Privacy Policy

Draft for review, prepared 2026-09-21. It describes what our website and systems do today and takes effect once the effective date is set here.

Tom's Waffles ("we", "us") is a waffle and espresso catering business in Denver, Colorado. This policy explains what information we collect through tomswaffles.com and when you book with us, what we use it for, who helps us process it, and how to reach us about it. Questions or requests: hello@tomswaffles.com or 303-801-8725.

When you visit the website

We count visits with our own simple tracker, not an advertising or analytics service. For each page you view we record the page's address (without anything after a "?"), the day, and, for the first page of a visit, where you came from:

• the name of the website that linked to us (for example "google.com"), not the full link;
• campaign tags in the link, if any (utm_source, utm_medium, utm_campaign, utm_term, utm_content);
• if you clicked an ad, only the name of the ad platform's click parameter (for example "gclid"), never its value.

To tell visits apart we compute a visitor code from your IP address, your browser's user-agent and the date, scrambled with a one-way hash. The code changes every day, so it can't follow you from one day to the next, and we don't store your IP address or user-agent. Obvious bots are ignored, and our staff and customer-account pages aren't counted. We use these records to see how many people visit and which pages, searches and ads bring them. They contain no name, email address or IP address, and we currently keep them without a set deletion date so we can compare traffic over time.

Google Ads. We advertise on Google, and our public pages (not staff or customer-account pages) load Google's ad measurement tag. It lets Google tell us which of our ads led to a quote request or a booking. Google receives your IP address, browser details and the page you're on, and sets its own cookies to connect an ad click to that later request. When you request a quote or book, we tell Google only that it happened, with an order number and, for a booking, its total; never your name, email, phone number or event address. Google uses this under its own privacy policy.

If your browser sends a Global Privacy Control signal, the tag doesn't load at all. You can also limit ad personalization in your Google account's ad settings.

Cookies and browser storage

We don't set cookies ourselves (the Google Ads tag described above sets Google's). We use your browser's local storage in two cases:

• Where your visit came from. If you arrive through a link that says where it came from (a search result, an ad, another website), your browser remembers that source, the page you landed on and the time for 30 days. If you later ask for a quote, it's sent along with your request so we know which ad or page brought you. It stays in your browser and you can clear it by clearing this site's data.
• Signing in. If you sign in to a customer account, your login session is kept in local storage until you sign out.

Our fonts and the footer's service-area map image are served from our own site, so an ordinary page view doesn't contact Google or any other outside company, apart from the Google Ads tag described above. A few things do, and only where noted: the footer's "View on Google Maps" link (Google) and the chicken-and-waffles video (Vimeo) load only when you click them; our service-areas page shows map tiles from OpenStreetMap; and the account sign-in pages show Google's sign-in button. Those companies receive your IP address and may set their own cookies under their own policies.

Quote requests and bookings

Our quote and booking form asks for your name, email, phone number, event date, event address, guest count, menu and add-on choices, gluten-free count, special requests or dietary notes, how you heard about us, and, for tax-exempt organizations, your tax-exempt ID and certificate.

We save your details as soon as you enter your email or phone number, even if you don't finish the form, so we can prepare a quote and follow up about your event. The form says so right under those fields. We use what you give us to prepare your quote and proposal, contact you about your event, prepare contracts and invoices, schedule our crew, and work out any travel fee. For the travel fee your event address is sent to Google to calculate the driving time from our kitchen.

We also collect information through these pages:

• scheduling a call (name, email, optional phone and notes; we send a calendar invitation);
• our loyalty program (name, email, phone, points, and a record of each scan and redemption; points expire a set number of months after they're earned);
• giveaways (name, email, phone);
• our feedback survey (your score and comments, and whether we may quote you);
• customer accounts, if you create one.

Payments

Online payments are handled by Stripe on Stripe's own checkout page. We never see or store your card number. From Stripe we keep the amount, the payment reference, and the name, email and phone number used at checkout. Sales at our public events are taken with Square, which may give us the email address a buyer enters.

Emails and AI assistance

We email you about your quote and booking: proposals, contracts, confirmations, reminders, receipts and follow-ups after your event. Some routine emails are sent automatically. We also send occasional sales follow-up emails to business contacts. Every marketing or sales email includes an unsubscribe link: one click stops them for good. You can also write to hello@tomswaffles.com. Unsubscribing doesn't stop emails about an event you've booked, like receipts and event details.

We use Anthropic's Claude AI to help draft replies, quotes and follow-ups from the information you send us.

Who helps us process your information

We share information only with the service providers that run our business:

• Supabase: our database and back-end services, where your information is stored;
• Lovable: hosting of the website;
• Stripe (online payments) and Square (payments at events);
• Google: our business email and calendar, driving-time calculation and account sign-in;
• Resend: sending some of our emails;
• Anthropic: AI drafting assistance;
• Google Ads: measuring which of our ads lead to quote requests and bookings, as described above.

The Google reviews shown on our site come from Google's Places service. Our server fetches them and keeps a copy for up to a day; your visit isn't sent to Google for this.

We don't sell your personal information. The only advertising network we work with is Google Ads, as described above, and we never send it your name, email, phone number or event address.

How long we keep it

We keep quote, booking, payment and email records as long as we need them to serve your event and for our accounting and tax obligations. Visit records are described above.

Your choices

You can ask us what information we hold about you, ask us to correct it, or ask us to delete it by writing to hello@tomswaffles.com. We'll delete what we aren't required to keep for payment, accounting or tax reasons. You can clear the browser storage described above at any time in your browser's settings.

Children

Our website and services are meant for adults planning events. We don't knowingly collect personal information from children under 13.

Changes

If we change how we handle information, we'll update this page and its effective date.