Privacy Notice

Angel & Manna Bakery ("we," "us," or "our") respects your privacy and is committed to protecting the personal information you share with us. This Privacy Notice explains what information we collect, how we use it, how we protect it, and your rights under applicable law.

As a Massachusetts-based business, we comply primarily with the Massachusetts Data Security Law (M.G.L. c. 93H) and the Massachusetts Standards for the Protection of Personal Information of Residents of the Commonwealth (201 CMR 17.00), which impose some of the strictest data security obligations of any U.S. state. We also extend relevant protections to customers in other states with applicable privacy laws, including the California Consumer Privacy Act (CCPA/CPRA) and the Virginia Consumer Data Protection Act (VCDPA).

This Notice applies to our website, mobile application, in-store interactions, loyalty programs, online ordering, and any other service we provide (collectively, the "Services").

Information You Provide Directly:

• Name, email address, phone number, and delivery address when placing orders or creating an account
• Payment information (processed securely through our payment processor — we do not store full card numbers)
• Loyalty program data including points, rewards activity, and tier status
• Gift card purchase and recipient details
• Special instructions, dietary preferences, and allergy notes you voluntarily share
• Communications you send us via contact forms, email, or phone

Information We Collect Automatically:

• IP address, browser type, device type, and operating system
• Pages visited, time on site, and navigation paths
• Cookies, pixel tags, and similar tracking technologies (see Cookie Preferences)
• General geolocation data (city/region level) for delivery availability

Information from Third Parties:

• Analytics providers (e.g., aggregated traffic and engagement data)
• Payment processors confirming successful transactions

• Process and fulfill your orders, including pickup and delivery
• Manage your loyalty account and rewards
• Send order confirmations, receipts, and delivery updates
• Respond to your questions, requests, and feedback
• Send promotional emails and newsletters (only with your consent, and you may opt out at any time)
• Improve our website, products, and services through analytics
• Comply with legal obligations and enforce our Terms of Use
• Detect and prevent fraud or unauthorized activity

We do not sell your personal information. We share your information only in the following circumstances:

• Service Providers: Payment processors, email delivery services, analytics platforms, and delivery partners who assist us in operating the Services — each bound by confidentiality obligations
• Legal Compliance: When required by law, court order, or to protect the rights and safety of Angel & Manna, our customers, or the public
• Business Transfers: In connection with a merger, acquisition, or sale of assets, subject to notice to you

We retain personal data only as long as necessary to fulfill the purposes described in this Notice, or as required by law. Order and transaction records are retained for a minimum of 7 years in accordance with Massachusetts tax record-keeping requirements under M.G.L. c. 62C. Loyalty program data is retained for the duration of your account and up to 2 years after closure. When personal data is no longer needed, we dispose of it securely in compliance with 201 CMR 17.00, including shredding physical records and securely wiping digital storage.

Massachusetts Residents: Massachusetts does not currently have a comprehensive consumer data privacy statute granting specific rights to access, delete, or port personal data (such as California's CCPA). However, under the Massachusetts Consumer Protection Act (M.G.L. c. 93A), you are protected from unfair or deceptive practices in connection with your personal information. As a matter of good practice, we honor the following requests from all customers regardless of state:

• Access a summary of the personal information we hold about you
• Correct inaccurate personal information in your account
• Request deletion of your account and associated personal data
• Opt out of marketing communications at any time

California Residents have additional rights under the CCPA/CPRA, including the right to know, delete, correct, and opt out of the sale or sharing of personal information.

Virginia, Colorado, Connecticut, and other state residents may have rights under their respective state privacy laws.

To exercise any of these rights, contact us at privacy@angelandmanna.com or by calling (617) 555-0120. We will respond within 45 days.

As required by 201 CMR 17.00, Angel & Manna Bakery maintains a comprehensive Written Information Security Program (WISP) governing the collection, storage, use, and disposal of personal information belonging to Massachusetts residents. Our WISP includes:

• Designation of an employee responsible for maintaining the security program
• Risk assessment and ongoing identification of internal and external threats
• Employee security awareness training
• Access controls and secure authentication for systems containing personal data
• TLS encryption for all personal data transmitted over public networks
• Encryption of personal data stored on portable devices or laptops
• Vendor/service provider oversight — we require all third parties with access to our data to maintain appropriate safeguards
• Incident response procedures and annual review of the WISP

Data Breach Notification: In the event of a security breach involving your personal information, we will notify you and the Massachusetts Attorney General's Office as required by M.G.L. c. 93H, Section 3. We aim to provide notice within 30 days of discovering a qualifying breach. Notification will include the nature of the breach, the information affected, and steps you can take to protect yourself.

Our Services are not directed to children under the age of 13. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us immediately.

We may update this Privacy Notice periodically. We will notify you of material changes by posting a notice on our website or sending an email to registered users. Your continued use of the Services after the effective date constitutes your acknowledgment of the updated Notice.

Angel & Manna Bakery
Privacy Office
1167 Providence Rd Unit 2, Whitinsville, MA 01588
Email: privacy@angelandmanna.com
Phone: (617) 555-0120