Privacy Policy

1. Introduction

Excalibur Interactive Solutions, LLC ("Excalibur Interactive," "we," "us," or "our") operates the Talos platform, available at ordertalos.com and through all Restaurant Partner Storefronts hosted on subdomains (e.g., restaurant.ordertalos.com) and custom domains (collectively, the "Service").

This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you use our Service. This policy applies to all users, including Restaurant Partners, Staff Members, and Customers.

By using the Service, you consent to the practices described in this Privacy Policy. If you do not agree with this policy, please do not use the Service. This Privacy Policy should be read in conjunction with our Terms of Service.

2. Information We Collect

2a. Information You Provide Directly

• Account registration data: Name, email address, phone number, and password
• Restaurant Partner data: Business name, business address, branding assets (logos, colors, fonts), menu content, and operational settings
• Customer data: Name, email address, phone number, and delivery addresses
• Payment information: Credit and debit card details, which are processed and stored exclusively by our PCI-compliant payment processors (Stripe and AMP Payment Systems) — Excalibur Interactive does not directly store full card numbers
• Order details: Items ordered, customizations, special instructions, order type (pickup or delivery), and scheduling preferences
• Communications: Support inquiries, contact form submissions, and correspondence with our team
• Staff data: Names, email addresses, roles, and permissions assigned by Restaurant Partners

2b. Information Collected Automatically

• Device and browser information (type, version, operating system)
• IP address and approximate geographic location
• Usage data (pages visited, features used, timestamps, interaction patterns)
• Cookies and similar technologies used for authentication and session management
• Progressive Web App (PWA) installation status
• Error and performance data collected for monitoring and reliability purposes
• Server logs and request data

2c. Information from Third Parties

• Payment transaction confirmations and dispute information from our payment processors
• Delivery status updates from third-party delivery providers
• Authentication and session data from our authentication service provider

3. How We Use Your Information

We use the information we collect for the following purposes:

• To provide and operate the Platform, including processing orders and managing accounts
• To process payments and complete transactions
• To facilitate delivery coordination between Restaurant Partners, Customers, and delivery providers
• To send transactional communications, including order confirmations, status updates, and account notifications
• To provide real-time notifications about orders and restaurant operations
• To provide analytics, reports, and business insights to Restaurant Partners
• To improve, optimize, and maintain the Platform
• To monitor for security threats, fraud, and abuse
• To enforce our Terms of Service
• To comply with legal obligations
• To provide customer support

4. How We Share Your Information

4a. With Restaurant Partners

When Customers place orders, their information (including name, delivery address, phone number, and order details) is shared with the Restaurant Partner fulfilling the order. Restaurant Partners can view customer order history within their own Storefront only.

4b. With Service Providers

We share information with third-party service providers who assist us in operating the Platform. These providers are contractually obligated to use your information only for the purposes of providing services to us. Our service providers include:

• Payment processors (Stripe, AMP Payment Systems / Enhanced Gateway) for payment processing and transaction management
• Hosting provider (Vercel) for application hosting and serverless infrastructure
• Database provider (MongoDB Atlas) for secure data storage
• Cloud storage (Amazon Web Services S3) for file and image storage
• Real-time communication (Pusher) for live order notifications and updates
• Email service (Resend) for transactional email delivery
• Error monitoring (Sentry) for application error tracking and performance monitoring
• Delivery coordination (Shipday) for third-party delivery driver dispatch and tracking
• Infrastructure services (Upstash Redis) for rate limiting and session management

4c. For Legal and Safety Reasons

We may disclose your information when required by law, subpoena, or court order, or when we believe in good faith that disclosure is necessary to protect the rights, safety, and property of Excalibur Interactive, our users, or the public, or to investigate potential violations of our Terms of Service.

4d. Business Transfers

In the event of a merger, acquisition, reorganization, or sale of all or a portion of our assets, your personal information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal information.

4e. With Your Consent

We may share your information for any other purpose with your explicit consent.

We do not sell your personal information to third parties for advertising or marketing purposes.

5. Data Storage and Security

Your data is stored in the United States using industry-standard cloud infrastructure. We employ the following security measures to protect your information:

• Encryption in transit via HTTPS/TLS for all data transmission
• Encryption at rest for sensitive data stored in our database
• PCI DSS-compliant payment processing through Stripe and AMP Payment Systems — we never store full credit card numbers
• Secure password hashing and session management
• Rate limiting to prevent abuse and brute-force attacks
• Role-based access controls to limit data access to authorized personnel
• Regular security monitoring and error tracking

While we implement commercially reasonable security measures, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security of your data. If you believe your account has been compromised, please contact us immediately at support@excaliburinteractive.io.

6. Cookies and Tracking Technologies

We use the following cookies and similar technologies:

• Session cookies: Required for authentication and maintaining your login state across pages
• Preference cookies: Used to remember your settings, such as saved delivery addresses and payment method selections
• Service worker: Used for Progressive Web App (PWA) functionality, including caching assets for faster loading and limited offline capabilities

We do not use third-party advertising cookies or cross-site tracking technologies. Our cookies are used solely for the operation and functionality of the Service.

You can control cookies through your browser settings. However, disabling session cookies will prevent you from logging in and using authenticated features of the Service.

7. Data Retention

We retain your information for as long as necessary to provide the Service and fulfill the purposes described in this policy. Specific retention periods include:

• Account data: Retained while your account is active; deleted upon request after a reasonable processing period
• Order history: Retained for business records, accounting, and legal compliance purposes (typically seven years for financial records)
• Saved payment tokens: Retained while the saved payment method is active; deleted when you remove the saved method
• Server logs and error data: Retained for up to ninety (90) days
• Restaurant Partner data: Restaurant Partners retain access to their business data — including customer information, order history, and financial records — even after cancellation or termination of their subscription. Data is retained indefinitely until the Restaurant Partner requests permanent deletion
• Anonymized and aggregated data: May be retained indefinitely for analytics and platform improvement purposes

8. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete personal data
• Deletion: Request deletion of your personal data, subject to legal retention requirements
• Portability: Request your data in a structured, commonly used, machine-readable format
• Opt-out of communications: Unsubscribe from marketing or promotional emails (note: transactional communications related to your orders and account cannot be opted out of while using the Service)
• Account closure: Request closure and deletion of your account

To exercise any of these rights, please contact us at support@excaliburinteractive.io. We will respond to your request within thirty (30) days.

9. Children's Privacy

The Service is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13 without verifiable parental consent, we will take steps to promptly delete that information.

If you are a parent or guardian and believe that your child under 13 has provided personal information to us, please contact us at support@excaliburinteractive.io so we can take appropriate action.

10. Multi-Tenant Data Separation

The Talos platform operates on a multi-tenant architecture, meaning multiple Restaurant Partners share the same underlying infrastructure while their data remains logically separated. Key data separation principles include:

• Each Restaurant Partner's data (menus, orders, customer interactions) is logically isolated from other Restaurant Partners
• Restaurant Partners can only access data related to their own Storefront and customers who have ordered from them
• Customer accounts may interact with multiple Restaurant Partners; each Partner only sees data from orders placed through their Storefront
• Excalibur Interactive, as the platform operator, has access to all data for the purposes of platform operation, technical support, and legal compliance

Data Ownership Principle: Restaurant Partners retain full ownership and control of their business data at all times. This includes customer contact information, order history, financial records, and analytics. This data remains accessible to Restaurant Partners regardless of subscription status, and Restaurant Partners may request a complete data export at any time. Talos will never hold your data hostage or restrict access to your business information as a result of account cancellation.

11. State-Specific Privacy Rights

California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including:

• Right to know: You may request that we disclose what personal information we have collected, used, disclosed, and sold about you in the past 12 months
• Right to delete: You may request that we delete personal information we collected from you
• Right to correct: You may request that we correct inaccurate personal information
• Right to opt-out of sale: We do not sell your personal information to third parties
• Right to non-discrimination: We will not discriminate against you for exercising your privacy rights

Other State Privacy Laws

Residents of other states with comprehensive privacy legislation (including Virginia, Colorado, Connecticut, Utah, and others) may have similar rights regarding their personal information. To exercise any state-specific privacy rights, please contact us at support@excaliburinteractive.io.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by email or by posting a prominent notice on the Platform prior to the changes taking effect.

The "Last updated" date at the top of this page indicates the date of the most recent revision. Your continued use of the Service after any changes to this Privacy Policy constitutes your acceptance of the revised policy.

13. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: