Privacy Policy

Information we collect

• Account information: email address, pickup name, sign-in provider, avatar, account identifiers, and communication preferences.
• Order information: selected products, customizations, pickup method, order status, transaction totals, order history, and support messages.
• Loyalty and promotion information: Lab Points balance and history, coupon use, eligibility, and reward redemptions.
• Payment references: Square customer and payment identifiers, card brand, last four digits, and expiry details for cards you choose to save. ARK does not receive or store full card numbers or security codes.
• Notification information: device platform, app version, push token, and notification preferences.
• Technical information: security logs, diagnostics, approximate network information, and information our service providers need to operate and protect the service.
• Website storage: the public website can save your temporary Lab Tray in your browser so it remains available when you return.

How we use information

• Create and secure your ARK account.
• Validate, prepare, charge, track, and support dine-in and takeaway orders.
• Maintain saved payment methods through Square when you request that feature.
• Operate Lab Points, coupons, promotions, favorites, and reorder features.
• Send account security messages, receipts, and order-status notifications.
• Send optional Lab Drops and offers only when you have opted in.
• Prevent fraud, abuse, duplicate transactions, and unauthorized access.
• Improve reliability, accessibility, menu performance, and store operations.
• Meet legal, tax, accounting, and dispute-resolution requirements.

Service providers

We use trusted providers to operate the ARK ecosystem. They process information only for the services they provide and under their own contractual and privacy obligations.

• Supabase for authentication, application data, database services, and secure server functions.
• Square for payment processing, saved payment methods, customer payment profiles, refunds, and point-of-sale synchronization.
• Expo for mobile application builds, updates, and notification delivery.
• Firebase for Android push-notification routing.
• Google and Apple when you choose social sign-in, platform wallets, or app-store services.
• GoDaddy and cPanel email services for website hosting and transactional account email.

Some providers may process information outside Canada. Where that occurs, information can be subject to the laws of the country where it is processed.

Messages and marketing

Receipts, account security emails, and order-status messages are transactional and are sent when required to provide the service.

Promotional email and push notifications are optional. You can change promotional preferences in the app’s Account area. Device-level notification permission can also be changed in your phone settings.

Retention and account deletion

Account and preference information is kept while your account is active. You can initiate deletion inside the ARK app or through our account deletion page.

Deletion requests are normally completed within 30 days. Account profiles, saved-card links, device registrations, favorites, and loyalty information are removed. Completed order and payment records may be anonymized and retained when reasonably required for tax, accounting, fraud prevention, chargebacks, legal claims, or regulatory obligations.

Security

We use encrypted connections, access controls, role-based administration, server-side pricing, signed payment webhooks, limited production credentials, and monitoring intended to protect customer information. No online service can guarantee absolute security, so customers should use a unique password and protect access to their devices and email accounts.

Customers aged 13 and over

The ARK app and account program are intended for customers aged 13 and over. We do not intentionally collect full birth dates at launch. If you believe a younger person created an account improperly, contact us so we can review and remove it.

Your choices

You may ask to access, correct, or delete your account information, withdraw optional marketing consent, or ask questions about our handling of personal information. We may need to verify your identity before completing a request.

Policy updates

We may update this policy as the service changes. The current version and effective date will remain available on this page. Material changes may also be communicated through the app or by email when appropriate.