Root To Fruit Privacy Policy

Effective Date: April 1st, 2023 

This privacy policy (“Policy”) explains how all information, including information about you, is collected, used, and disclosed by Root To Fruit, LLC., a Pennsylvania limited liability company, and its subsidiaries (collectively, “Root To Fruit,” “we,” “us,” and “our”). We own and operate our website roottofruit0@wixsite.com/website (the “Site”) to provide ready-to-eat meal delivery services and subscriptions for you (the “Services”). This Policy covers your use of the Site and Services, as well as all other interactions (e.g., customer service inquiries) you may have with us. By accessing the Site or using the Services, you agree to our collection, use, and disclosure of your information as outlined in this Policy.1. Information We Collect When you access our Site or use the Services, we collect and store certain information about you, including Personal Information (defined below), your IP address, and standard log information, such as your browser type and the pages you accessed on our Site. If you do not agree to our collection of this information, you may not be able to use our Site or Services. Personal Information is information that, alone or in combination with other information in our possession, could be used to personally identify you. We collect the following categories of Personal Information and other information as described below:

a. Information You Provide Information You Provide Directly. We may collect or receive the following categories of Personal Information when you access the Site, request to receive information about us or our Services, create an account, verify your identity, use any of the Services, or otherwise communicate with us, including through customer support channels. • Account Information, such as: o Name, email address, birthdate, and password o Other relevant contact, delivery, and identity verification information • Transaction Information, such as: o Order date, amount, quantity, delivery date, recipient o Payment history and subscription information o Promotion or discount codes used Other Information You Voluntarily Choose to Provide. We may collect your user content (“User Content”), including content that you upload or otherwise share or integrate with the Services. We may also collect information, including Personal Information, that you voluntarily provide to us when you: • participate in surveys, referrals, or promotions; • sign up for our newsletter; • register for, attend, or participate in webinars or events; • provide us feedback or comment on our blog or social media pages; • submit information to us so that we can assess potential business opportunities; • apply for a job position with us. b. Information We Automatically Collect We automatically collect certain information when you access the Site or use the Services. • Electronic & Online Identifiers (IDs), such as: o If on a mobile device: mobile carrier, device IDs o If using a browser: operating system, browser type o Internet Protocol (IP) address • Internet Activity Information, such as: o Your “log-in” and “log-out” information; o The pages that you visit before, after, and while using our Services; o Pages you visit, links you click, and the content you view on the Site; o Other log file information, which may include your web request, number of clicks and how you interact with links on the Service, domain names, landing pages, pages viewed, and other such information. We may collect information using tracking technologies, such as: • Cookies, which are small text files that websites send to your computer or mobile device. This includes session cookies (which are deleted once you close your browser) and persistent cookies (which remain on your computer or device until you delete them or they expire). • Pixel tags (also known as web beacons), which are pieces of code embedded in our Site that collect information about engagement on our Site or emails. To make it easier, we collectively call cookies and pixel tags/web beacons “Cookies.” Read more about your choices when it comes to Cookies in Part 6 of this Policy. We use the third-party analytics tools, including: Google Analytics, Facebook, NextDoor, TikTok, Pinterest, LinkedIn, HubSpot, and Hyros. For more information, visit each analytics provider’s privacy policy to understand how they use and share your information. Additionally, we may use Cookies for the following purposes: • when it is operationally necessary for us to provide you access to our Site or Services. This also includes tracking behavior in order to protect against irregular, fraudulent, or possibly illegal behavior on our Site or Services • to assess the performance of how you and others use our Site and Services (for more information, read the Analytics section below) • to enhance the functionality of our Site or Services. This includes identifying you when you sign into our Services and keeping track of your preferences, interests, or past items viewed Our Services may contain social media buttons, such as Facebook, LinkedIn, Twitter, and Instagram (that might include widgets such as the “share this” button or other interactive mini programs). These features may collect your IP address, which page you are visiting on our Site, and may set a Cookie to enable the feature to function properly. Your interactions with these platforms are governed by the privacy policy of the company providing the platform. c. Information from Third Parties We may collect and receive information about you, including Personal Information, from third parties, such as your name, contact information, and other information from various sources, such as our service providers, for the purposes described in this Policy. In addition, we may receive demographic and business industry information about you from third parties to help us better understand our users and to improve and market the Services.

2. How We Use Your Information A. Purposes. We use information that we collect about you for the following purposes: • To develop and provide you with the Site and Services, including to: o operate the Site, manage accounts, and provide the Services o determine your eligibility for our Services and discounts o improve, personalize, and enable your use of the Site and Services o develop new products and features • To protect Root To Fruit, our users, and the public, and comply with applicable law, regulation, or legal process, including to: o validate user information for fraud and risk detection purposes o resolve disputes and protect the rights of users and third parties o respond to claims and legal process (such as subpoenas and court orders) o monitor and enforce compliance with any applicable terms o prevent or stop any activity that may be illegal, unethical, or legally actionable • To operate our business, including to: o process payment transactions (see more details below) o schedule and deliver your orders (see more details below) o manage and enforce contracts with you or with third parties o resolve disputes, collect fees, and troubleshoot problems o prevent potentially fraudulent, prohibited, or illegal activities, and enforce our Terms o manage our corporate governance, compliance, and auditing practices o make employment decisions if you submit an application for employment with us o generate anonymized or aggregated data • To communicate with you as part of your use of the Services, including to: o respond to requests or questions you submit to our support staff o send you surveys and get your feedback about the Services o otherwise contact you with Services-related notices • To market to you, including to: o determine your eligibility for certain programs, events, and offers o inform you of our or our partners’ products, services, features, or promotions o provide you with newsletters, articles, reports, and announcements • To infer or generate information about you. • For any other purpose for which you expressly authorize us to use your information.

B. Payment Processing. We use Stripe or other similar payment processing services (“Payment Services”) as a third-party service provider to collect and process payment information with and from you and applicable financial institutions or payment methods. By paying through the Payment Services, you acknowledge and agree that such payment information will be treated in accordance with such Payment Services’ terms and policies. We do not have access to your payment information, but will have access to general transaction information associated with your transaction.

C. Routing and Deliveries. We use OptimoRoute or other similar delivery scheduling and route optimization services (“Logistics Services”) as a third-party service provider to coordinate delivery logistics and ensure your orders are delivered properly by accessing the delivery address associated with your order number and recipient name. Root To Fruituses its own vehicles and employee drivers to complete the deliveries to your designated recipient address, and you acknowledge and agree that such logistics information will be treated in accordance with such Logistics Services’ terms and policies.

3. How We Share Your Information We will only share your information with the categories of third parties listed below for the purposes described in Part 2 of this Policy, unless otherwise noted at the point of collection. • Service Providers that limit how they use your information and promise to keep your information confidential. Examples include companies or organizations that provide services such as website hosting, payment processing, logistics optimization, and customer management and support; • Affiliates for the purpose of operating, improving, and providing the promotion of our Services; • Other parties under the circumstances described below: o for legal reasons, including: § with companies that verify your identity for us and detect fraud; § with legal and financial advisors, auditors, examiners, and certain (including potential) investors § with companies that may acquire us, if we are involved in a merger, acquisition, or sale of assets o to comply with applicable law, regulation, or legal process, including to: § comply with law enforcement or national security requests § comply with legal process, such as a court order or subpoena (including in a country other than your home country) § protect your, our, or othersʼ rights, property, or safety § enforce our policies or contracts and collect amounts owed to us § assist with an investigation or prosecution of suspected or actual illegal activity o to further public policy goals, including: § publishing reports that incorporate aggregated, non-personally identifiable information about customer attributes, transactions, and behavior § sharing data containing aggregated and/or non-personally identifiable customer information with nonprofit or non-partisan organizations, academic institutions, think tanks, trade associations, consultancies, or similar organizations, only if they have signed an agreement with us that restricts how they can store, access, share, and use the information o for any other purpose and to any other person with whom you expressly authorize us to share such information. 4. Your Privacy Choices & Rights If you have an account on the Site, you can review and update your Personal Information in the account settings at any time by logging in to your account through the Site. a. Notice to Non-U.S. Users We are a U.S.-based company and only intend to provide our Services to Customers in the U.S. However, you may have additional rights based on your home country or location. Root To Fruit is committed to complying with all laws and regulations that may apply to our collection, use, and disclosure of Personal Information. For example, data located in the EU may be subject to the General Data Protection Regulation (“GDPR”), which allows for eligible data subjects to withdraw their consent to the collection and processing of Personal Information, as well as to exercise the following rights: • Right to be Informed. • Right to Access. • Right to Rectify. • Right to Erasure. • Right to Restrict Processing. • Right to Data Portability. • Right to Object. • Rights related to Automated Individual Decision-Making and Profiling. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your Personal Information conducted in reliance on lawful processing grounds other than consent. If you believe you are entitled to certain rights based on your home country or location, please contact us by email at roottofruit0@gmail.com. You may also have the right to submit a complaint to a data protection authority about our collection and use of your Personal Information. For more information, please contact your local data protection authority. Our legal basis for collecting and using the Personal Information described above will depend on the Personal Information concerned and the specific context in which we collect it. However, we will normally collect or process Personal Information from you only where we have your consent to do so, where we need the Personal Information to perform a contract with you, or where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms. In some cases, we may also have a legal obligation to collect Personal Information from you or may otherwise need the Personal Information to protect your vital interests or those of another person. b. Notice to California Consumers California law permits users who are California residents to request and obtain from us once a year, free of charge, a list of the third parties to whom we have disclosed their Personal Information’ (if any, and as defined under applicable California law) for such third parties’ direct marketing purposes in the prior calendar year, as well as the type of Personal Information disclosed to those parties. If you are a California resident and would like to request this information, please submit your request to roottofruit0@gmai.com This Supplemental California Privacy Notice only applies to our processing of Personal Information that is subject to the California Consumer Privacy Act of 2018 (“CCPA”). The CCPA specifies that natural persons who are California residents have the right to know what categories of Personal Information Root To Fruit has collected about them and whether Root To Fruit has disclosed or sold that Personal Information for a business purpose (e.g., to a service provider) in the preceding twelve (12) months. For purposes of the CCPA, Root To Fruit does not “sell” any Personal Information, nor do we have actual knowledge of any “sale” of Personal Information of minors under 18 years of age. As of the Effective Date of this Policy, Root To Fruit does not qualify as a “business” for purposes of the CCPA. Categories of Personal Information we may collect about you: • Identifiers (ex: name, email address, mailing address, phone number, signature, birthdate); • Personal Information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)) (ex: Social Security number, passport number, driver’s license or state identification card number, financial information); • Commercial information (ex: sales engagement history); • Internet or other electronic network activity information (ex: IP address, unique personal identifier, web history); Categories of third parties with whom we may share that information: • Service Providers as described in Part 3 of this Policy; • Affiliates as described in Part 3 of this Policy. Right to Non-Discrimination for the Exercise of a Consumer’s Privacy Rights: You have the right not to receive discriminatory treatment from us for exercising the privacy rights granted by the CCPA. c. Notice to Nevada Residents If you are a resident of Nevada, you have the right to opt out of the sale of certain Personal Information to third parties who intend to license or sell that Personal Information. Please note that we do not currently sell your Personal Information as sales are defined in Nevada Revised Statutes Chapter 603A. If you have any questions, please contact us as set forth below. d. Verifiable Consumer Requests Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your Personal Information. You may also make a verifiable consumer request on behalf of your minor child. In order to verify your request, we will ask you to provide your name, email address, and certain other pieces of identifying information. Once you or your authorized agent has submitted the requested information and any necessary supporting documentation, we will confirm the information by reviewing it against our records. The only purpose for which we will use such submitted information is to verify your identity and once the submitted information has been used for that purpose, it will be deleted from our records in accordance with this Policy. To designate an authorized agent, please contact us as set forth below. 5. How We Protect & Store Your Information We store and process your Personal Information using third-party servers located in data centers in the United States. We employ administrative, physical, and technical safeguards, including data encryption, which are designed to protect your information from unauthorized access and to comply with applicable privacy laws where we operate. Your Personal Information will be kept on our servers or on those of our service providers and only those employees that require it for the purposes of their duties will have access to your Personal Information. No security measures are perfect or impenetrable and no method of data transmission can be guaranteed to prevent any unauthorized interception, access, disclosure, alteration, destruction, or other type of misuse. We also depend on you to protect your information. Therefore, we urge you to take adequate precautions to protect your personal data as well, including never sharing your account password or other sensitive or confidential information with anyone. If you become aware of any breach of security or privacy, please notify us immediately. To the fullest extent permitted by applicable law, we do not accept liability for unauthorized disclosure. If Root To Fruitlearns of a systems security breach, we may attempt to notify you electronically so that you can take appropriate protective steps. By using the Site and Services, you agree that we may communicate with you electronically. We may post a notice on the Site or through the Services if a security breach occurs. We may also send an email to you at the email address you have provided to us. Depending on where you live, you may have a legal right to receive notice of a security breach in writing. To receive free written notice of a security breach (or to withdraw your consent from receiving electronic notice of a security breach), please contact us. a. International Data Transfers All information processed by Root To Fruitor our service providers may be transferred, processed, or stored anywhere in the world, including in countries that may have data protection laws that are different from the laws where you live. Your information may be accessible to the courts, law enforcement, and national security authorities of the United States. We endeavor to safeguard your information consistent with the requirements of applicable laws. To obtain more information about our policies and practices with respect to service providers outside your country, please contact us as set forth below. b. Data Retention We retain Personal and Order Information we collect from you where we have an ongoing legitimate business need to do so (for example, to provide you with a service you have requested or to comply with applicable legal, tax, or accounting requirements).Upon request, we will either delete or anonymize it or, if this is not possible (for example, because your Personal Information has been stored in backup archives), we will securely store your Personal Information and isolate it from any further processing until deletion is possible. c. Links to Third-Party Sites The Services may contain links to (or allow you to link to) other third-party services or websites. Root To Fruit does not control the information collection of third-party services or websites that can be reached through such links. This Policy only covers the privacy practices of Root To Fruit. It does not apply to the practices of third-party websites, services, or applications, even those who we have partnered or integrated with. We encourage you to be aware when you are linking to a third-party service or website and to read the privacy statements of any third-party service or website that collects personally identifiable information. Third-party services handle your information in accordance with their own practices and privacy policies. We are not responsible for their policies, practices, or handling of your information. 6. Cookies & Do-Not-Track Signals When you visit or use our Site, Services, or visit a third-party website for which we provide online services, we and certain business partners and vendors may use Cookies. We use Cookies to recognize you as a customer; customize the Services and other content; measure the effectiveness of promotions; perform a wide range of analytics; mitigate risk and prevent potential fraud; and to promote trust and safety across our Services. Certain Services are only available through the use of Cookies, so if you choose to disable or decline Cookies, your use of certain Services may be limited or not possible. Do-Not-Track ("DNT") is an optional browser setting that allows you to express your preferences regarding tracking by advertisers and other third parties. We do not respond to DNT signals. 7. Information About Children The Services are not directed to users under the age of 18 at this time. If we obtain actual knowledge that we have collected Personal Information from a user under the age of 18, we will promptly delete it, unless we are legally obligated to retain such data. Contact us if you believe that we have mistakenly or unintentionally collected information from a user under the age of 18. 8. Changes to this Policy Root To Fruit is always improving, and we may occasionally modify or update this Policy accordingly. Any information that we collect is subject to the policy in effect at the time such information is collected. We may, however, modify and revise this Policy from time to time. If we make any material changes to this Policy, we may use the email address or other Personal Information you’ve provided to us to notify you of such changes, post a notification on the Site, or provide a notification through the Services, and we will indicate when such changes will become effective in any such notice. It is your responsibility to periodically monitor and review this Policy and any changes we make. By continuing to access or use the Site or the Services after those changes become effective, you agree to be bound by the revised policy. 9. Contact Information If you have questions or concerns regarding this Policy, or any feedback pertaining to your privacy and the Services that you would like us to consider, please email us at roottofruit0@gmail.com or reach out to us at: Root To Fruit, LLC. 3200 Capri Drive, Philadelphia, pa 19454.