Privacy Policy

Effective October 2, 2026 · Last updated October 2, 2026

Ability Culinary, LLC (“ABLTY,” “we,” “us,” or “our”) operates the website ablty.com and related services. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, place an order, or otherwise interact with our services.

1. Information We Collect

Personal Information You Provide

When you create an account, place an order, or contact us, we may collect:

Name
Email address
Phone number
Delivery address
Payment information (processed securely via Stripe — we do not store card numbers)
Order history and preferences
Dietary restrictions or preferences you provide
Team or organization affiliation
Newsletter subscriptions — your email address and which page you subscribed from
Messages you send to our on-site chat, where we have that chat turned on

Information Collected Automatically

When you visit our website, we may automatically collect:

Device and browser information
IP address
Pages visited and interactions with our site
Referring URL
Campaign parameters (utm_source, utm_medium, and similar) from the link you arrived on, plus the page you landed on
Error and performance data

2. How We Use Your Information

We use the information we collect to:

Process and fulfill your orders
Calculate sales tax on shop orders
Manage your account and team access
Send transactional emails (order confirmations, status updates, account notifications)
Send marketing email — our newsletter, and automated sequences that start when you place a shop order, when it is time to reorder, and when you begin a checkout without completing payment. Every one of them carries a one-click unsubscribe link
Communicate with you about your orders or inquiries
Attribute an enquiry or an order to the campaign that brought you here
Improve our website, products, and services
Monitor and analyze usage trends and performance
Detect and prevent fraud or errors
Comply with legal obligations

3. Third-Party Services

We use trusted third-party service providers to operate our platform. These providers only have access to your information as necessary to perform their functions:

Stripe — Payment processing and sales-tax calculation. Stripe handles all payment card data in compliance with PCI-DSS standards. To calculate the sales tax on a shop order we send Stripe Tax your state and ZIP code — never your street address. See Stripe's Privacy Policy.
EasyPost — Shipping. At checkout we send the delivery address you entered to EasyPost to check that it is deliverable and to suggest corrections, which you accept or override — nothing is rewritten for you. When your order ships we send EasyPost your name, delivery address, email address, and your phone number if you gave us one, so it can buy the shipping label, and EasyPost sends us tracking updates for that shipment until it is delivered.
Shipping carriers — The carrier that moves your box, named on your tracking link, receives the delivery details printed on the label — your name, delivery address, email address, and the contact phone number on the shipment — and uses them to deliver the order and to send its own delivery notifications.
Supabase — Authentication, database, and file storage. Your account credentials and order data are stored with row-level security controls.
Resend — Email delivery, both transactional (order confirmations, status updates, account notices) and marketing. Subscribing to our newsletter adds your address to a Resend audience. Placing a shop order or beginning a checkout without completing payment does not add you to that audience: it starts an automated sequence that emails your address directly — a welcome series after an order, a reminder when it is time to reorder, and a reminder when a checkout was left unfinished. Every marketing email carries a one-click unsubscribe link and an unsubscribe header your mail app can act on; using either stops further sends from that sequence, and unsubscribing from the newsletter also removes you from the audience.
PostHog — Product analytics and error tracking. PostHog records the pages you view, your clicks and other interactions with page elements, clicks that produce no result, page-performance measurements, and reports of errors your browser hits. It keeps a persistent identifier for your device in your browser. When you place a shop order we attach your email address to that identifier, so the order and the visit that led to it are linked and are no longer anonymous. Session replay is switched off for visitors — it runs only for signed-in ABLTY staff on our internal admin pages, and every text input is masked in those recordings.
Sentry — Error monitoring. When something breaks, Sentry receives the error and its stack trace, the page URL, your browser and device type, and a short trail of the actions that led to it.
Vercel — Website hosting and deployment, plus page-performance measurement. Vercel Speed Insights runs on every page and reports load and interaction timings, the path you were on, and your general device and connection type.
Inngest — Background job processing for order notifications, invoice processing, and the scheduled email sequences described above.
Cal.com — Consultation booking. Used to schedule calls from our Contact, Corporate, and office lunch pages. The booking form is hosted by Cal.com and may set its own cookies.
Google (Gemini API) and Cloudflare Turnstile — On-site chat. Our chat assistant is not switched on today. Where we turn it on, the messages you type are sent to Google's Gemini API to generate a reply and are stored with the conversation, and Turnstile checks your browser — including your IP address — to block automated abuse.
Google Maps Platform — Address autocomplete in order and delivery forms. The Maps script loads only where that autocomplete is enabled.

4. We Do Not Sell Your Data

We do not sell, rent, or trade your personal information to third parties for their marketing purposes. We only share your data with the service providers listed above, as necessary to operate our business, or as required by law.

5. Data Security

We implement appropriate technical and organizational security measures to protect your personal information, including encrypted connections (HTTPS), secure authentication, row-level database security, and PCI-compliant payment processing through Stripe. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you services, comply with legal obligations, resolve disputes, and enforce our agreements. Order history is retained for accounting and operational purposes.

Campaign attribution is held in your browser for 90 days. Newsletter records are kept until you unsubscribe, and then kept as a suppression record so we do not email that address again. Chat conversations, where chat is switched on, are retained with the enquiry they belong to.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

Access the personal information we hold about you
Request correction of inaccurate information
Request deletion of your personal information
Stop receiving marketing email
Opt out of analytics tracking
Receive a copy of your data in a portable format

Marketing email carries an unsubscribe link in every message — one click ends it. For analytics, you can block analytics cookies and scripts in your browser, and you can email us to have the analytics records tied to your email address deleted. To exercise any of these rights, contact us at support@ablty.com.

8. Cookies and Local Storage

Our website uses cookies and browser storage in three categories. You can control cookies through your browser; clearing site data removes everything listed below. Disabling cookies may affect certain features of our website.

Strictly necessary — Your sign-in session (for account holders) and your shop cart. The cart holds product identifiers and quantities only; prices are re-read from our servers on every visit and are never stored in your browser.
Analytics — The PostHog identifier described in section 3, which lets us count a return visit as the same visitor rather than a new one.
Marketing attribution — A first-touch cookie that records the campaign parameters and landing page of your first visit, kept for 90 days and sent with any form you submit. First touch wins: it is written once and never overwritten.

9. Children's Privacy

Our services are not directed to individuals under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will take steps to delete that information.

10. California Residents

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

Right to Know — You may request that we disclose the categories and specific pieces of personal information we have collected about you, the sources of that information, the business purpose for collecting it, and the categories of third parties with whom we share it.
Right to Delete — You may request that we delete personal information we have collected from you, subject to certain exceptions.
Right to Opt-Out of Sale — ABLTY does not sell your personal information to third parties. Because we do not sell personal information, there is no need to opt out.
Right to Non-Discrimination — We will not discriminate against you for exercising any of your CCPA rights.

To submit a CCPA request, contact us at support@ablty.com. We will verify your identity before processing your request and respond within 45 days.

11. International Visitors

If you are visiting from the European Union or other regions with data protection laws, you may have additional rights under the General Data Protection Regulation (GDPR) or similar legislation, including:

The right to access your personal data
The right to rectification of inaccurate data
The right to erasure (“right to be forgotten”)
The right to data portability
The right to restrict or object to processing
The right to withdraw consent at any time

Our legal basis for processing your data includes contract performance (fulfilling your orders), legitimate interests (improving our services), and consent (where applicable). To exercise your rights, contact us at support@ablty.com.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the “Last updated” date. Your continued use of our services after any changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, contact us at:

Ability Culinary, LLC
Washington, DC
support@ablty.com