ABLTY HQ · 1150 Connecticut Ave NW, Suite 108 — Dupont Circle, Washington, DC
Legal
Privacy Policy
How Ability Culinary, LLC collects, uses, and protects your information.
Effective August 23, 2026 · Last updated August 28, 2026
Ability Culinary, LLC (“ABLTY,” “we,” “us,” or “our”) operates the website ablty.com and related services. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, place an order, or otherwise interact with our services.
1. Information We Collect
Personal Information You Provide
When you create an account, place an order, or contact us, we may collect:
Name
Email address
Phone number
Delivery address
Payment information (processed securely via Stripe — we do not store card numbers)
Order history and preferences
Dietary restrictions or preferences you provide
Team or organization affiliation
Newsletter subscriptions — your email address and which page you subscribed from
Messages you send to our on-site chat, where we have that chat turned on
Information Collected Automatically
When you visit our website, we may automatically collect:
Device and browser information
IP address
Pages visited and interactions with our site
Referring URL
Campaign parameters (utm_source, utm_medium, and similar) from the link you arrived on, plus the page you landed on
Error and performance data
2. How We Use Your Information
We use the information we collect to:
Process and fulfill your orders
Calculate sales tax on shop orders
Manage your account and team access
Send transactional emails (order confirmations, status updates, account notifications)
Send marketing email you asked for — our newsletter and related email sequences
Communicate with you about your orders or inquiries
Attribute an enquiry or an order to the campaign that brought you here
Improve our website, products, and services
Monitor and analyze usage trends and performance
Detect and prevent fraud or errors
Comply with legal obligations
3. Third-Party Services
We use trusted third-party service providers to operate our platform. These providers only have access to your information as necessary to perform their functions:
Stripe — Payment processing and sales-tax calculation. Stripe handles all payment card data in compliance with PCI-DSS standards. To calculate the sales tax on a shop order we send Stripe Tax your state and ZIP code — never your street address. See Stripe's Privacy Policy.
Supabase — Authentication, database, and file storage. Your account credentials and order data are stored with row-level security controls.
Resend — Email delivery, both transactional (order confirmations, status updates, account notices) and marketing. When you subscribe to our newsletter your address is added to a Resend audience and may receive automated email sequences. Every marketing email carries a one-click unsubscribe link; using it removes you from that audience and ends the sequences.
PostHog — Product analytics and error tracking. PostHog records the pages you view, your clicks and other interactions with page elements, clicks that produce no result, page-performance measurements, and reports of errors your browser hits. It keeps a persistent identifier for your device in your browser. When you place a shop order we attach your email address to that identifier, so the order and the visit that led to it are linked and are no longer anonymous. Session replay is switched off for visitors — it runs only for signed-in ABLTY staff on our internal admin pages, and every text input is masked in those recordings.
Sentry — Error monitoring. When something breaks, Sentry receives the error and its stack trace, the page URL, your browser and device type, and a short trail of the actions that led to it.
Vercel — Website hosting and deployment.
Inngest — Background job processing for order notifications, invoice processing, and the scheduled email sequences described above.
Cal.com — Consultation booking. Used to schedule calls from our Contact, Corporate, and office lunch pages. The booking form is hosted by Cal.com and may set its own cookies.
Google (Gemini API) and Cloudflare Turnstile — On-site chat. Our chat assistant is not switched on today. Where we turn it on, the messages you type are sent to Google's Gemini API to generate a reply and are stored with the conversation, and Turnstile checks your browser — including your IP address — to block automated abuse.
Google Maps Platform — Address autocomplete in order and delivery forms. The Maps script loads only where that autocomplete is enabled.
4. We Do Not Sell Your Data
We do not sell, rent, or trade your personal information to third parties for their marketing purposes. We only share your data with the service providers listed above, as necessary to operate our business, or as required by law.
5. Data Security
We implement appropriate technical and organizational security measures to protect your personal information, including encrypted connections (HTTPS), secure authentication, row-level database security, and PCI-compliant payment processing through Stripe. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
6. Data Retention
We retain your personal information for as long as your account is active or as needed to provide you services, comply with legal obligations, resolve disputes, and enforce our agreements. Order history is retained for accounting and operational purposes.
Campaign attribution is held in your browser for 90 days. Newsletter records are kept until you unsubscribe, and then kept as a suppression record so we do not email that address again. Chat conversations, where chat is switched on, are retained with the enquiry they belong to.
7. Your Rights
Depending on your jurisdiction, you may have the right to:
Access the personal information we hold about you
Request correction of inaccurate information
Request deletion of your personal information
Stop receiving marketing email
Opt out of analytics tracking
Receive a copy of your data in a portable format
Marketing email carries an unsubscribe link in every message — one click ends it. For analytics, you can block analytics cookies and scripts in your browser, and you can email us to have the analytics records tied to your email address deleted. To exercise any of these rights, contact us at hello@ablty.com.
8. Cookies and Local Storage
Our website uses cookies and browser storage in three categories. You can control cookies through your browser; clearing site data removes everything listed below. Disabling cookies may affect certain features of our website.
Strictly necessary — Your sign-in session (for account holders) and your shop cart. The cart holds product identifiers and quantities only; prices are re-read from our servers on every visit and are never stored in your browser.
Analytics — The PostHog identifier described in section 3, which lets us count a return visit as the same visitor rather than a new one.
Marketing attribution — A first-touch cookie that records the campaign parameters and landing page of your first visit, kept for 90 days and sent with any form you submit. First touch wins: it is written once and never overwritten.
9. Children's Privacy
Our services are not directed to individuals under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will take steps to delete that information.
10. California Residents
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):
Right to Know — You may request that we disclose the categories and specific pieces of personal information we have collected about you, the sources of that information, the business purpose for collecting it, and the categories of third parties with whom we share it.
Right to Delete — You may request that we delete personal information we have collected from you, subject to certain exceptions.
Right to Opt-Out of Sale — ABLTY does not sell your personal information to third parties. Because we do not sell personal information, there is no need to opt out.
Right to Non-Discrimination — We will not discriminate against you for exercising any of your CCPA rights.
To submit a CCPA request, contact us at hello@ablty.com. We will verify your identity before processing your request and respond within 45 days.
11. International Visitors
If you are visiting from the European Union or other regions with data protection laws, you may have additional rights under the General Data Protection Regulation (GDPR) or similar legislation, including:
The right to access your personal data
The right to rectification of inaccurate data
The right to erasure (“right to be forgotten”)
The right to data portability
The right to restrict or object to processing
The right to withdraw consent at any time
Our legal basis for processing your data includes contract performance (fulfilling your orders), legitimate interests (improving our services), and consent (where applicable). To exercise your rights, contact us at hello@ablty.com.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the “Last updated” date. Your continued use of our services after any changes constitutes acceptance of the updated policy.
13. Contact Us
If you have questions or concerns about this Privacy Policy or our data practices, contact us at:
