, unique personal identifier, online identifier, email address, account name, or other similar identifiers. Affiliates or subsidiaries.
Business partners.
Internet service providers.
Joint marketing partners.
Operating systems and platforms.
Other Service Providers.
Payment processors and financial institutions.
Professional services organizations, this may include auditors and law firms.		 Advertising networks
Government Issued Identification – this may include social security number, driver’s license number, or state issued identification number, passport number. Affiliates or subsidiaries.
Business partners.
Operating systems and platforms.
Other Service Providers.
Payment processors and financial institutions.
Professional services organizations, this may include auditors and law firms.
Financial Information – this may include bank account number, credit card number, debit card number, and other financial information. Affiliates or subsidiaries.
Business partners.
Operating systems and platforms.
Other Service Providers.
Payment processors and financial institutions.
Health Related Information – this may include medical information, mental or physical condition or treatment, or health insurance information. Affiliates or subsidiaries.
Business partners.
Operating systems and platforms.
Other Service Providers.
Professional services organizations, this may include auditors and law firms.
Characteristics of protected classifications – this may include age, sex, nationality, physical, or mental handicap, etc. Affiliates or subsidiaries.
Business partners.
Operating systems and platforms
Other Service Providers.
Professional services organizations, this may include auditors and law firms.
Commercial information – this may include information about products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. Affiliates or subsidiaries.
Business partners.
Internet service providers.
Joint marketing partners.
Operating systems and platforms.
Other Service Providers.
Biometric information – this may include face geometry (i.e. faceprint). Affiliates or subsidiaries.
Business partners.
Operating systems and platforms.
Other Service Providers.
Internet or other electronic network activity information – this may include browsing history, search history, and information regarding an individual’s interaction with an internet website, application, or advertisement. Affiliates or subsidiaries.
Business partners.
Internet service providers.
Joint marketing partners.
Operating systems and platforms.
Other Service Providers.
Geolocation data Affiliates or subsidiaries.
Business partners.
Internet service providers.
Operating systems and platforms.
Other Service Providers.
Professional or employment-related information Affiliates or subsidiaries.
Business partners.
Operating systems and platforms.
Other Service Providers.
Payment processors and financial institutions.
Professional services organizations, this may include auditors and law firms.
Inferences drawn from any of the information listed above Affiliates or subsidiaries.
Business partners.
Internet service providers.
Joint marketing partners.
Operating systems and platforms.
Other Service Providers.

Automated Decision-Making

Papa does not use automated decision-making or profiling, including algorithmic matching, to make decisions that produce legal or similarly significant effects about individuals.

Your Choices

Some jurisdictions give you a right to make the following choices regarding your personal information:

  • Access To Your Personal Information. You may request access to your personal information or confirmation that we have and/or share information about you. In certain limited circumstances, you may also request to receive access to your data in a portable, machine-readable format. Some jurisdictions also permit you to access a list of third parties with whom we have shared or sold your health information.
  • Changes To Your Personal Information. We rely on you to update and correct your personal information. Most of our websites and the mobile app allow you to modify or delete your account profile. If our website or mobile app does not permit you to update or correct certain information, you can contact us at the address described below in order to request that your information be modified. You may ask us to correct information that is inaccurate or incomplete. Note that we may keep historical information in our backup files as permitted by law.
  • Deletion Of Your Personal Information. You may request that we delete your personal information, including deletion of your account if you use our mobile app. If required by law, we will grant a request to delete information, but you should note that in many situations we must keep your personal information to comply with our legal obligations, resolve disputes, enforce our agreements, or for another business purposes. In order to delete your account via the mobile app, open and log in to your Papa Pal app, and request removal of your account at the bottom of the Profile Tab.
  • Opt-out of Targeted Advertising. You can exercise your preferences in relation to targeted advertising via cookies served on our Website. When you first visit our Website, you will be presented with a banner that offers you choices about whether to accept or reject cookies. If you wish to change your preferences regarding cookies, you can do so any time by clicking the Cookie Settings link at the bottom of this page. Below we also describe the purposes for which we use these technologies. Please note that if you change browsers or devices, or if you clear your browser’s cache, you may need to exercise your preferences again.
  • Objection to or Restriction of Certain Processing. In certain circumstances, you may object to the processing of your personal information, or request that we restrict processing of your personal information, by following the instructions described below.
  • Online Tracking. We do not currently recognize the “Do Not Track” signal.
  • Promotional Emails. You may choose to provide us with your email address for the purpose of allowing us to send free newsletters, surveys, offers, and other promotional materials to you, as well as targeted offers from third parties. You can stop receiving promotional emails by following the unsubscribe instructions in emails that you receive. If you decide not to receive promotional emails, we may still send you service related communications.
  • Promotional Mailings. If at any time you do not want to receive offers and/or circulars from us you can remove yourself from our mailing lists by emailing us (our contact information is below) with “NO SNAIL MAIL” in the subject line along with your name, address, and zip code. Please note that our mailings are prepared in advance of their being sent. Although we will remove your name from our mailing list after receiving your request, you may still receive mailings from us that had been initiated prior to your name being removed.
  • Revocation of Consent. Where we process your personal information based upon consent, you may revoke consent. Please note, if you revoke your consent for the processing of personal information then we may no longer be able to provide you services.
  • Text Messages. If you receive a text message from us that contains information you can opt-out of receiving future text messages by replying “STOP.”

Please note, not all of the rights described above are absolute, and they do not apply in all circumstances.
In some cases, we may limit or deny your request because the law permits or requires us to do so, or if we are unable to adequately verify your identity.
We will not discriminate against individuals who exercise their privacy rights under applicable law.

Submitting Requests

You may exercise the rights described above by contacting us as indicated in the Contact Information section below.
If you disagree with our denial of a request, you may appeal our decision by contacting us with the subject line “Appeal.”

Note that, as required by law, we will require you to prove your identity. We may verify your identity by phone call or email.
Depending on your request, we will ask for information such as your name, the service with us, or the date of your last interaction with us from us.
We may also ask you to provide a signed declaration confirming your identity. Following a request, we will use reasonable efforts to supply, correct or delete personal information about you in our files.

In some circumstances, you may designate an authorized agent to submit requests to exercise certain privacy rights on your behalf.
If you are an authorized agent submitting a request on behalf of an individual, you must attach a copy of a completed Authorized Agent Designation Form indicating that you are able to act on another person’s behalf.

Response Timing

Papa will respond to verified requests to access, delete, or correct personal information within the timeframes required by applicable law.
Where permitted, Papa may extend its response period as allowed by law and will notify the requester accordingly.

How We Protect and Retain Information

No method of transmission over the internet, or method of electronic storage, is fully secure.
While we use reasonable efforts to protect your personal information from unauthorized access, use, or disclosure, we cannot guarantee the security of your personal information.
In the event that we are required by law to inform you of a breach to your personal information we may notify you electronically, in writing, or by telephone, if permitted to do so by law.

Some of our websites and mobile app permit you to create an account. When you do you will be prompted to create a password.
You are responsible for maintaining the confidentiality of your password, and you are responsible for any access to or use of your account by someone else that has obtained your password, whether or not such access or use has been authorized by you.
You should notify us of any unauthorized use of your password or account.

We retain your personal information for only as long as necessary to fulfil the purposes outlined in this Privacy Policy, including for the purposes of satisfying any legal, accounting, or reporting requirements, unless a longer retention period is required or permitted by law.
To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure of the information, the purposes for which we obtained the information and whether we can achieve those purposes through other means, as well as applicable legal requirements.

Third-Party Applications/Websites

For your convenience, we may provide links to websites and other third-party content or services that we do not own or operate.
The websites and third-party content to which we link may have separate privacy notices or policies.
Please note, we have no control over the privacy practices websites, or services that we do not own.
We encourage you to review the privacy policies of any third-party website or application for details about such third party’s privacy practices.

Changes To This Privacy Policy

We may change our privacy policy and practices over time. To the extent that our policy changes in a material way, the policy that was in place at the time that you submitted personal information to us will generally govern that information unless we receive your consent to the new privacy policy.
Our privacy policy includes an “effective” and “last updated” date. The effective date refers to the date that the current version took effect.
The last updated date refers to the date that the current version was last substantively modified.
If we make a material change to our privacy notice, we will attempt to notify you through the email address specified in your account or by means of a notice on the services prior to the change becoming effective.

Children

Our websites and services are not intended for individuals under the age of 18.
We do not knowingly collect personal information from children under the age of 18, without parental consent.
Children under the age of 18 should not provide their personal information to us.

Contact Information

If you have any questions, comments, or complaints concerning our privacy practices, or if you need to access this Privacy Policy in an alternative format due to having a disability, please contact us at the appropriate address below. We will attempt to respond to your requests and to provide you with additional privacy-related information.

Email: privacy@papa.com

Address: 390 NE 191st St., Suite 8655
Miami, FL 33179

Phone: 1-855-938-8195

Additional Information For California Residents

California law requires us to disclose the following additional information related to our privacy practices.
If you are a California resident, the following privacy disclosures apply to you in addition to the rest of the Privacy Policy.

  • California Shine the Light. If you would like more information concerning the categories of personal information (if any) we share with third parties or affiliates for those parties to use for direct marketing, please submit a written request to us using the information in the Contact Information section above.
  • California Sensitive Information Disclosure. We collect the following categories of sensitive personal information (as defined under California law): information related to your health, social security numbers, government identification (such as a drivers license or other identification card), precise geolocation, and certain biometric information. This information is collected in order to process transactions, comply with laws, manage our business, or provide you with services. Note that we do not use such information for any purposes that are not identified within the California Privacy Rights Act Section 1798.121. We do not “sell” or “share” sensitive personal information for purposes of cross-context behavioral advertising.

Washington – My Health, My Data Policy

Residents of Washington state and other consumers receiving health-related services within Washington are entitled to certain information and rights relating to the collection, processing, and disclosure of their consumer health data as it pertains to our services beyond what is required by the Health Insurance Portability and Accountability Act (“HIPAA”).
For more information about our compliance with HIPAA, see our HIPAA Privacy Rule.
We collect and use consumer health data to provide services to you at your request, tailor those services to your specific needs, recommend additional services that may be of interest to you (such as meal delivery or transportation services), and to verify your identity.

Washington Consumer Health Data – Information We Collect

We collect information about you in a variety of ways depending on how you interact with us and our websites, mobile applications, and services, including:

  • Directly from you when you provide it to us.
  • From other sources, including, for example, our affiliates, business partners, service providers, online social media networks, and other third parties, or from publicly available sources.

Categories of consumer health data that we collect may include: (i) individual health conditions, treatments, diseases, or diagnoses; (ii) social, psychological, behavioral, and medical interventions; (iii) use or purchase of prescribed medication; (iv) biometric data; and (v) precise geolocation information that may reveal receipt of health services.
We collect this information directly from you when you provide it, automatically from our mobile app when you have geolocation services enabled, and from our affiliates, business partners, and service providers who assist us in providing our services.

How We Share Your Information

We may share your consumer health data with affiliates or third parties as necessary to provide you with our services.
Categories of consumer health data that we may share include, but are not limited to, biometric information and precise geolocation.
We share this information with third party service providers who assist us in facilitating or improving our services, processing payment, providing customer support, providing geolocation and other information to Papa Pals, providing meal delivery or transportation services at your request, performing website or mobile app-related services, or assisting us in analyzing how the services are used. These third parties have access to your consumer health data only to perform these tasks on Papa’s behalf and are obligated not to disclose or use it for any other purpose other than the purpose for which we disclose it to them.

Your Choices

As a recipient of our services in the state of Washington, you have rights related to your consumer health data. These rights include:

  • Right to confirm whether we collect, process, and/or share your consumer health data.
  • Right to access your consumer health data, including a list of third parties and affiliates with whom we share your consumer health data.
  • Right to request deletion of your consumer health data; note that in some circumstances, we are unable to complete this request where legal obligations require us to retain certain information.
  • Right to revoke consent where we have collected and processed your consumer health data based on your consent.
  • Right to appeal a decision we make regarding a request related to the above rights.

Submitting Requests:

If you wish to exercise any of these rights, or otherwise have questions related to your consumer health data, please send us an email at privacy@papa.com. We will not discriminate against individuals who exercise their privacy rights under Washington law.

Papa does not sell consumer health data.