LEGAL

Privacy Policy

Hazel’s Subs & Wraps · Last updated October 26, 2026

Who we are

Hazel's Subs & Wraps is a family-owned food business based in East Orange, New Jersey. We operate a made-to-order sandwich website at hazelssubs.com and accept orders for local delivery, pickup, and workplace programs. You can reach us at hazelssubsandwraps@gmail.com.

Delivery evidence photos

For local delivery, approved drivers take a photo of the order’s handoff or drop-off in Hazel’s Driver. The photo is privately available to Kitchen and that order’s customer for 30 days, then removed. We strip photo metadata, including embedded GPS data, before storage and exclude photo bytes from saved backups. Drivers should avoid faces, people and unrelated personal information. Delivery completion ends live GPS sharing; the delivery photo is separate from live tracking. DJZ6 does not use delivery photos or driver tracking.

Information we collect

When you place an order or interact with our website, we may collect:

• Name — to identify your order and address you.
• Phone number — to contact you about your order and, if you consent, to send you SMS order-status notifications.
• Email address — to send your order confirmation and receipt.
• Delivery address — to verify delivery eligibility and fulfill your order.
• Order details — the items you ordered, customizations, and special instructions.
• Payment reference — we use Stripe to process payments. We do not store your full card number. We retain the Stripe session identifier and payment status for order records.
• SMS consent record — whether you opted in to SMS notifications and the timestamp of that consent.
• Technical information — IP address and browser user-agent may be logged by our hosting infrastructure for security and debugging purposes.

How we use your information

We use the information we collect to:

• Fulfill, prepare, and deliver your order.
• Send you an email confirmation and receipt after your payment is verified.
• Send you transactional SMS notifications about your order status — only if you have opted in.
• Contact you about problems with your order or delivery.
• Process and track payments via Stripe.
• Prevent fraud and unauthorized use of our ordering system.
• Maintain business records as required by applicable law.

SMS notifications

SMS updates and new SMS enrollment are currently off on this website. Order confirmations are sent by email. The SMS provisions below apply when this optional program is enabled.

If you provide your phone number and check the SMS opt-in box at checkout, you may receive transactional text messages about your order — such as order confirmation, preparation updates, pickup readiness, and delivery status notifications.

SMS consent is optional and is never a condition of placing an order. You may opt out at any time by replying STOP to any message from us. For assistance, reply HELP. Message and data rates may apply.

Mobile phone numbers, SMS opt-in data, and messaging consent will not be sold, rented, shared, or disclosed to third parties or affiliates for their marketing or promotional purposes.

Message frequency varies based on your order activity. Message and data rates may apply.

Our SMS notifications are transactional only and are sent through Twilio. See the SMS Messaging Terms for full details.

How we process your information for order notifications

We use your name, phone number, email address, and order details to fulfill and communicate about your order — including transactional email and, if you opt in, SMS notifications. Service providers listed below process relevant information on our behalf solely to operate those services. This is not sharing for marketing.

Third-party service providers

Service providers that process information on our behalf, solely to operate our ordering and notification services:

• Stripe — payment processing. Stripe receives your name, email, and payment card information to complete your transaction. Stripe's privacy policy applies to information they collect: stripe.com/privacy.
• Twilio — SMS message delivery. If you opt in to SMS, your phone number and message content are transmitted to Twilio to deliver order-status texts. Twilio's privacy policy applies: twilio.com/en-us/legal/privacy.
• Resend — email delivery. Your name, email address, order details, and support messages are transmitted to Resend as needed to deliver confirmation, sign-in, and customer-support emails.
• Render — hosting and persistent order storage, with access restricted to operate our ordering service.
• US Census Geocoder — may process street addresses for local delivery eligibility checks when that service is enabled. Local delivery is currently paused.

We do not sell your personal information to any third party. We do not share your information with advertisers or data brokers.

Browser storage and support requests

We store your bag’s item selections and menu context in your browser so it can be restored. Capability tokens for orders placed in your current browser session are held in session storage so My Orders can show only those orders. These tokens are not used for advertising. Closing your browser session may remove access to that session’s order list; keep your confirmation email.

If you use Contact Us, we store your name, email, topic, optional order number, and message so we can respond. Support messages may be emailed to our business inbox through Resend. Do not include payment card details or passwords in a support message.

Customer accounts

Accounts are optional. To create an account, provide your name, email and password, then verify your email with a five-digit code sent through Resend. Sign-in uses your email and password followed by a verification code. We store your name, verified email, a salted password hash, verification records and secure session records so you can view only orders associated with your verified email. We do not store or email your plain-text password. Verification codes expire after 15 minutes, verification records are kept for up to 24 hours, and remembered sessions expire after 30 days. Password recovery requires email verification and signs out previous sessions. Sign out on shared devices. Account messages are transactional, not marketing.

Local delivery location sharing

During an assigned local delivery, a driver may choose to share their phone’s location with Hazel’s and the customer using that order’s private tracking link. We keep only the latest location fix, not a trip history. The driver controls sharing. When the driver marks delivery complete, customer access to the location ends immediately and the current fix is removed. Customers cannot complete a delivery or control the driver’s sharing session. Drivers can stop sharing at any time. The web app pauses sharing when hidden or the phone is locked; old fixes stop appearing after 45 seconds and are cleared from live storage within about 2.5 minutes. Trip sessions expire after four hours, and tracking links expire after seven days. Location fixes are excluded from our application backups.

Customer maps load automatically when an authorized customer opens an active delivery’s private tracking link; driver maps load after Open Hazel’s map. OpenFreeMap supplies map tiles and receives the viewer’s IP address and requested map area. The US Census geocoder receives only the delivery street address, city, state and ZIP code to locate the destination, without the customer name, apartment number, phone or email. FOSSGIS/OSRM receives the driver and delivery destination coordinates to calculate road routes, and its privacy policy states that route requests are logged. Private tracking tokens are never sent to these providers. Verified destination coordinates are kept with the order address; driver route results remain briefly in memory and are cleared when sharing or delivery ends. The embedded map offers 2D and 3D views, with Apple Maps retained as an optional backup. DJZ6 and pickup orders do not use live driver tracking. Keep tracking links private.

Data retention

We retain order records — including your name, contact information, and order details — for as long as reasonably needed to support order fulfillment, customer service, and business recordkeeping. SMS consent records are retained as part of order records.

Your choices and rights

You may contact us at hazelssubsandwraps@gmail.com to:

• Ask what personal information we have on file about you.
• Request correction of inaccurate information.
• Request deletion of your personal information, subject to applicable legal obligations.
• Opt out of SMS messages (you may also reply STOP to any text).

Children's privacy

Our website and ordering service are not directed at children under 13. We do not knowingly collect personal information from children.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of our website after a change constitutes acceptance of the updated policy.

Contact us

Questions about this Privacy Policy? Please reach us at:

• Email: hazelssubsandwraps@gmail.com
• Website: hazelssubs.com