Privacy Policy

1. Introduction

Cereal Ventures, LLC, a Delaware limited liability company doing business as SUL (“SUL,” “we,” “us,” or “our”), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website at eatsul.com (the “Site”) or place an order with us.

This Privacy Policy is provided in compliance with the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act of 2020 (CPRA), and other applicable privacy laws. By using the Site, you agree to the terms of this Privacy Policy.

If you have questions about this policy, please contact us at:

hello@eatsul.com
200 Harbor Rd, Unit 602, San Diego, CA 92101

2. Information We Collect

We collect the following categories of personal information, which you provide to us voluntarily when creating an account, completing our onboarding questionnaire, or placing an order:

2.1 Identity and Contact Information

• Full name
• Email address
• Phone number (if provided)
• Home delivery address
• Date of birth / age

2.2 Health and Biometric-Adjacent Information (Optional)

The following information is collected solely to personalize your meal plan recommendations and is entirely optional. You are not required to provide this information to place an order or use our service.

• Height
• Weight
• Activity level (as indicated through our onboarding questionnaire)
• Dietary preferences or restrictions (if voluntarily disclosed)

IMPORTANT: We are not a healthcare provider. The health-related information you provide is used only for product personalization purposes and does not constitute medical advice. We do not sell, share, or use this information for any purpose other than personalizing your SUL experience.

2.3 Order and Transaction Information

• Order history and preferences
• Subscription status and billing cycle
• Payment method type (we do not store full card numbers — payments are processed by Stripe)

2.4 Technical and Usage Information

• IP address
• Browser type and version
• Device type and operating system
• Pages visited, time spent on pages, and referring URLs
• Cookie identifiers and similar tracking technologies (see Section 6)

2.5 Communications

• Emails or messages you send to us at hello@eatsul.com
• Customer support communications

3. How We Use Your Information

We use the information we collect for the following purposes:

• To process and fulfill your orders and manage your account
• To personalize product recommendations based on your optional health profile
• To manage and process your subscription, including billing and cancellations
• To send order confirmations, delivery updates, and service-related communications
• To respond to your inquiries and provide customer support
• To send marketing communications where you have opted in (you may opt out at any time)
• To improve our website, products, and services
• To detect, prevent, and investigate fraud or unauthorized activity
• To comply with applicable legal obligations

4. California Consumer Privacy Act (CCPA / CPRA) Disclosures

4.1 Categories of Personal Information Collected

In the past 12 months, we have collected the following categories of personal information as defined under the CCPA:

• Identifiers (name, email, address, IP address)
• Personal information under California Civil Code § 1798.80 (name, address, telephone number)
• Characteristics of protected classifications (age/date of birth)
• Commercial information (order history, subscription records)
• Health or medical information (height, weight, activity level — collected voluntarily)
• Internet or other electronic network activity (browsing behavior on Site)
• Geolocation data (delivery address, general location from IP)
• Inferences drawn to create a profile (meal personalization profile based on questionnaire)

4.2 Sensitive Personal Information

Under the CPRA, certain data we collect is classified as “sensitive personal information,” including health-related data (height, weight, activity level) and precise geolocation. We collect this data only with your knowledge, and solely for the purpose of providing and personalizing our service to you. We do not use sensitive personal information for purposes beyond those disclosed in this Policy.

4.3 Sale or Sharing of Personal Information

We do not sell your personal information to third parties for money. We do not share your personal information with third parties for cross-context behavioral advertising purposes. We may share limited data with service providers (such as Stripe for payment processing and delivery partners) strictly to fulfill our services to you. These providers are prohibited from using your data for their own marketing purposes.

4.4 Your California Privacy Rights

If you are a California resident, you have the following rights under the CCPA/CPRA:

• Right to Know: You may request to know what personal information we have collected about you, the categories of sources, the purposes for collection, and the categories of third parties with whom we share it.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to Correct: You may request correction of inaccurate personal information we hold about you.
• Right to Opt Out: You may opt out of the sale or sharing of your personal information. (We do not currently sell or share data, but you may still submit this request.)
• Right to Limit Use of Sensitive Personal Information: You may request that we limit our use of your sensitive personal information to what is necessary to provide the service.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.

To exercise any of these rights, contact us at hello@eatsul.com with the subject line “California Privacy Request.” We will respond within 45 days as required by law. We may need to verify your identity before processing your request.

5. How We Share Your Information

We do not sell your personal information. We may share your information with the following categories of third parties solely to operate our business and provide our services:

• Payment Processors: Stripe, Inc. processes all payments. Your payment card data is handled directly by Stripe and is subject to Stripe's Privacy Policy (stripe.com/privacy). We do not store full card numbers.
• Delivery Partners: We share your name and delivery address with our delivery service provider(s) solely to fulfill your order.
• Email and Marketing Tools: We may use third-party email platforms to send transactional and marketing communications. These providers process your email address on our behalf.
• Analytics Providers: We may use analytics tools (such as Google Analytics) to understand Site usage. These tools may collect anonymized usage data.
• Legal Compliance: We may disclose your information if required to do so by law, court order, or government authority, or to protect the rights, property, or safety of SUL, our customers, or others.

All third-party service providers are contractually prohibited from using your personal information for purposes other than providing services to us.

6. Cookies and Tracking Technologies

We use cookies and similar tracking technologies on the Site. Cookies are small text files stored on your device that help us operate the Site and understand how it is used.

6.1 Types of Cookies We Use

• Essential Cookies: Required for the Site to function (e.g., maintaining your cart and session). Cannot be disabled.
• Analytics Cookies: Help us understand how visitors use the Site (e.g., Google Analytics). You may opt out of analytics cookies.
• Marketing Cookies: Used to deliver relevant advertising. We will seek your consent before deploying marketing cookies.

6.2 Your Cookie Choices

You may control cookies through your browser settings. Note that disabling certain cookies may affect Site functionality. California residents may also submit a “Do Not Sell or Share” request via the contact information below, which will apply to any data shared with advertising partners. You can also manage your preferences on our Your Privacy Choices page.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide services, comply with legal obligations, resolve disputes, and enforce our agreements. Health-related data you provide through the optional questionnaire is retained only as long as your account is active and is deleted upon account closure or upon your written request to hello@eatsul.com.

8. Data Security

We implement reasonable technical and organizational measures to protect your personal information against unauthorized access, disclosure, alteration, or destruction. Payment data is handled entirely by Stripe and protected under PCI-DSS standards. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

If you believe your account has been compromised, please contact us immediately at hello@eatsul.com.

9. Children's Privacy

Our Site and services are intended for users aged 18 and older. We do not knowingly collect personal information from children under the age of 13. Users between the ages of 13 and 17 (“Minors”) may use the Site and place orders only with the express permission, supervision, and involvement of a parent or legal guardian. By allowing a Minor to use the Site, the parent or legal guardian agrees to these Terms and this Privacy Policy on behalf of the Minor and accepts full responsibility for the Minor's use of the Site and any orders placed.

We do not knowingly collect personal information from children under the age of 13 without verifiable parental consent, in compliance with the Children's Online Privacy Protection Act (COPPA). The optional health data fields (height, weight, activity level) are disabled for users who identify as under 13. If we become aware that we have inadvertently collected personal information from a child under 13 without parental consent, we will take prompt steps to delete that information. If you believe we may have information about a child under 13, please contact us at hello@eatsul.com.

10. Third-Party Links

Our Site may contain links to third-party websites. We are not responsible for the privacy practices of those websites and encourage you to review their privacy policies. This Privacy Policy applies only to our Site.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will post any changes on this page with a revised “Last Updated” date. If we make material changes that affect how we handle your health-related or sensitive personal information, we will notify you by email prior to the change taking effect. Your continued use of the Site after any changes constitutes your acceptance of the updated Policy.

12. Contact Us

For any privacy-related questions, requests, or complaints, please contact us:

Cereal Ventures, LLC dba SUL
200 Harbor Rd, Unit 602, San Diego, CA 92101
hello@eatsul.com

We will respond to all verifiable consumer requests within 45 days. For complex requests, we may extend this period by an additional 45 days with notice.