Who this is for
This notice supplements our Privacy Policy and is written for California residents under the California Consumer Privacy Act as amended by the CPRA ("CCPA"). We are Rice Cracker LLC, an Oakland, California business. In practice we honor every right on this page for anyone who asks, resident or not.
Notice at collection
The table below lists every CCPA category of personal information, whether we collect it, and where it comes from. Every row traces to something you typed, to the ordinary technical facts of an internet request, or to the Microsoft Clarity analytics described in our Privacy Policy.
| CCPA category | Do we collect it? | Details |
|---|---|---|
| Identifiers | Yes | Email address (account, orders, newsletter, catering); name and phone number if you include them in a catering inquiry; the display name you put on a review; name and postal address you enter at Stripe checkout for shipping; IP addresses attached to sign-in, checkout and form submissions for rate-limiting. |
| Customer records (Cal. Civ. Code §1798.80) | Yes | The same contact details as above. Payment card details are collected directly by Stripe on its hosted checkout page and never reach our servers. |
| Protected classifications | No | Not collected. |
| Commercial information | Yes | Orders (items, quantities, prices, totals, status), subscription state (plan, price, renewal, pause/cancel flags), and your review history. |
| Biometric information | No | Not collected. |
| Internet or network activity | Yes | IP address and browser user-agent on session records; IP-keyed request records for abuse prevention. Microsoft Clarity also records how you interact with our pages (mouse movement, clicks, scrolls) as session recordings and heatmaps, and gives your browser a pseudonymous ID in its own cookies. We build no browsing-history profiles ourselves. |
| Geolocation data | No | We derive no location from your device. A shipping address or an event venue you type in yourself is stored as the text you gave us, under the categories above. |
| Sensory data (audio, video) | No | Not collected. |
| Professional or employment information | No | Not collected. |
| Education information | No | Not collected. |
| Inferences / profiles | Not by us | We build no profiles and make no automated decisions about you. Microsoft may use what Clarity collects for its own purposes, including advertising — the Privacy Policy explains how to switch that off. |
| Sensitive personal information | Only sign-in credentials | Your email plus a one-time 6-digit sign-in code, and — if you enroll one — a passkey's public key with its usage metadata (the private key never leaves your device). Codes are stored only as salted hashes, expire after 10 minutes, and both are used solely to sign you in — never disclosed, never used for anything else. We collect no government IDs, no financial account numbers (Stripe holds payment details), no precise geolocation, no health, genetic, biometric or similar data. |
Sources: you (forms, checkout, email you send us), your browser (the technical facts of a request), and Stripe (the payment outcome, plus the shipping details you enter there). Purposes: providing the site, accounts, orders, subscriptions and catering; sending the email you asked for; security and abuse prevention; understanding how the site is used; and legal compliance — exactly as described in the Privacy Policy. We run no advertising and build no profiles. Microsoft does use the Clarity data it receives for its own advertising, which is why the next section says we share.
Sale and sharing
We receive no money for anyone's personal information, and we have never sold any. One thing on this site does, however, meet the CCPA's definitions: Microsoft Clarity, the analytics tool described in our Privacy Policy. Microsoft acts as an independent controller rather than a service provider following our instructions, and it uses what it collects for its own purposes, including advertising. The law does not turn on whether money changes hands, so we do not argue the point: we treat this as both a sale and a share and give you the opt-out that applies to both.
What is shared: internet or network activity — how you interact with our pages, and the pseudonymous cookie IDs Microsoft sets to recognize your browser. With whom: Microsoft. For what: analytics for us, and Microsoft's own purposes including advertising. Nothing else is sold or shared: not your email, your orders, your addresses, your reviews or your sign-in credentials. Before August 28, 2026 we sold and shared nothing at all, so that is the whole of it for the preceding 12 months. We have no actual knowledge of selling or sharing the personal information of consumers under 16.
How to stop it: turn on Global Privacy Control in your browser or a privacy extension. Microsoft states that Clarity honors GPC, and Clarity is the only thing here that could be sold or shared, so that signal switches off all of it. Because we let you opt out through an opt-out preference signal, Civil Code §1798.135(b) does not require us to post a separate "Do Not Sell or Share My Personal Information" link, and this section stands in its place. You can also opt out of Microsoft's collection directly at the Digital Advertising Alliance opt-out page, or email [email protected] and we will confirm it for you. Opting out never changes your prices or what we sell you.
We use sensitive personal information (the sign-in credentials described above) only to provide the sign-in you request and to resist attacks on it — purposes permitted by CCPA regulations — so no "Limit the Use of My Sensitive Personal Information" link is required either.
Disclosures for business purposes in the preceding 12 months: identifiers, customer records, commercial information and network activity, disclosed to the service providers named in the Privacy Policy (payment processing, transactional email delivery, bot protection, inbound email routing, and place search for the catering form) under contracts limiting them to those purposes. Microsoft is listed separately above because it is not one of those service providers.
"Shine the Light" (Cal. Civ. Code §1798.83): we do not disclose personal information to third parties for their own direct-marketing purposes, so there is nothing to request under that statute.
Retention
We keep each category only as long as the purpose it was collected for requires: sessions at most 30 days; sign-in codes unusable after 10 minutes; passkeys until you remove them on your account page or delete your account (their one-time sign-in challenges expire within 10 minutes); orders and payment records for as long as tax, accounting and fraud rules require; catering inquiries as records of the events we were asked to quote; newsletter addresses until you unsubscribe or are deleted; abuse-prevention records for as long as the threat they guard against persists.
Your rights
- Right to know / access — what categories and specific pieces of personal information we hold about you, where it came from, why, and who it was disclosed to.
- Right to delete — subject to the CCPA's exceptions; the ones we actually rely on are completing your transactions, security and fraud prevention, and legal record-keeping obligations (tax and accounting records of orders).
- Right to correct — inaccurate personal information.
- Right to portability — a copy of what you gave us, in a usable format.
- Right to opt out of sale or sharing — Microsoft Clarity is the only thing it applies to; the "Sale and sharing" section above is how you exercise it.
- Right to non-discrimination — exercising any of these rights never changes the price or quality of anything we offer you.
How to exercise them
Delete it all yourself, right now: sign in and use "Delete account" on your account page. Your signed-in session is the identity verification. It is immediate, and this is exactly what it does:
- Cancels any active coffee subscription immediately — including any remaining deliveries in a period you already paid for — and deletes your customer record and saved billing details at Stripe.
- Permanently deletes your account, every session, every passkey, the sign-in code records for your email address, your product reviews, and your newsletter entry if you had one.
- Keeps order records (what was bought, amounts, the email and shipping address on the order) because tax and accounting law requires it — but detaches them from any account. Catering inquiries, which are business correspondence rather than account data, are also kept unless you ask us to delete them by email.
- Cannot be undone. Signing in later with the same email address starts a brand-new, empty account.
Everything else — know, access, correct, portability, or deletion without an account: email [email protected]. We verify requests by confirming you control the email address our records are about (we'll reply to that address; for higher-risk requests we may ask for one more piece of matching information). We respond within 45 days, extendable once by another 45 with notice, and it is always free unless requests become manifestly excessive (and even then, no more than the CCPA allows, at most twice in 12 months for access requests).
Authorized agents may submit requests for you with your signed written permission; we will still verify your identity with you directly. We cannot act on requests we cannot verify — deleting the right person's data depends on it.
Opt-out preference signals
We treat Global Privacy Control as a valid opt-out of sale and sharing, and it is how we meet Civil Code §1798.135(b) instead of posting a "Do Not Sell or Share" link. Microsoft Clarity is the only recipient the signal has to reach, and Microsoft states that Clarity honors GPC. Everything else on this site — your account, orders, email and sign-in data — is never sold or shared with or without the signal.
Contact
Rice Cracker LLC, Oakland, California — [email protected]. If you believe we have fallen short of anything on this page, tell us and we will fix it.