WHAT WE COLLECT
Only what a kit needs.
When you book or register for an event: your name, email address, phone number, company, and a U.S. shipping address, because a kit ships to a real door.
Dietary information — preferences, allergies, and restrictions, so the kitchen can build your kit correctly. This is the most sensitive thing we hold and we treat it that way: allergy details are encrypted, visible only to the kitchen team who need them, and every access is logged.
When you buy from us directly: order details and billing information. We never see or store your card number — payment is processed by Stripe under PCI DSS standards.
Optional personalization: if you choose to tell us a favorite flavor or treat, we use it for gifts and personal touches only. It is opt-in, kept separate from your operational dietary information, and leaving it blank costs you nothing.
Automatically, when you visit the site: IP address, browser type, pages viewed, and access times. Standard web analytics, described further in our Cookie Policy.
Effective August 9, 2026. Replaces the policy dated January 1, 2024.
WHAT WE USE IT FOR
Running your event. That's it.
Preparing and shipping your kit. Running your event. Sending the messages that make both work — confirmations, shipping updates, reminders, and follow-up. Improving what we do.
Marketing email only if you asked for it, and you can unsubscribe from the link in any message. Text messages only with your explicit opt-in, and you can stop them by replying STOP.
We do not sell your personal information. We never have and we will not. We also don't rent it, trade it, or hand it to data brokers.
"We do not sell your personal information. We never have and we will not."
WHO ELSE TOUCHES IT
A short list, and no one else.
The services that make delivery possible: our database and hosting, address validation, shipping labels and carriers, email and text delivery, payment processing, and our internal planning boards. Each is bound by confidentiality obligations and may use your information only to provide their service to us.
If you registered through a company event, your company's event coordinator sees the roster for their event only — never your history with any other company, and never your allergy details beyond what's needed to run the event.
We may disclose information where the law requires it, or to protect someone's safety. If we're ever part of a merger or sale, your information moves under this same policy.
YOUR RIGHTS
One posture, not fine print per state.
See it. Ask what we hold about you, where it came from, and what we use it for. If you have a portal profile you can download it yourself, any time.
Correct it. Tell us what's wrong and we'll fix it.
Delete it. One request erases your personal details from our active systems, within 30 days. Two things persist by design: financial records we are required to keep for seven years, and a tamper-evident access log that records that a record was touched and by whom — it holds none of your dietary or contact detail.
Opt out. Of marketing email, of text messages, or of both, without losing anything you're entitled to as a customer.
No retaliation. Exercising any of these changes nothing about the service you get or the price you pay.
Appeal. If we deny a request, we'll tell you why and how to appeal. Email info@smcoaz.com with 'Appeal' in the subject and a different person reviews it within 45 days.
To exercise any of these, email info@smcoaz.com. A human answers. We'll verify it's really you before we act, and we'll respond within 45 days.
ⓘThese rights apply to everyone, in every U.S. state.
HOW WE PROTECT IT
Encryption, least privilege, an audit log.
Encryption in transit and at rest. Allergy details get a second layer at the application level. Access is limited to the people whose job requires it. Actions on your data are recorded in an append-only audit log. Files live in private storage that requires a fresh, short-lived signed link and a server-side permission check before anything downloads.
No system is perfect and anyone who tells you otherwise is selling something. If an incident affects your information, we notify affected individuals without unreasonable delay and no later than 30 days after we confirm it. If the incident involves a corporate client's roster, we notify that client's contact within 72 hours of confirming it.
HEALTH INFORMATION & YOUNGER PARTICIPANTS
Allergy data has one job.
Allergy and dietary information may qualify as consumer health data under some state laws, including Washington's My Health My Data Act. We collect it for one purpose — building your kit correctly and telling you honestly when we can't — and we do not use it for advertising, share it for advertising, or sell it, ever. You can withdraw it at any time by contacting us, though we may then be unable to accommodate the need.
Some events include family or younger participants. Where a participant is under 18, a parent, guardian, or organizer registers them and provides the shipping and dietary details on their behalf. We don't knowingly collect information directly from anyone under 13; if you believe we have, contact us and we'll delete it.
Links to other companies' sites are governed by their policies, not ours.
We'll post updates here with a new effective date. If a change materially affects how we use information you've already given us, we'll tell you directly rather than hoping you re-read this page.
Sweet Moments Co. is a brand of Ludwig Concepts LLC · 5448 E. Washington St, STE 3, Phoenix, AZ 85034 · info@smcoaz.com · (480) 401-1385
ALSO
The rest of the fine print.