Privacy Policy
Effective Date: June 1, 2026 · Last Updated: June 13, 2026
Who We Are
Don Fefo Cafe is a mobile coffee cart based in the tri-state area of Ohio, Kentucky, and Indiana. This Privacy Policy explains how we collect, use, and protect personal information when you visit our website, place an order, or contact us.
If you have questions about this policy, contact us at donfefocafe@proton.me.
Information We Collect
We collect information you provide directly to us, including:
- Contact information — your name, email address, and any message you send through our contact form.
- Order information — items ordered, special instructions, and order totals.
- Payment information — card details are processed directly and securely by Stripe. We do not store or have access to your full payment card number.
We also automatically collect limited technical data when you visit our website:
- Browser type and device information
- Pages viewed and time spent on the site
- Referring URLs
We do not collect sensitive personal information such as Social Security numbers, government IDs, financial account details beyond payment processing, health or medical data, or precise geolocation.
How We Use Your Information
We use the information we collect to:
- Fulfill and communicate about your orders
- Respond to questions and messages you send us
- Improve our website and services
- Comply with legal obligations
We do not sell, rent, or trade your personal information to third parties for their own marketing purposes.
How We Share Your Information
We share your personal information only in the following limited circumstances:
- Payment processing — Stripe processes payment card data on our behalf. Stripe's privacy policy is available at stripe.com/privacy.
- Service providers — We may use hosting and analytics providers that process data solely on our behalf and under our instructions.
- Legal requirements — We may disclose information if required by law, court order, or to protect our legal rights.
We do not sell personal data as defined under applicable Ohio, Kentucky, or Indiana privacy laws.
Cookies and Tracking
Our website may use cookies and similar technologies for basic functionality and to understand how visitors use our site. You can disable cookies in your browser settings; however, some parts of the site may not function correctly without them.
We do not use cookies for cross-site behavioral advertising or targeted advertising.
Data Retention
We retain your personal information only as long as necessary to fulfill the purposes described in this policy, to resolve disputes, or to comply with legal obligations. Order records are typically retained for up to three (3) years for business and tax purposes. Contact form submissions are retained for up to one (1) year.
Your Privacy Rights
Depending on where you live, you may have certain rights regarding your personal information. Residents of Ohio, Kentucky, and Indiana have rights under their respective state consumer data protection laws, including:
Your Rights
- Right to Access — Confirm whether we process your personal data and request a copy of it.
- Right to Correction — Request that we correct inaccurate personal data we hold about you.
- Right to Deletion — Request that we delete personal data we have collected from you, subject to certain exceptions.
- Right to Data Portability — Obtain a portable copy of personal data you have provided to us.
- Right to Opt Out — Opt out of the sale of personal data or its use for targeted advertising or profiling. (We do not sell personal data or use it for targeted advertising.)
- Right to Appeal — If we decline to act on a privacy request, you may appeal that decision.
- Right to Non-Discrimination — We will not discriminate against you for exercising any of these rights.
To exercise any of these rights, please contact us using the information below. We will respond to verifiable requests within the timeframes required by applicable law (generally 45 days, with a possible 45-day extension when reasonably necessary).
Applicable State Laws
This policy is designed to comply with the following consumer privacy laws applicable to our service area:
- Ohio — Ohio Privacy Act (OPA), effective December 31, 2024
- Kentucky — Kentucky Consumer Data Protection Act (KCDPA), effective January 1, 2026
- Indiana — Indiana Consumer Data Protection Act (INCDPA), effective January 1, 2026
Note: These laws include applicability thresholds based on volume of data processed. As a small, locally operated coffee cart, we may fall below those thresholds; however, we are committed to respecting these rights for all of our customers regardless.
Children's Privacy
Our website is not directed to children under the age of 13, and we do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us and we will delete it promptly.
Security
We implement reasonable administrative, technical, and physical measures to protect your personal information from unauthorized access, loss, or misuse. Payment card data is handled exclusively by Stripe, which maintains PCI DSS compliance. No method of electronic transmission or storage is 100% secure, so we cannot guarantee absolute security.
Changes to This Policy
We may update this Privacy Policy from time to time. When we make changes, we will update the "Last Updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of our website after any updates constitutes acceptance of the revised policy.
Contact Us
To submit a privacy rights request, ask questions about this policy, or appeal a decision, please reach out to us:
Don Fefo Cafe
Email: donfefocafe@proton.me