Privacy Policy

Effective October 6, 2026 · Last updated October 6, 2026

Ability Culinary, LLC (“ABLTY,” “we,” “us,” or “our”) operates the website ablty.com and related services. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, place an order, or otherwise interact with our services.

1. Information We Collect

Personal Information You Provide

When you create an account, place an order, or contact us, we may collect:

• Name
• Email address
• Phone number
• Delivery address
• Payment information (processed securely via Stripe — we do not store card numbers)
• Order history and preferences
• Dietary restrictions or preferences you provide
• Team or organization affiliation
• Newsletter subscriptions — your email address and which page you subscribed from
• Messages you send to our on-site chat, where we have that chat turned on

Information Collected Automatically

When you visit our website, we may automatically collect:

• Device and browser information
• IP address
• Pages visited and interactions with our site
• Referring URL
• Campaign parameters (utm_source, utm_medium, and similar) from the link you arrived on, plus the page you landed on
• The ad-click identifier in the link, when you arrive from a Meta or Google ad
• Error and performance data

2. How We Use Your Information

We use the information we collect to:

• Process and fulfill your orders
• Calculate sales tax on shop orders
• Manage your account and team access
• Send transactional emails (order confirmations, status updates, account notifications)
• Send marketing email — our newsletter, and automated sequences that start when you place a shop order, when it is time to reorder, and when you begin a checkout without completing payment. Every one of them carries a one-click unsubscribe link
• Communicate with you about your orders or inquiries
• Attribute an enquiry or an order to the campaign that brought you here
• Measure which of our Meta and Google ads lead to orders, and help those platforms show our ads to people likely to order, as described in section 3, unless you opt out
• Improve our website, products, and services
• Monitor and analyze usage trends and performance
• Detect and prevent fraud or errors
• Comply with legal obligations

3. Third-Party Services

We use trusted third-party service providers to operate our platform. These providers only have access to your information as necessary to perform their functions:

• Stripe — Payment processing and sales-tax calculation. Stripe handles all payment card data in compliance with PCI-DSS standards. To calculate the sales tax on a shop order we send Stripe Tax your state and ZIP code — never your street address. See Stripe's Privacy Policy.
• EasyPost — Shipping. At checkout we send the delivery address you entered to EasyPost to check that it is deliverable and to suggest corrections, which you accept or override — nothing is rewritten for you. When your order ships we send EasyPost your name, delivery address, email address, and your phone number if you gave us one, so it can buy the shipping label, and EasyPost sends us tracking updates for that shipment until it is delivered.
• Shipping carriers — The carrier that moves your box, named on your tracking link, receives the delivery details printed on the label — your name, delivery address, email address, and the contact phone number on the shipment — and uses them to deliver the order and to send its own delivery notifications.
• Supabase — Authentication, database, and file storage. Your account credentials and order data are stored with row-level security controls.
• Resend — Email delivery, both transactional (order confirmations, status updates, account notices) and marketing. Subscribing to our newsletter adds your address to a Resend audience. Placing a shop order or beginning a checkout without completing payment does not add you to that audience: it starts an automated sequence that emails your address directly — a welcome series after an order, a reminder when it is time to reorder, and a reminder when a checkout was left unfinished. Every marketing email carries a one-click unsubscribe link and an unsubscribe header your mail app can act on; using either stops further sends from that sequence, and unsubscribing from the newsletter also removes you from the audience.
• PostHog — Product analytics and error tracking. PostHog records the pages you view, your clicks and other interactions with page elements, clicks that produce no result, page-performance measurements, and reports of errors your browser hits. It keeps a persistent identifier for your device in your browser. When you place a shop order we attach your email address to that identifier, so the order and the visit that led to it are linked and are no longer anonymous. Session replay is switched off for visitors — it runs only for signed-in ABLTY staff on our internal admin pages, and every text input is masked in those recordings.
• Sentry — Error monitoring. When something breaks, Sentry receives the error and its stack trace, the page URL, your browser and device type, and a short trail of the actions that led to it.
• Vercel — Website hosting and deployment, plus page-performance measurement. Vercel Speed Insights runs on every page and reports load and interaction timings, the path you were on, and your general device and connection type.
• Inngest — Background job processing for order notifications, invoice processing, and the scheduled email sequences described above.
• Cal.com — Consultation booking. Used to schedule calls from our Contact, Corporate, and office lunch pages. The booking form is hosted by Cal.com and may set its own cookies.
• Google (Gemini API) and Cloudflare Turnstile — On-site chat. Our chat assistant is not switched on today. Where we turn it on, the messages you type are sent to Google's Gemini API to generate a reply and are stored with the conversation, and Turnstile checks your browser — including your IP address — to block automated abuse.
• Google Maps Platform — Address autocomplete in order and delivery forms. The Maps script loads only where that autocomplete is enabled.

Advertising: Meta and Google

We run ads on Meta (Facebook and Instagram) and Google and measure which ads lead to orders. Unlike the service providers above, Meta and Google also use what they receive for their own purposes, under their own privacy policies — see Meta's Privacy Policy ↗ (opens in a new tab) and Google's Privacy Policy ↗ (opens in a new tab). Unless you have opted out on our Your Privacy Choices page, or your browser sends a Global Privacy Control signal, they receive:

• Page visits. The Meta Pixel records visits to our home page, the main shop page, the cart, checkout and the Training Table page, and tells Meta when you start a checkout and what your cart is worth. It runs only on those pages — never on a product or category page or the order confirmation page — so Meta does not learn which products you looked at.
• Purchases. When you complete a shop order, Meta and Google receive the order number, the order total not counting sales tax, and the ad-click identifier from the ad you arrived on, if you came from one. To match the order to their own users, they also receive your email address and phone number in hashed form: scrambled by a one-way function (SHA-256) before they leave us, so a platform can recognize them only if it already has them. Meta also receives your ZIP code, state and country, hashed the same way, plus your browser and device details (the user-agent string) and the Meta cookie identifiers listed in section 8.
• How purchases reach them. Meta gets the purchase from our server. Google gets it from a tag that loads only on the order confirmation page and, where we have turned it on, from our server as well.
• What the tags see. Because the Meta Pixel and the Google tag run in your browser, Meta and Google also receive your IP address and browser details from them, and they set the advertising cookies listed in section 8.

Meta and Google never receive the names of the products you buy.

Health data. We do not share consumer health data — allergens, dietary notes, or goals — with advertising platforms. That holds whether or not you opt out of ad sharing. Our Consumer Health Data Privacy Policy sets out what we collect, who receives it, and how to have it deleted.

4. Sale and Sharing of Your Data

We do not sell your personal information for money, and we do not rent or trade it to anyone for their own marketing. We do send Meta and Google the information described in section 3 to measure and improve our ads. Some state privacy laws treat that as “sharing” personal information for cross-context behavioral advertising, or as “targeted advertising” or a “sale,” even though no money changes hands. You can opt out of it on our Your Privacy Choices page, and we treat a Global Privacy Control signal from your browser as that opt-out automatically. Otherwise, we share your information only with the service providers listed in section 3, as necessary to operate our business, or as required by law.

5. Data Security

We implement appropriate technical and organizational security measures to protect your personal information, including encrypted connections (HTTPS), secure authentication, row-level database security, and PCI-compliant payment processing through Stripe. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you services, comply with legal obligations, resolve disputes, and enforce our agreements. Order history is retained for accounting and operational purposes.

Campaign attribution is held in your browser for 90 days. Newsletter records are kept until you unsubscribe, and then kept as a suppression record so we do not email that address again. Chat conversations, where chat is switched on, are retained with the enquiry they belong to.

When an order is stored with advertising identifiers — the ad-click identifier, the Meta cookie identifiers and the browser and device details described in section 3 — we delete those identifiers 400 days after the order. The order itself, and the campaign it came from, stay with your order history.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your personal information
• Stop receiving marketing email
• Opt out of analytics tracking
• Opt out of the sale or sharing of your personal information, and of targeted advertising
• Receive a copy of your data in a portable format

To opt out of ad sharing, use our Your Privacy Choices page, linked in our site footer. The choice is saved in that browser. If your browser sends a Global Privacy Control signal, we honor it automatically as the same opt-out, both in your browser and on our server, with nothing for you to do. Opting out stops the Meta Pixel and the Google tag and stops our server from reporting the orders you place from that browser.

Marketing email carries an unsubscribe link in every message — one click ends it. For analytics, you can block analytics cookies and scripts in your browser, and you can email us to have the analytics records tied to your email address deleted. To exercise any of these rights, contact us at support@ablty.com.

8. Cookies and Local Storage

Our website uses cookies and browser storage in five categories. You can control cookies through your browser; clearing site data removes everything listed below. Disabling cookies may affect certain features of our website.

• Strictly necessary — Your sign-in session (for account holders) and your shop cart. The cart holds product identifiers and quantities only; prices are re-read from our servers on every visit and are never stored in your browser.
• Analytics — The PostHog identifier described in section 3, which lets us count a return visit as the same visitor rather than a new one.
• Marketing attribution — A first-touch cookie that records the campaign parameters and landing page of your first visit, kept for 90 days and sent with any form you submit. First touch wins: it is written once and never overwritten.
• Advertising — Set only while ad sharing is on, to connect your visits and the ads you click to Meta and Google (section 3); opting out deletes all of them.
• Ad-sharing preferences — Remember your ad-sharing choice and carry a Global Privacy Control signal to our server.

Clearing your cookies clears your opt-out too, so opt out again afterward — or use a browser that sends Global Privacy Control, which we honor on every visit.

9. Children's Privacy

Our services are not directed to individuals under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will take steps to delete that information.

10. California Residents

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know — You may request that we disclose the categories and specific pieces of personal information we have collected about you, the sources of that information, the business purpose for collecting it, and the categories of third parties with whom we share it.
• Right to Delete — You may request that we delete personal information we have collected from you, subject to certain exceptions.
• Right to Opt Out of Sale and Sharing — You may opt out of the sale or sharing of your personal information, including for targeted (cross-context behavioral) advertising, on our Your Privacy Choices page. We honor a Global Privacy Control signal as a valid opt-out, in your browser and on our server.
• Right to Non-Discrimination — We will not discriminate against you for exercising any of your CCPA rights.

To submit a CCPA request, contact us at support@ablty.com. We will verify your identity before processing your request and respond within 45 days.

11. International Visitors

If you are visiting from the European Union or other regions with data protection laws, you may have additional rights under the General Data Protection Regulation (GDPR) or similar legislation, including:

• The right to access your personal data
• The right to rectification of inaccurate data
• The right to erasure (“right to be forgotten”)
• The right to data portability
• The right to restrict or object to processing
• The right to withdraw consent at any time

Our legal basis for processing your data includes contract performance (fulfilling your orders), legitimate interests (improving our services), and consent (where applicable). To exercise your rights, contact us at support@ablty.com.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the “Last updated” date. Your continued use of our services after any changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, contact us at:

Ability Culinary, LLC
Washington, DC
support@ablty.com