Privacy Policy

1. Introduction

Excalibur Interactive Solutions, LLC ("Excalibur Interactive," "we," "us," or "our") operates the Talos platform, available at ordertalos.com and through all Restaurant Partner Storefronts hosted on subdomains (e.g., restaurant.ordertalos.com) and custom domains (collectively, the "Service").

This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you use our Service. This policy applies to all users, including Restaurant Partners, Staff Members, and Customers.

By using the Service, you consent to the practices described in this Privacy Policy. If you do not agree with this policy, please do not use the Service. This Privacy Policy should be read in conjunction with our Terms of Service.

2. Information We Collect

2a. Information You Provide Directly

• Account registration data: Name, email address, phone number, and password
• Restaurant Partner data: Business name, business address, branding assets (logos, colors, fonts), menu content, and operational settings
• Customer data: Name, email address, phone number, and delivery addresses
• Payment information: Credit and debit card details, which are processed and stored exclusively by our PCI-compliant payment processing partners — Excalibur Interactive does not directly store full card numbers
• Order details: Items ordered, customizations, special instructions, order type (pickup or delivery), and scheduling preferences
• Growth and feedback data: Marketing opt-ins, loyalty activity, promotion usage, review request activity, and private feedback submitted through the Service
• Communications: Support inquiries, contact form submissions, and correspondence with our team
• Staff data: Names, email addresses, roles, and permissions assigned by Restaurant Partners

2b. Information Collected Automatically

• Device and browser information (type, version, operating system)
• IP address and approximate geographic location
• Usage data (pages visited, features used, timestamps, interaction patterns)
• Cookies and similar technologies used for authentication and session management
• Progressive Web App (PWA) installation status
• Error and performance data collected for monitoring and reliability purposes
• Server logs and request data

2c. Information from Third Parties

• Payment transaction confirmations and dispute information from our payment processors
• Delivery status updates from third-party delivery providers
• Authentication and session data from our authentication service provider

2d. Google Business Profile Data

Talos by Excalibur Interactive offers an optional Google Business Profile connection for Restaurant Partners. You authorize access through Google using the Business Profile management permission (business.manage). Talos does not receive your Google password. This connection does not request access to Gmail, Google Drive, or your personal Google contacts.

• Data accessed: Business account and location identifiers; profile names, addresses, phone numbers, categories, website links, descriptions, hours, and profile metadata; menus and photos; reviews, reviewer information supplied by Google, and replies; and performance metrics such as Search and Maps impressions, website clicks, call clicks, and direction requests.
• Purpose: To let you select the correct profile, view its information and performance, and submit the profile edits, hours, menus, photos, and review replies you choose to publish. These submissions are sent to Google and may appear publicly on Google services.
• Storage and security: We store encrypted OAuth access and refresh tokens, permission and connection timestamps, the selected account and location identifiers, the profile name and address, and hours validation and sync timestamps. Tokens allow continued authorized access without asking you to sign in for every request. Data is transmitted over HTTPS, and access within Talos is restricted by restaurant and staff permissions. Other profile content is retrieved when you use the dashboard.

Limited Use: Talos's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We use this data only to provide or improve the Google Business Profile features you use. We do not sell it, use it for advertising, credit decisions, or training general-purpose AI models, or transfer it to data brokers.

Google data is shared only with your authorized restaurant users and service providers as needed to deliver these features with your consent, for security, or as required by law. A business transfer involving Google data requires your prior explicit consent. Our personnel may access it only with your affirmative permission for specific data, for security investigations, or when legally required. These restrictions take precedence over broader uses and sharing described elsewhere in this policy. New uses require notice and renewed consent.

Retention, disconnection, and deletion: Saved connection data remains while the connection is active. Disconnecting the location in Talos removes its saved tokens and connection record from our active database. You can separately revoke Talos's Google authorization in your Google Account connections. Revocation stops further Google access but does not itself delete the saved Talos connection record. To request deletion of Google data retained by Talos, contact support@excaliburinteractive.io. Disconnecting does not delete your Business Profile or content already published on Google. This connection data is excluded from the indefinite retention of Restaurant Partner data described in Section 7.

3. How We Use Your Information

We use the information we collect for the following purposes:

• To provide and operate the Platform, including processing orders and managing accounts
• To process payments and complete transactions
• To facilitate delivery coordination between Restaurant Partners, Customers, and delivery providers
• To send transactional communications, including order confirmations, status updates, and account notifications
• To send marketing, loyalty, promotion, and review-request communications when users opt in or when permitted by law
• To operate feedback recovery, win-back, campaign attribution, and restaurant growth features
• To provide real-time notifications about orders and restaurant operations
• To provide analytics, reports, and business insights to Restaurant Partners
• To improve, optimize, and maintain the Platform
• To monitor for security threats, fraud, and abuse
• To enforce our Terms of Service
• To comply with legal obligations
• To provide customer support

4. How We Share Your Information

4a. With Restaurant Partners

When Customers place orders, their information (including name, delivery address, phone number, and order details) is shared with the Restaurant Partner fulfilling the order. Restaurant Partners can view customer order history within their own Storefront only.

4b. With Service Providers

We share information with third-party service providers who assist us in operating the Platform. These providers are contractually obligated to use your information only for the purposes of providing services to us. Our service providers include:

• Payment processors for payment processing, transaction management, fraud prevention, and dispute handling
• Cloud hosting and infrastructure providers for application hosting, content delivery, networking, and related platform operations
• Database and storage providers for storing and managing application data, files, images, and backups
• Communication providers for transactional and marketing communications, account notifications, and real-time operational updates
• Monitoring and security providers for error tracking, performance monitoring, fraud prevention, rate limiting, and platform security
• Delivery and logistics providers for delivery estimates, dispatch, driver coordination, and order tracking

4c. For Legal and Safety Reasons

We may disclose your information when required by law, subpoena, or court order, or when we believe in good faith that disclosure is necessary to protect the rights, safety, and property of Excalibur Interactive, our users, or the public, or to investigate potential violations of our Terms of Service.

4d. Business Transfers

In the event of a merger, acquisition, reorganization, or sale of all or a portion of our assets, your personal information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal information.

4e. With Your Consent

We may share your information for any other purpose with your explicit consent.

We do not sell your personal information to third parties for advertising or marketing purposes.

Mobile information and SMS consent: We do not share, sell, rent, or transfer mobile phone numbers, SMS opt-in data, or SMS consent with third parties or affiliates for their own marketing or promotional purposes. We may provide this information to service providers acting on our behalf only as needed to deliver and support the text messaging services requested by the Customer.

5. Data Storage and Security

Your data is stored in the United States using industry-standard cloud infrastructure. We employ the following security measures to protect your information:

• Encryption in transit via HTTPS/TLS for all data transmission
• Encryption at rest for sensitive data stored in our database
• PCI DSS-compliant payment processing through our processing partners — we never store full credit card numbers
• Secure password hashing and session management
• Rate limiting to prevent abuse and brute-force attacks
• Role-based access controls to limit data access to authorized personnel
• Regular security monitoring and error tracking

While we implement commercially reasonable security measures, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security of your data. If you believe your account has been compromised, please contact us immediately at support@excaliburinteractive.io.

6. Cookies and Tracking Technologies

We use the following cookies and similar technologies:

• Session cookies: Required for authentication and maintaining your login state across pages
• Preference cookies: Used to remember your settings, such as saved delivery addresses and payment method selections
• Service worker: Used for Progressive Web App (PWA) functionality, including caching assets for faster loading and limited offline capabilities

We do not use third-party advertising cookies or cross-site tracking technologies. Our cookies are used solely for the operation and functionality of the Service.

You can control cookies through your browser settings. However, disabling session cookies will prevent you from logging in and using authenticated features of the Service.

7. Data Retention

We retain your information for as long as necessary to provide the Service and fulfill the purposes described in this policy. Specific retention periods include:

• Account data: Retained while your account is active; deleted upon request after a reasonable processing period
• Order history: Retained for business records, accounting, and legal compliance purposes (typically seven years for financial records)
• Saved payment tokens: Retained while the saved payment method is active; deleted when you remove the saved method
• Server logs and error data: Retained for up to ninety (90) days
• Restaurant Partner data: Restaurant Partners retain access to their business data — including customer information, order history, and financial records — even after cancellation or termination of their subscription. Data is retained indefinitely until the Restaurant Partner requests permanent deletion
• Anonymized and aggregated data: May be retained indefinitely for analytics and platform improvement purposes

8. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete personal data
• Deletion: Request deletion of your personal data, subject to legal retention requirements
• Portability: Request your data in a structured, commonly used, machine-readable format
• Opt-out of communications: Unsubscribe from marketing or promotional emails (note: transactional communications related to your orders and account cannot be opted out of while using the Service)
• Account closure: Request closure and deletion of your account

To exercise any of these rights, please contact us at support@excaliburinteractive.io. We will respond to your request within thirty (30) days.

9. Children's Privacy

The Service is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13 without verifiable parental consent, we will take steps to promptly delete that information.

If you are a parent or guardian and believe that your child under 13 has provided personal information to us, please contact us at support@excaliburinteractive.io so we can take appropriate action.

10. Multi-Tenant Data Separation

The Talos platform operates on a multi-tenant architecture, meaning multiple Restaurant Partners share the same underlying infrastructure while their data remains logically separated. Key data separation principles include:

• Each Restaurant Partner's data (menus, orders, customer interactions) is logically isolated from other Restaurant Partners
• Restaurant Partners can only access data related to their own Storefront and customers who have ordered from them
• Customer accounts may interact with multiple Restaurant Partners; each Partner only sees data from orders placed through their Storefront
• Excalibur Interactive, as the platform operator, has access to all data for the purposes of platform operation, technical support, and legal compliance

Data Ownership Principle: Restaurant Partners retain full ownership and control of their business data at all times. This includes customer contact information, order history, financial records, and analytics. This data remains accessible to Restaurant Partners regardless of subscription status, and Restaurant Partners may request a complete data export at any time. Talos will never hold your data hostage or restrict access to your business information as a result of account cancellation.

11. State-Specific Privacy Rights

California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including:

• Right to know: You may request that we disclose what personal information we have collected, used, disclosed, and sold about you in the past 12 months
• Right to delete: You may request that we delete personal information we collected from you
• Right to correct: You may request that we correct inaccurate personal information
• Right to opt-out of sale: We do not sell your personal information to third parties
• Right to non-discrimination: We will not discriminate against you for exercising your privacy rights

Other State Privacy Laws

Residents of other states with comprehensive privacy legislation (including Virginia, Colorado, Connecticut, Utah, and others) may have similar rights regarding their personal information. To exercise any state-specific privacy rights, please contact us at support@excaliburinteractive.io.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by email or by posting a prominent notice on the Platform prior to the changes taking effect.

The "Last updated" date at the top of this page indicates the date of the most recent revision. Your continued use of the Service after any changes to this Privacy Policy constitutes your acceptance of the revised policy.

13. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: