PRIVACY POLICY

Effective date: July 22, 2026

This Privacy Policy explains how Bella Maine, LLC, which operates Chaval (collectively, “Chaval,” “we,” “us,” or “our”), collects, uses, discloses, and protects personal information.

This Privacy Policy applies to https://www.chavalmaine.com and any Chaval-branded online service that links to this Privacy Policy (collectively, the “Site”). It also applies to personal information that we receive when you subscribe to our emails, contact us, apply for employment, make a reservation, place an online order, purchase a gift card, or submit a private-event or wedding inquiry through a service we use.

Some services linked from or embedded in the Site are operated by other companies. Their privacy notices govern the information they collect and use for their own purposes. This Privacy Policy governs Chaval’s use of personal information that those services provide to us.

1. Information We Collect

We may collect the following categories of personal information.

Information you provide directly

When you interact with Chaval, you may provide:

• Your first and last name, email address, telephone number, and other contact information.

• The content of messages, questions, feedback, or other communications you send to us.

• Newsletter subscription information, including your first name, last name, and email address.

• Details relating to cake orders, private events, weddings, or other inquiries, such as an event date, guest count, budget, service preferences, and special requests.

• Reservation details, including the requested date and time, party size, preferences, special requests, and information you choose to include about dietary restrictions, allergies, or accessibility needs.

• Employment application information, such as your resume, work history, qualifications, availability, references, and any information included in your application or correspondence.

Please provide only information that is relevant to your request. If you provide information about another person, you represent that you have permission to do so.

Reservations, orders, gift cards, and transactions

When you use a third-party service to make a reservation, order food, purchase a gift card, or complete another transaction, that service may collect information such as your name, contact information, reservation or order details, billing or delivery information, transaction amount, and payment information.

Chaval currently uses Resy for reservations and Upserve by Lightspeed for online ordering, gift cards, and payment processing. Payment card information is collected and processed by the applicable payment provider. Chaval does not intend to collect or store full payment card numbers through the Site. We may receive limited transaction information, such as an order or reservation confirmation, payment status, amount, or other information needed to complete the transaction and maintain our records.

Private events and wedding inquiries

Chaval uses PerfectVenue for private-event inquiries and related communications. PerfectVenue is not currently used by Chaval to process payments. Chaval may receive information submitted through PerfectVenue, including contact information, event date, guest count, budget, event type, preferences, and message content.

If and when Chaval makes a venue listing or inquiry feature available through Zola, Zola may collect wedding and event information under its own privacy policy and may provide relevant inquiry or lead information to Chaval. This may include names, contact information, wedding date, location, guest count, budget, requested services, preferences, and communications. Chaval will use information received from Zola to evaluate and respond to wedding inquiries and provide requested services.

Shopify store

If and when Chaval launches an online merchandise store using Shopify, Shopify and the store’s payment providers may collect information needed to operate the store and fulfill purchases. This may include names, email addresses, telephone numbers, billing and shipping addresses, products viewed or purchased, order history, transaction details, payment information, returns, and customer-service communications.

Chaval may receive order, fulfillment, and customer information needed to process orders and provide customer service. Full payment card information will be handled by Shopify or the applicable payment provider rather than intentionally stored by Chaval. Shopify’s own privacy notice will also apply to its processing of information.

Information collected automatically

When you use the Site, Chaval and its technology providers may automatically collect:

• Internet Protocol address and approximate location derived from it.

• Browser type, device type, operating system, language, network information, and device identifiers.

• Referring and exit pages, pages viewed, links clicked, scrolling activity, and other interactions with the Site.

• Dates, times, session duration, error information, and general Site-performance data.

• Cookie identifiers, advertising identifiers, and similar online identifiers, where permitted by your choices and applicable law.

We collect this information through server logs, cookies, pixels, tags, embedded content, and similar technologies.

Microsoft Clarity

We use Microsoft Clarity to understand how visitors interact with the Site. Clarity may collect behavioral and technical information such as page views, clicks, scrolling, mouse movement, device and browser information, and page-rendering information. Clarity may present this information through aggregated metrics, heatmaps, and session-replay tools. Chaval uses these insights to diagnose problems and improve the Site’s design, content, and usability.

Clarity is intended to mask sensitive information in recorded sessions. Even so, you should not enter payment card numbers or other highly sensitive information into ordinary Site fields or messages. Chaval has configured Microsoft Clarity not to set cookies. Clarity may still process limited cookieless technical and behavioral signals on a per-page basis to help us understand and improve Site use. More information is available in the Microsoft Privacy Statement.

Fraud prevention and reCAPTCHA

Squarespace forms on the Site may use Google reCAPTCHA to help detect spam, fraud, and automated abuse. Google may collect device, browser, interaction, and network information for this purpose. Google’s processing is governed by the Google Privacy Policy and applicable terms.

2. How We Use Personal Information

We may use personal information to:

• Operate, maintain, secure, troubleshoot, and improve the Site.

• Respond to questions, requests, cake inquiries, private-event inquiries, wedding inquiries, and other communications.

• Manage reservations and provide reservation confirmations, reminders, and customer service.

• Process and fulfill online orders, gift-card purchases, merchandise orders, returns, and related transactions.

• Provide services requested by customers and remember relevant preferences.

• Send Chaval newsletters and promotional emails when you subscribe.

• Measure Site traffic, understand how visitors use the Site, and improve performance and usability.

• Measure advertising effectiveness and, where permitted by your choices and applicable law, show or help measure advertisements relevant to visitors.

• Detect, investigate, and prevent fraud, misuse, security incidents, and technical problems.

• Review employment applications and communicate with applicants.

• Maintain business, accounting, tax, reservation, transaction, and operational records.

• Enforce our agreements, protect our rights and the rights of others, and comply with legal obligations.

• Carry out another purpose disclosed when the information is collected or with your permission.

Information about dietary restrictions, allergies, accessibility needs, or other potentially sensitive circumstances is used to respond to your request and provide appropriate service. Chaval does not intentionally use this information for targeted advertising.

3. Cookies and Similar Technologies

The Site uses cookies and similar technologies. Chaval’s Squarespace cookie controls organize cookies into the following categories:

Necessary

Necessary cookies are always on because they support core Site functions, security, network management, fraud prevention, and the storage of privacy choices.

Performance and Analytics

These optional technologies help measure visits, traffic sources, Site interactions, errors, and performance. They may include Squarespace Analytics and Google Analytics 4. Microsoft Clarity operates in limited cookieless mode, as described under Microsoft Clarity above.

Advertising

These optional technologies may help Chaval measure advertising campaigns, understand whether an advertisement led to a Site visit or other action, and deliver or measure advertising based on online activity. They may include tools provided by Google Ads and Meta.

Some technology may load in a limited or cookieless form to provide security, essential functionality, or basic consent and measurement signals. Optional cookie storage and advertising use should follow your saved choices and applicable law.

You may accept all cookies, reject non-essential cookies, or choose individual categories through the Site’s cookie banner. After making a choice, use the Cookie Preferences control on the Site to review or change it. Blocking cookies through your browser may also work, but it can affect Site functionality and may not control every form of storage or cookieless processing.

Do Not Track

Some browsers offer a “Do Not Track” setting. Because there is not a uniform industry standard for interpreting these signals, the Site does not currently respond to Do Not Track signals. Use the Site’s cookie controls to manage optional cookies and advertising technologies.

4. Email and Text Communications

Chaval sends newsletters through Squarespace Email Campaigns. If you subscribe, we may send occasional emails about menus, events, dinners, wine-focused evenings, brunches, announcements, and other Chaval news. You can unsubscribe at any time by selecting the unsubscribe link included in each marketing email. An unsubscribe request may take a short time to process.

Chaval does not use its newsletter list to enroll subscribers in text-message marketing. Resy may send transactional text messages relating to a reservation, such as a confirmation, update, or reminder, based on the information and choices provided during the reservation process. Opting out of marketing email does not stop communications necessary to complete a reservation, order, transaction, or response to your request.

5. How We Disclose Personal Information

We may disclose personal information in the following circumstances.

Service providers and platforms

We disclose information to companies that provide services to Chaval or enable customer-requested transactions. Depending on the interaction, these companies may include:

• Squarespace, for website hosting, forms, security, analytics, newsletter subscriptions, and email campaigns.

• Google, for Google Analytics 4, Google Ads, and reCAPTCHA.

• Meta, for advertising measurement or advertising services if those tools are enabled.

• Microsoft, for Microsoft Clarity.

• Resy, for reservations and reservation-related communications and payments.

• Upserve by Lightspeed, for online ordering, gift cards, transactions, and payment processing.

• PerfectVenue, for private-event inquiries and related communications.

• SinglePlatform, for embedded menu content.

• Zola, if and when Chaval activates its venue listing or inquiry services, for wedding promotion and wedding inquiries.

• Shopify and applicable Shopify store providers, if and when Chaval launches its merchandise store, for ecommerce, payments, order processing, fulfillment, security, and customer service.

These companies may process information as Chaval’s service providers, as independent businesses, or in both roles, depending on the service. Their own privacy notices explain how they process information under their control.

Advertising and analytics providers

If advertising or analytics technologies are enabled, providers may receive online identifiers, Internet Protocol addresses, browser and device information, pages viewed, Site interactions, and information about advertising performance. Chaval does not upload newsletter, reservation, ordering, or other customer lists to Meta or Google for Customer Match or custom-audience creation.

Professional, legal, and safety disclosures

We may disclose information to professional advisers, insurers, auditors, accountants, attorneys, or other parties that assist with legitimate business operations. We may also disclose information when reasonably necessary to comply with law, legal process, or a valid government request; enforce an agreement; investigate fraud or security concerns; or protect the rights, property, and safety of Chaval, our guests, employees, or others.

Business transactions

If Chaval is involved in a merger, financing, reorganization, sale of assets, acquisition, bankruptcy, or similar transaction, information may be reviewed or transferred as part of that transaction, subject to applicable law.

Ugly Duckling

Chaval does not transfer customer records or newsletter subscriber information to Ugly Duckling. If you choose to follow a link from the Site to Ugly Duckling’s website, that separate website may collect information directly from your browser under its own privacy notice.

6. Sale, Sharing, and Targeted Advertising

Chaval does not sell personal information for monetary compensation.

Some U.S. state privacy laws may define the disclosure of cookie identifiers and online activity to advertising platforms as “selling,” “sharing,” or processing for targeted advertising, even when no money is exchanged. Where applicable, you may opt out by turning off Advertising in the Site’s Cookie Preferences. You may also contact us using the information below.

Chaval does not provide its newsletter, reservation, ordering, or other customer lists to unaffiliated businesses for their own direct-marketing campaigns.

7. Third-Party Services and Links

The Site may contain links to, or embedded features from, services operated by other companies, including Resy, Lightspeed, PerfectVenue, SinglePlatform, Instagram, Facebook, Yelp, TripAdvisor, Zola, and Shopify. When you interact directly with one of these services, the provider’s privacy notice and terms govern its collection and use of information.

For more information, you may review the privacy notices of Squarespace, Google, Meta, Microsoft, Resy, Lightspeed, PerfectVenue, Zola, and Shopify.

Chaval is not responsible for changing the privacy practices of independently operated services. We encourage you to review the notice presented by the applicable provider before submitting information.

8. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide requested services, maintain business and transaction records, comply with legal, tax, accounting, or reporting requirements, resolve disputes, enforce agreements, and protect against fraud or security incidents.

Retention periods vary according to the type of information and the context in which it was collected. For example:

• Newsletter information may be retained until you unsubscribe, ask us to delete it, or the list is otherwise cleaned or retired.

• Reservation, order, gift-card, payment-status, and event records may be kept for customer service, operational, accounting, tax, chargeback, dispute, and legal purposes.

• Employment application information may be kept for the applicable hiring process and for a reasonable period afterward, including to consider a candidate for future opportunities where permitted by law.

• Analytics and advertising information is retained according to Chaval’s configurations and the applicable provider’s retention practices.

When information is no longer reasonably needed, we may delete it, deidentify it, or retain it in an aggregated form, subject to technical and legal limitations.

9. Data Security

We use reasonable administrative, technical, and physical safeguards designed to protect personal information. We also use established service providers for website hosting, reservations, transactions, and payments. No method of transmission over the Internet or method of electronic storage is completely secure, so we cannot guarantee absolute security.

Do not send payment card numbers, Social Security numbers, health records, or other highly sensitive information through ordinary email or general Site inquiry fields.

10. Children’s Privacy

The Site is intended for a general audience and is not directed to children under 13. Chaval does not knowingly collect personal information online from children under 13. If you believe a child under 13 has provided personal information to us, contact us so we can review and, where appropriate, delete it.

11. Your Privacy Choices and Rights

Depending on where you live and subject to applicable exceptions, you may have the right to request that Chaval:

• Confirm whether we process personal information about you.

• Provide access to or a copy of personal information about you.

• Correct inaccurate personal information.

• Delete personal information.

• Provide certain information in a portable format.

• Opt you out of the sale or sharing of personal information or processing for targeted advertising.

• Restrict or limit certain uses of sensitive personal information.

• Review an appeal if we deny a request and applicable law provides an appeal right.

You may also unsubscribe from marketing emails using the link in each email and manage optional cookies through the Site’s Cookie Preferences.

To submit a privacy request, email info@chavalmaine.com with the subject line Privacy Request. Please include your name, the email address associated with your interaction, your state of residence, and a clear description of the request. Do not include sensitive identification documents in your initial email.

We may need to verify your identity and authority before completing a request. If an authorized agent submits a request for you, we may require evidence of the agent’s authority and may ask you to verify your identity directly. We will respond within the period required by applicable law. Certain information may be exempt from a request, including information we must retain to comply with law, complete a transaction, maintain security, or exercise or defend legal claims.

Chaval will not discriminate against you for exercising a privacy right provided by applicable law.

If your request concerns information maintained primarily in an account operated by Resy, Lightspeed, Zola, Shopify, or another independent service, you may also need to submit a request directly to that provider. Chaval will address information under its control and will assist as reasonably appropriate.

12. Processing in the United States

Chaval is located in Maine, United States. We and our service providers may process information in the United States and other countries where they operate. Privacy laws in those locations may differ from the laws where you live.

13. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, services, providers, or legal obligations. When we do, we will revise the effective date at the top of the page. If a change is material, we may provide additional notice on the Site or through another appropriate method.

14. Contact Chaval

For privacy questions or requests, contact:

Bella Maine, LLC
Chaval
58 Pine Street
Portland, Maine 04102
United States
info@chavalmaine.com
207-772-1110