This Privacy Policy explains how MEP Suite LLC, a Wyoming limited liability company ("MEP," "we," "us," or "our"), collects, uses, and discloses personal information in connection with our website, our restaurant-operations platform, and our related business activities (collectively, the "Services"). It also describes the privacy rights available to individuals under U.S. state privacy laws and how to exercise them.
1. Scope; the two roles in which we handle information
We handle personal information in two distinct roles, and this Policy addresses each differently.
As a business (this Policy governs). When we collect information about visitors to our website, individuals who inquire about or purchase our Services, the personnel of our business customers who administer or use their account, and others who communicate with us, we act as a "business" or "controller." This Policy describes that processing.
As a service provider (this Policy does not govern; the DPA does). When our business customers use the Services to process information in their own records (for example, information within the reports, reservations, reviews, delivery, labor, and employment records they choose to import) we process that information only as a "service provider" or "processor" on that customer's documented instructions, and only to provide the Services. We are not a third party, business, or controller with respect to that customer data. Our handling of it is governed by our Data Processing Addendum and by the customer's own privacy notice, not by this Policy. If you are a guest, employee, or contractor of one of our customers and have questions about that data, please contact the business you dealt with directly; they are the controller, and we will assist them in responding to your request as required by law.
MEP provides the Services to businesses. The Services are offered for use in the United States and are not directed to consumers acting in a personal or household capacity.
2. Categories of personal information we collect
In our role as a business, and depending on how you interact with us, we may collect the following categories of personal information:
- Identifiers and contact details, such as name, business email address, business phone number, business or mailing address, and online account or user identifiers.
- Account and authentication information used to create and secure an account and to sign you in.
- Commercial and transaction information, such as the Services purchased or considered, billing contact details, and correspondence relating to orders and support.
- Professional or employment information provided when you inquire on behalf of a business or apply to work with us.
- Internet and device activity limited to what is needed to operate and secure the Services, such as log data, general location inferred from an IP address, device and browser type, and basic usage of our website.
- Communications and the contents of messages, inquiries, and support requests you send us.
Certain account authentication credentials we collect may constitute "sensitive personal information" under California law. We collect and use them solely to create, secure, and provide access to accounts; we do not use them to infer characteristics about you; and we do not use or disclose sensitive personal information for purposes other than those permitted under applicable law; so the "right to limit" does not apply and no separate limitation option is required. Apart from that, we do not seek to collect sensitive personal information in our role as a business, and we ask that you not send us government identifiers, financial account numbers, health information, or other sensitive details except where specifically requested and necessary.
3. Sources of personal information
We collect personal information: directly from you when you contact us, request or use the Services, or create an account; automatically through standard, privacy-preserving logging when you use our website or the Services; and, occasionally, from your employer or the business you represent, or from service providers that support our own operations.
4. How we use personal information
We use personal information in our role as a business for the following purposes: to provide, operate, secure, support, and improve the Services and our website; to create and administer accounts and authenticate users; to communicate with you about the Services, respond to inquiries, and provide support; to process orders and manage our business relationship; to protect the security and integrity of the Services, prevent fraud and misuse, and maintain audit and operational records; to comply with law and enforce our agreements; and for other purposes disclosed to you at the point of collection or to which you consent.
We do not use personal information to build advertising profiles, and we do not use sensitive personal information to infer characteristics. We do not use personal information, or the data we process on our customers' behalf, to train generalized artificial-intelligence models, and our artificial-intelligence service providers are contractually prohibited from doing so.
5. How we disclose personal information
We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under applicable law.
We disclose personal information only as follows:
- To categories of service providers and vendors that perform functions on our behalf (for example, cloud infrastructure and hosting; database, authentication, and storage; communications and email delivery; and operational and analytics support) under written contracts that limit their use of the information to performing those functions for us. We disclose only the categories of such providers; we do not publish a list of specific vendors, and the identities, configurations, and implementations of the vendors and tools we use are our confidential information and trade secrets, available to customers and prospects under a data-protection agreement only on written request.
- To our affiliates, and to professional advisors such as auditors and counsel, subject to confidentiality.
- In connection with a merger, financing, acquisition, or similar corporate transaction, subject to appropriate protections.
- To comply with law, respond to lawful requests and legal process, and protect the rights, safety, and property of MEP, our customers, and others.
Where we act as a service provider for a customer's data, we disclose that data only as that customer instructs and as permitted by our Data Processing Addendum.
6. Retention
We retain personal information for as long as reasonably necessary to fulfill the purposes described in this Policy, including to provide the Services, maintain security and operational records, and comply with our legal obligations, and thereafter as required or permitted by law. We determine retention based on the amount, nature, and sensitivity of the information, the purposes for which it is processed, and applicable legal requirements. We may retain information in routine backups for a limited period pending deletion in the ordinary course, and we may retain de-identified or aggregated information that can no longer reasonably be linked to an individual. Retention of the data we process on behalf of our business customers is governed by our Data Processing Addendum, not by this Section.
7. Security
We maintain an information-security program consistent with a recognized control framework, including controls in areas such as encryption of data in transit and at rest, access controls on a least privilege basis, authentication controls, logical isolation of customer environments, additional application-layer encryption of stored credentials, restricted storage for sensitive documents, logging and monitoring, vulnerability management, and incident response. The specific configurations, architecture, tooling, key management, vendors, and implementation of these controls are our confidential information and trade secrets and are not disclosed. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
8. Your privacy rights
Depending on your state of residence and applicable law, you may have some or all of the following rights with respect to personal information we hold about you in our role as a business: to know or access the personal information we have collected and how we use and disclose it; to correct inaccurate personal information; to delete personal information; to obtain a portable copy of certain information; and to opt out of any sale of personal information, targeted advertising or sharing for cross context behavioral advertising, and profiling that produces legal or similarly significant effects. Because we do not sell personal information, do not engage in targeted advertising or sharing for cross-context behavioral advertising, and do not conduct such profiling, no opt-out is necessary for those activities. We will not discriminate against you for exercising your rights.
How to exercise your rights. You may submit a request by emailing privacy@mepsuite.com or, if you have an account, through your authenticated account. To protect your information, we will take reasonable steps to verify your identity before responding, which may include confirming information we already hold or verifying through your account. You may use an authorized agent to submit a request on your behalf where permitted by law; we may require the agent to demonstrate authority and may separately verify your identity.
If you are an individual whose information we process on behalf of a business customer (our role as a service provider), we will refer your request to that customer or assist them in responding, and we will act on their instructions as required by law.
Appeals. If we decline your request and you are a resident of a state that provides an appeal right, you may appeal our decision by replying to our response or by contacting privacy@mepsuite.com with the word "Appeal." We will respond to appeals within the time required by applicable law. If your appeal is denied, you may contact your state attorney general.
California residents. This Policy, including the categories described in Sections 2 through 6, serves as our notice at collection. In the preceding twelve months we collected the categories of personal information described in Section 2 for the business and commercial purposes described in Section 4, and disclosed certain of those categories, for a business purpose, to the categories of recipients described in Section 5. We did not sell or share personal information, and we did not use or disclose sensitive personal information for any purpose that would create a right to limit, as those terms are defined under California law.
9. Cookies and analytics
Our website uses only the cookies and similar technologies reasonably necessary to operate the site, keep you signed in, and maintain security, together with limited, privacy-preserving analytics to understand and improve site performance. Any analytics providers act as our service providers and are contractually prohibited from using the information for their own purposes or for cross-context behavioral advertising. We do not use advertising cookies or third-party trackers for cross-context behavioral advertising. You can control cookies through your browser settings; disabling essential cookies may affect how the site functions.
10. Children's privacy
The Services are intended for businesses and are not directed to children. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, please contact us and we will take appropriate steps to delete it.
11. Third-party links
Our website and the Services may link to third-party websites or resources that we do not control. This Policy does not apply to those third parties, and we are not responsible for their privacy practices. Please review their privacy notices.
12. Where information is handled
We are based in the United States and handle personal information in the United States. If you access the Services from outside the United States, you understand that your information will be handled in the United States.
13. Changes to this Policy
We may update this Policy from time to time. When we do, we will revise the "Last updated" date above and, where required by law, provide additional notice. Your continued use of the Services after an update takes effect constitutes acceptance of the updated Policy to the extent permitted by law.
14. Contact us
If you have questions about this Policy or our privacy practices, or wish to exercise a privacy right, contact us at privacy@mepsuite.com. Legal notices may be sent to legal@mepsuite.com and to the address above.