BananaBox Privacy Policy

Last Updated: July 13, 2026

1. Introduction

This Privacy Policy explains how BananaBox, operated by Common Grid LLC (“BananaBox,” “Common Grid LLC,” “we,” “us,” or “our”), collects, uses, retains, discloses, sells, and protects personal information when you access or use our websites, mobile or web applications, public menu pages, and related services (collectively, the “Services”).

BananaBox provides technology that allows independent food vendors and other businesses (“Vendors”) to create menus, accept customer orders, communicate order information, and coordinate pickup. Individuals who browse menus or submit orders are referred to as “Customers.”

By using the Services, you acknowledge the practices described in this Privacy Policy. Where consent is required by applicable law, we will request consent separately.

2. Who This Policy Applies To

This Privacy Policy applies to:

• Vendors: Businesses and their authorized representatives who create or manage BananaBox accounts, menus, storefronts, schedules, and orders.
• Customers: Individuals who browse Vendor menus, submit orders, communicate with Vendors, or otherwise interact with the Services.
• Visitors: Individuals who visit our websites or applications without creating an account or submitting an order.

Vendors are independent businesses. A Vendor may have its own privacy practices covering information it receives from Customers. BananaBox is not responsible for a Vendor’s independent use of information outside the Services.

3. Personal Information We Collect

The information we collect depends on how you interact with BananaBox.

3.1 Vendor Information

When a Vendor registers or uses the Services, we may collect:

• Name and email address
• Password, stored using a one-way password hashing process rather than in plain text
• Business name and contact information
• Business username, account identifiers, and storefront identifiers
• Menu names, descriptions, sections, items, prices, and variations
• Business hours, availability, and pickup scheduling information
• Storefront logos, menu photographs, cover images, and other uploaded media
• Order-management activity and fulfillment status
• Communications with BananaBox
• Subscription, billing, or payment information if paid services are introduced
• Account settings, preferences, and administrative activity

3.2 Customer Information

When a Customer submits an order or interacts with a Vendor through BananaBox, we may collect:

• Name
• Email address
• Telephone number
• Order selections, quantities, prices, and notes
• Requested pickup date and time
• Order confirmation, fulfillment, cancellation, and status information
• Communications concerning the order
• Vendor associated with the order
• Technical and usage information described below

Customers may be able to submit orders without creating a BananaBox account.

3.3 Payment Information

BananaBox currently operates on a pay-at-pickup basis and does not collect payment card information. If online payments are introduced, payment information will be processed by a third-party provider, and this policy will be updated when that feature becomes available.

3.4 Information Collected Automatically

When you access the Services, BananaBox and its service providers may automatically collect:

• IP address
• Browser, device, and operating-system information
• Approximate location derived from an IP address
• Pages and screens viewed
• Links, buttons, and features used
• Referral information
• Login and session information
• Dates, times, and duration of activity
• Application errors, diagnostics, and performance information
• Security, fraud-prevention, and audit logs
• Cookie and similar-technology identifiers

3.5 Information From Other Sources

We may receive information from:

• Vendors
• Hosting, analytics, email, media-storage, and security providers
• Payment processors
• Authentication or platform providers
• Publicly available sources
• Business partners
• Successors involved in a merger, financing, acquisition, or sale

4. Public Content and Media Files

Vendor menus and storefronts are intended to be publicly accessible. Information published through a Vendor storefront—including business names, menu content, prices, logos, photographs, availability, and pickup information—may be viewed, copied, cached, indexed, or redistributed by Customers, search engines, content-delivery networks, and other third parties.

Vendors must not upload confidential information or personal information that they do not have authority to publish. This includes photographs of identifiable individuals and files containing embedded location or device metadata.

Vendor images may be stored through third-party media-hosting or content-delivery providers. Removing an image from an active storefront may not immediately remove cached copies.

5. How We Use Personal Information

We use the information collected through BananaBox to operate and improve the Services, including to:

• Create and manage Vendor accounts
• Publish and maintain Vendor menus and storefronts
• Receive, record, confirm, and manage Customer orders
• Share order information with the appropriate Vendor and Customer
• Coordinate pickup, fulfillment, cancellations, and status updates
• Send transactional emails and service-related communications
• Provide customer support and respond to inquiries
• Maintain order history, business records, logs, and audit information
• Protect the Services against fraud, misuse, security threats, and technical failures
• Diagnose errors and improve reliability and performance
• Analyze how Vendors and Customers use the Services
• Develop, test, and improve current and future features, automation, analytics, recommendations, and operational tools
• Create aggregated or deidentified business and usage insights
• Conduct internal research, planning, and product development
• Market BananaBox or related CommonGrid products and services where permitted by law
• Comply with legal, tax, accounting, contractual, and regulatory obligations
• Establish, exercise, or defend legal claims

We may combine information from different interactions or sources for these purposes. Customer Order Information is primarily used to support ordering, fulfillment, recordkeeping, service improvement, and permitted marketing rather than to operate a personal social profile.

6. Marketing Communications

We may use Vendor and Customer contact information to send information about BananaBox, CommonGrid, new features, promotions, surveys, or related products and services where permitted by law.

Transactional communications concerning an account or order are not marketing communications.

Recipients may unsubscribe from marketing emails using the instructions included in the message or by contacting us. Unsubscribing from marketing does not prevent necessary transactional, security, legal, or account-related communications.

7. Development, Analytics, and Artificial Intelligence

We may analyze order records, menu information, communications, usage patterns, and related data to develop or improve:

• Menu-building tools
• Vendor recommendations
• Operational automation
• Ordering and fulfillment features
• Analytics and reporting
• Fraud and security systems
• Search and categorization tools
• Machine-learning or artificial-intelligence-supported features
• Future CommonGrid or BananaBox products

Where reasonably possible, we may aggregate, pseudonymize, or deidentify information used for research or development. However, identifiable information may be used when necessary to operate, evaluate, secure, or improve a feature, subject to applicable law and our access controls.

We will not represent information as anonymous or deidentified unless we have taken reasonable measures intended to prevent it from being associated with an identifiable individual.

8. How We Disclose Personal Information

We may disclose information to the following categories of recipients.

8.1 Vendors and Customers

We disclose information needed to process and fulfill an order. For example, a Vendor may receive a Customer’s name, contact information, order details, notes, and pickup selection. Customers may receive Vendor contact, menu, pickup, and order-status information.

8.2 Service Providers

We may disclose information to companies that provide services on our behalf, including:

• Cloud-hosting and database providers
• Email-delivery providers
• Image-hosting and content-delivery providers
• Analytics and diagnostic providers
• Security, fraud-prevention, and monitoring providers
• Customer-support providers
• Payment processors
• Professional advisers, including attorneys and accountants

These providers may process information according to their contracts with us and their own applicable legal obligations.

8.3 Legal, Compliance, and Safety Disclosures

We may disclose information when we reasonably believe disclosure is necessary to:

• Comply with law, regulation, court order, subpoena, or lawful governmental request
• Investigate fraud, misuse, security incidents, or illegal activity
• Enforce agreements and policies
• Protect BananaBox, CommonGrid, Vendors, Customers, or the public
• Establish, exercise, or defend legal claims

8.4 Business Transfers

Information may be disclosed or transferred in connection with an investment, financing, merger, acquisition, reorganization, bankruptcy, sale of assets, or similar transaction.

9. Sale or Sharing of Personal Information

BananaBox may sell, license, disclose, or otherwise make personal information available to third parties for monetary or other valuable consideration, subject to applicable law.

Information involved may include:

• Customer contact information
• Vendor contact and business information
• Order and purchase information
• Menu and product-interest information
• Device, browser, and usage information
• Approximate location information
• Marketing and interaction information
• Inferences or audience segments derived from this information

Potential recipients may include marketing partners, advertising or analytics providers, data or business partners, prospective commercial partners, and parties involved in developing or offering future products and services.

We do not sell passwords, complete payment-card information, or card security codes.

Some privacy laws define “sale” or “sharing” broadly and may include disclosures for targeted or cross-context behavioral advertising even when no money is exchanged.

Before engaging in a sale or sharing activity where applicable law requires an opt-out, BananaBox will provide an applicable method to submit a “Do Not Sell or Share My Personal Information” request. Requests may also be submitted using the contact information below.

Where legally required and technically applicable, we will process recognized browser-based opt-out preference signals. We will not knowingly sell or share the personal information of individuals under 16 without the affirmative authorization required by applicable law.

10. Cookies and Similar Technologies

We and our service providers may use cookies, local storage, pixels, software-development kits, and similar technologies to:

• Maintain sessions and authentication
• Remember settings and preferences
• Operate and secure the Services
• Measure traffic and usage
• Diagnose errors
• Evaluate features
• Support analytics and marketing

Browser settings may allow you to block or remove certain technologies. Doing so may impair login, ordering, or other functionality.

Where required, we will provide additional cookie controls or obtain consent before using nonessential technologies.

11. Data Retention

BananaBox retains information for operational, legal, security, accounting, dispute-resolution, research, development, and business purposes.

Our general retention practices include:

• Active account and order information may be retained while the relevant account remains active.
• Completed and archived order records may be retained for at least seven years.
• Order records may be hidden or archived rather than permanently deleted.
• Customer order details, item records, timestamps, status history, and related metadata may remain stored to preserve the accuracy of historical orders.
• Payment-related metadata may be retained for reconciliation, refunds, disputes, chargebacks, tax review, and audits.
• Application logs are generally retained for at least one year.
• Security and audit logs may be retained longer.
• Backup copies may remain until they expire under a rolling backup schedule.
• Aggregated or deidentified information may be retained indefinitely where permitted by law.
• Information may be retained longer when required by law, contract, litigation hold, investigation, or legitimate business need.

A user-facing delete function may remove information from active display without deleting the underlying database record.

When a valid deletion request applies, we may delete or deidentify covered personal information unless retention is permitted or required for completing transactions, maintaining business records, security, fraud prevention, legal compliance, exercising legal rights, internal uses reasonably aligned with expectations, or another lawful purpose.

12. Data Security

We use administrative, technical, and organizational safeguards designed to protect personal information. Measures may include:

• One-way password hashing
• Token-based authentication
• Role-based access restrictions
• Logging and monitoring
• Restricted administrative access
• Encrypted network transmission where supported
• Vendor and infrastructure security controls
• Backup and incident-response procedures

No security system is completely secure. We cannot guarantee that information will never be accessed, altered, lost, or disclosed without authorization.

If a security incident triggers a legal notification obligation, we will provide notice as required by applicable law.

13. Your Privacy Rights

Depending on your jurisdiction and subject to applicable exceptions, you may have the right to:

• Confirm whether we process your personal information
• Access categories or specific pieces of personal information
• Correct inaccurate information
• Request deletion
• Obtain a portable copy of certain information
• Opt out of the sale or sharing of personal information
• Opt out of targeted advertising
• Restrict or object to certain processing
• Limit certain uses of sensitive personal information
• Withdraw consent where processing depends on consent
• Appeal a denied privacy request
• Receive equal service and pricing without unlawful discrimination for exercising privacy rights

To submit a request, email commongrid310@gmail.com with the subject line Privacy Request.

To request an opt-out of sale or sharing, use the subject line Do Not Sell or Share Request.

We may need to verify your identity and authority before completing a request. Verification may require confirming information associated with an order, account, email address, or telephone number.

Authorized agents may submit requests where permitted by law, but we may require proof of authorization and identity verification.

We may deny or limit a request when permitted by law, including when retaining information is necessary to preserve transaction records, prevent fraud, protect security, comply with legal obligations, or exercise legal rights.

14. Children’s Privacy

The Services are intended for adults and businesses and are not directed to children under 13. We do not knowingly collect personal information directly from children under 13 through the Services.

If we learn that we collected personal information directly from a child under 13 without legally required parental authorization, we will take appropriate steps to delete it.

Parents or guardians may contact us regarding information they believe was submitted by a child.

15. Third-Party Services and Links

The Services may contain links to Vendor websites, social-media pages, payment processors, or other third-party services. Those services operate under their own privacy policies. BananaBox is not responsible for third-party privacy or security practices.

16. United States Operations

BananaBox is operated from the United States. Information may be stored or processed in the United States or other locations where our service providers operate.

Individuals accessing the Services outside the United States acknowledge that applicable data-protection standards may differ from those in their jurisdiction. Where required, we will use appropriate safeguards for international transfers.

17. Changes to This Privacy Policy

We may revise this Privacy Policy periodically to reflect changes in the Services, technology, legal requirements, or business practices.

We will post the revised policy with an updated “Last Updated” date. When legally required, we will provide additional notice or obtain consent before materially changing how previously collected information is used.

Continued use of the Services after an updated policy becomes effective constitutes acknowledgment of the revised policy, except where applicable law requires a different form of agreement.

18. Contact Us

Questions, concerns, and privacy requests may be submitted to:

CommonGrid / BananaBox
Email: commongrid310@gmail.com
Mailing Address:
205 Dental Drive
Suite 7, No. 147
Warner Robins, Georgia 31088
United States