Privacy Policy

The information we collect depends on how you use the Services.

Information you provide directly

We may collect:

• Contact and identity information, such as your name, email address, telephone number, billing or shipping address, and account username.
• Account information, such as your login credentials (with passwords stored in hashed form), profile settings, birthday if you choose to provide it, marketing preferences, and account status.
• Order and transaction information, such as products or menu items ordered, modifiers, quantities, prices, tips, discounts, loyalty activity, pickup or shipping details, special instructions, order status, transaction identifiers, and limited payment-method details such as card brand and last four digits.
• Payment and subscription information. Payment-card fields are hosted and tokenized by our payment processor, Stax. Complete card numbers and card security codes are submitted directly to Stax and are not received by Enoch's servers. We receive payment tokens, processor customer or payment-method identifiers, transaction status, and limited card details needed to complete purchases, issue refunds, and manage recurring subscriptions.
• Enoch's Circle information, such as loyalty enrollment, points, rewards, redemption activity, membership tier, and subscription history.
• Communications and request information, such as messages sent through our contact form, customer-service correspondence, newsletter signups, feedback, private-event inquiries, requested dates, event type, estimated guest count, and other details you choose to provide.
• Event information, such as RSVP name and email, attendance or waitlist status, email consent, performer application details, performance type, technical needs, notes, and cancellation requests.
• Artist and submission information, such as artist name or handle, biography, website and social-media links, profile image, artwork or other uploaded media, title, description, medium, dimensions, price, sale preference, review status, and communications about a submission. Information you designate for an artist profile or that is included with approved work may be displayed publicly.
• Other information you choose to provide, including information entered in free-text fields. Please do not include sensitive personal information in special instructions, messages, notes, biographies, or submissions unless it is necessary for your request.

Information received from delivery marketplaces and other sources

If you order through Uber Eats, DoorDash, or another service we expressly support, the platform may send us information needed to prepare and manage your order. Depending on the platform and order, this may include a platform order identifier, customer name, ordered items and modifiers, special instructions, amounts, fulfillment type, promised time, courier information, and order status. We use that information to fulfill the order, show it in our kitchen systems, communicate status updates to the platform, prevent duplicate processing, handle cancellations, and maintain required business records.

We may also receive transaction status and payment identifiers from Stax; delivery, shipping, or fulfillment updates from service providers; and information from a person who submits a request or order on your behalf.

Information collected automatically

When you use the Services, we and our service providers may automatically collect:

• internet protocol (IP) address, browser and device type, operating system, referring page, pages viewed, approximate location derived from IP address, timestamps, and similar usage or diagnostic information;
• server, security, and error logs; and
• information stored through cookies, pixels, local storage, session storage, and similar browser technologies.

We use browser storage and similar technologies to keep you signed in, maintain a cart, preserve checkout progress, remember preferences, control newsletter prompts, support security and fraud prevention, and understand use of the Services.

We use Google Analytics to measure website traffic and interactions. Google may collect device, usage, and online-identifier information through cookies or similar technologies and process it under Google's own terms and privacy policy. We may also use Cloudflare Turnstile or similar tools to identify automated or abusive activity.

We may use personal information to:

• provide, operate, maintain, and improve the Services;
• create and administer accounts, artist profiles, Enoch's Circle membership, rewards, and subscriptions;
• process payments, orders, pickups, shipments, refunds, cancellations, and recurring charges;
• prepare delivery orders and exchange order status with Uber Eats, DoorDash, or another platform through which an order was placed;
• manage event RSVPs, waitlists, performer applications, private-event inquiries, artist submissions, exhibitions, and related communications;
• send transactional messages, including receipts, confirmations, account notices, order updates, password-reset messages, and submission decisions;
• send newsletters or promotional communications when permitted by law and consistent with your choices;
• personalize content and remember settings;
• analyze traffic, usage, and performance;
• protect the Services, customers, staff, and business; authenticate users; prevent fraud, spam, duplicate transactions, abuse, and security incidents; and troubleshoot technical problems;
• enforce our terms and policies and protect legal rights; and
• comply with legal, tax, accounting, regulatory, and contractual obligations.

We may disclose personal information in the following circumstances:

• Service providers. We use vendors that provide cloud hosting, databases, file storage, email delivery, analytics, bot and abuse prevention, payment processing, shipping or fulfillment, technical support, and other operational services. These include providers such as Amazon Web Services, Google Analytics, Cloudflare, and Stax, where applicable.
• Delivery marketplaces. When an order involves Uber Eats or DoorDash, we exchange order, store, and fulfillment information with the applicable platform to receive, accept, prepare, update, cancel, and complete the order. An order placed directly with a marketplace is also subject to that marketplace's privacy policy.
• Business and professional advisers. We may disclose information to accountants, insurers, attorneys, auditors, consultants, and other professional advisers where reasonably necessary.
• Legal, safety, and security purposes. We may disclose information if we reasonably believe disclosure is required by law, legal process, or a valid governmental request, or is necessary to protect rights, safety, property, users, staff, or the public; investigate fraud or abuse; or enforce agreements.
• Business transfers. We may disclose or transfer information in connection with an actual or proposed financing, merger, acquisition, reorganization, sale of assets, or similar business transaction, subject to appropriate protections.
• At your direction or with your consent. We may disclose information when you ask us to do so or otherwise consent.
• Public content. Artist profile information and approved creative submissions intended for public display may be published on our website or promotional channels.

We do not sell personal information for money. We do not use personal information obtained from delivery marketplaces for unrelated advertising. Some privacy laws may define certain analytics disclosures more broadly than an ordinary sale; see Your privacy choices and rights below.

Most browsers let you delete or block cookies and clear local or session storage. Blocking these technologies may prevent carts, checkout recovery, account sign-in, preferences, and other features from working correctly.

You can learn about Google's practices in its Privacy Policy and use the Google Analytics opt-out browser add-on.

Our website does not currently respond to browser "Do Not Track" signals because there is no universally accepted standard for those signals. If applicable law requires us to recognize another browser-based opt-out signal, we will process it as required.

You may unsubscribe from marketing emails by using the unsubscribe link in an email or contacting us at hello@enochs.nyc. Unsubscribing from marketing messages does not prevent us from sending non-promotional communications such as receipts, service notices, order updates, security alerts, or messages needed to respond to your request.

You may update certain marketing preferences in your account where that option is available.

We retain personal information only for as long as reasonably necessary for the purposes described in this policy, including to provide requested services; maintain account, loyalty, order, subscription, submission, and event records; meet tax, accounting, payment-network, contractual, and legal requirements; resolve disputes; prevent fraud and duplicate processing; and enforce agreements.

Retention periods vary by the type of information and our obligations. For example, we may retain transaction records longer than ordinary website analytics or abandoned checkout information. When information is no longer reasonably needed, we take steps to delete, de-identify, or securely isolate it, unless retention is required or permitted by law. Backup copies may remain for a limited period until overwritten through ordinary backup processes.

We use reasonable administrative, technical, and physical safeguards designed to protect personal information. These measures include access controls, encrypted network connections, password hashing, payment tokenization, restricted credentials, and measures intended to detect abuse and duplicate transactions.

No system or transmission method is completely secure. We therefore cannot guarantee absolute security. You are responsible for using a strong, unique password and protecting your account credentials.

Depending on where you live and subject to applicable exceptions, you may have the right to request that we:

• provide access to or a copy of personal information we hold about you;
• correct inaccurate personal information;
• delete personal information;
• explain the categories of information we collect, use, or disclose;
• restrict or object to certain processing;
• opt out of a sale, sharing, or targeted advertising where such activity occurs and the right applies; or
• provide portable information where required by law.

You may submit a request by emailing hello@enochs.nyc with the subject line Privacy Request or by writing to the address below. Please describe your request and provide enough information for us to identify the relevant records. We may need to verify your identity before completing a request. We may deny or limit a request when permitted by law, including when information must be retained for legal, security, transaction, fraud-prevention, or recordkeeping purposes.

Where applicable, an authorized agent may submit a request for you. We may ask for proof of authorization and identity. If applicable law provides a right to appeal our response, you may appeal by replying to our decision email with the subject Privacy Appeal.

We will not unlawfully discriminate against you for exercising an applicable privacy right.

The Services may contain links to websites, maps, social networks, calendars, delivery marketplaces, and other third-party services. We do not control their privacy or security practices. This policy does not apply to information a third party collects directly from you under its own privacy policy.

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information to us, contact us so we can review and, where appropriate, delete it.

Enoch's operates in the United States. We and our service providers may process and store information in the United States and other locations where they operate. Those locations may have data-protection laws different from the laws where you live.

We may update this Privacy Policy from time to time. We will post the updated version at this public URL and change the effective date above. If required by law, we will provide additional notice or obtain consent for material changes.

For privacy questions or requests, contact: