Privacy Policy | Ottoman Kitchen

The short version

We collect only what we need to make your order, answer your catering request and send the messages you asked for. We do not sell your personal information. We do not share your mobile number or your text-message consent with anyone for their marketing.

What we collect

When you order online: your name, mobile number, email address, what you ordered, any notes you add, your pickup time and the order total.
Payment: your card details go straight from your browser to Clover, our payment processor. We never see or store your full card number.
When you request catering: your name, contact details and what you tell us about your event.
When you buy a gift card: your name and email, the name and email of the person it is for, and your message. We keep the card’s balance and when it was used.
When you join the Text Club: your mobile number, your first name if you give it, and a record of the consent you gave (the exact wording you agreed to, when, and on which page).
When you contact us: whatever you send us by phone, text, WhatsApp or email.
Automatically: basic technical information that every website receives, such as your IP address, browser type and the pages requested. Our hosting provider keeps this in short-lived logs for security and troubleshooting.

How we use it

To prepare your order, take payment and have it ready on time.
To send your order confirmation, and one follow-up email asking how your order was.
To reply to catering requests and questions.
To send Text Club messages, only if you signed up for them.
To prevent fraud, fix problems and keep the site secure.
To keep the business records the law requires, such as sales records.

Text messages

We text you only if you gave us your number for that purpose. Marketing texts go only to people who joined the Text Club. Details, including how to stop, are in our Text Message Terms.

We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text-message opt-in data and consent are never shared with or sold to any third party. We share your number only with the service providers that deliver our messages for us, and only for that purpose.

Who we share it with

We use a small number of companies to run our ordering and messages. They may handle your information only to provide their service to us:

Clover (payments, and the order system in our kitchen)
Vercel (website hosting)
Supabase (the database where order and sign-up records are stored)
Resend (order confirmation and follow-up emails)
Twilio (text messages, when you have asked for them)
Google (YouTube), Meta (Facebook and Instagram) and Dropbox (publishing the restaurant’s own photos and videos; see “YouTube and our social media tools” below)
Google (Google Analytics, to measure how the site is used)
Meta (Facebook and Instagram, to measure and show our ads)
Microsoft (Microsoft Clarity, to see how the site is used and fix what is confusing)

If you order through DoorDash or Uber Eats, your information is handled under their privacy policies. We may also share information when the law requires it, or to protect our guests, staff or business. We do not sell personal information.

Cookies, analytics and advertising

The ordering page uses your browser's storage to remember your cart on your own device. When you arrive through a link in one of our posts, your browser also remembers which post it was for 14 days, and we save that with your order or catering request so we know which posts our guests find useful. It is not a cookie and is not shared with anyone. Clover sets what it needs to process a card payment securely.

Google Analytics. We use Google Analytics to understand how people use this site: which pages are visited, how visitors found us, and whether an order, catering request or Text Club sign-up went through (with the order total, never your card or contact details). Google Analytics uses cookies and records information such as pages viewed, approximate location (city level), and device and browser type. We have turned off Google signals and ad personalization for this data. Google handles it under the Google Privacy Policy. You can opt out with Google's opt-out browser add-on.

Meta (Facebook and Instagram). We use the Meta pixel to measure our ads and to show our ads to people who visited this site. It uses cookies and tells Meta which pages were visited and whether an order or request was completed (with the order total). This may count as sharing for targeted advertising under some state laws. You can turn it off: we do not load it in browsers that send a Global Privacy Control signal, and you can turn off advertising on this browser.

Microsoft Clarity. We use Microsoft Clarity to see how visitors use our pages, so we can fix what is hard to use. Clarity records anonymous page activity: taps, clicks, scrolling and how the page looked, which can be replayed as a recording and combined into heatmaps. What you type into forms (such as your name, phone, email, address and card details) is hidden before anything is sent, and card payments happen in Clover's secure frame, which Clarity cannot see. Clarity uses cookies and records information such as device and browser type and approximate location. We do not load Clarity in browsers that send a Global Privacy Control signal. Microsoft handles this data under the Microsoft Privacy Statement.

Visits from our ads. When you arrive by clicking one of our ads, we record that visit with your IP address, browser type, approximate location (city level), how long you stayed and whether you placed an order. We use this only to detect fake or wasted ad clicks and to stop showing our ads to addresses that repeatedly click without ordering (which may mean sharing the IP address with Google Ads for that purpose). We delete these records after 30 days.

101 Okey scoreboard. Names and scores stay on your own phone. When you finish a game, we count one game for your country, using the approximate location our hosting provider works out from your connection. We use the same approximate location (state level) to decide whether to show Ottoman Kitchen offers for the DC area. We don't store your IP address or location.

YouTube and our social media tools

Ottoman Kitchen runs its own YouTube channel (@ottomankitchenva). Our website includes a private owner dashboard that uses YouTube API Services to upload the restaurant’s own videos to that channel. Only the restaurant owner can sign in to it. By using any YouTube feature on or through our site you agree to be bound by the YouTube Terms of Service. Google’s handling of information is described in the Google Privacy Policy.

What we access: when the owner connects our YouTube channel, Google gives our dashboard permission to upload videos to that channel and to read the channel’s name and ID. We do not access, collect or store information about any other YouTube user or channel, and we do not read viewers’ data, comments or analytics through the API.
What we store: an encrypted access token (so scheduled videos can be uploaded) and the channel’s name and ID, kept in our own database (Supabase). We also keep the titles, descriptions and schedule of the videos we post.
How we use and share it: only to upload and publish our own restaurant videos at the times the owner approves. We do not sell it or share it with anyone else.
Revoking access and deletion: the channel owner can disconnect YouTube at any time from the dashboard, which deletes the stored token and channel details immediately, or revoke our access through Google’s security settings page. If access is revoked or not refreshed, we delete the stored YouTube data within 30 days. You can also contact us below to ask for deletion.

The same dashboard posts our own photos and videos to the restaurant’s Facebook Page and Instagram account through Meta’s APIs, and reads the media files we keep in our own Dropbox folder. It does not collect personal information about our guests from those services.

How long we keep it

We keep order records for as long as tax and accounting rules require. We keep Text Club records, including proof of consent and opt-outs, for as long as you are a member and for a period afterward to show that we followed the rules. Catering requests are kept so we can follow up and plan repeat events. You can ask us to delete information we no longer need.

Your choices

Stop texts: reply STOP to any text from us.
Advertising: turn off the Meta pixel on this browser. We also honor the Global Privacy Control signal.
Analytics: install Google's opt-out add-on, or block cookies in your browser settings.
Session recordings: turn on Global Privacy Control in your browser and we will not load Microsoft Clarity.
Stop emails: reply to the email and tell us, or contact us below. Order confirmations are sent for every order you place.
See, correct or delete your information: contact us and we will help. Depending on where you live, you may have additional legal rights over your personal information, and we will honor them.

Children

Our website and online ordering are meant for adults. We do not knowingly collect personal information from children under 13.

Changes to this policy

If we change how we handle personal information, we will update this page and the date at the top.

Contact us

Ottoman Kitchen
4300 Chantilly Shopping Center, Suite 1N, Chantilly, VA 20151
Phone or text: (571) 287-7278
Email: info@ottomankitchen.us