Privacy Policy

1. Who We Are

Uncle J's Dirty Apron BBQ ("we", "us", or "our") operates the website unclebbq.com and provides online ordering, rewards, catering inquiry, customer support, and careers services. Our restaurant is located at 3202 Theodore Street, Joliet, IL 60431.

2. Information We Collect

We collect information you provide directly to us, including:

• Account profile information such as your name, email address, account identifiers, and sign-in information handled through our authentication provider, Clerk
• Billing and delivery address when you place an order
• Payment card details (processed securely by Stripe — we never store raw card numbers)
• Order history and preferences
• Messages you send through our contact form, support portal, or by email reply to a support ticket
• Any resume or background information you upload when applying for a position through our careers portal
• Responses you provide during an AI screening interview, including the text of your answers and the conversation transcript
• Messages sent to our AI support helper and information you include in those conversations
• Feedback reports, diagnostic events, and session-replay information about interactions with the site

We also automatically collect certain technical information when you visit our site, including your IP address, browser type, device identifiers, and pages visited. This information is used to provide the service, detect and prevent fraud, and improve our platform.

During AI screening interviews on our careers portal, we may passively collect behavioral signals such as response timing and input patterns solely to verify that submissions are made by a human applicant rather than an automated system. Raw signals are subject to our end-of-session retention commitment. Screening-integrity indicators, such as detected automated responses, may be included in the hiring summary. See Section 8 for the retention commitments and enforcement-review notice.

3. How We Use Your Information

• Process and fulfill your orders
• Send order confirmation and status emails
• Manage your rewards account and points balance
• Respond to your questions, contact form submissions, and support tickets — including replies you send directly by email
• Route and store incoming support email replies within your ticket conversation
• Conduct AI-assisted initial screening of job applications and log screening outcomes for review by our hiring team
• Provide AI-assisted customer support and monitor AI prompts and responses for troubleshooting and service quality
• Allow authorized staff to review tickets and hiring records, and record staff actions for operational accountability
• Detect, prevent, and investigate fraud and unauthorized access
• Improve our menu, website, and services
• Send you marketing text messages if you have opted in to SMS updates (you may opt out at any time by replying STOP or clicking the unsubscribe link in any message)
• Notify you of material updates to our policies (via email, where you have provided one)
• Comply with legal obligations and prevent fraud

We do not sell your personal information to third parties.

4. Fraud Detection & Security

We use automated systems to detect and prevent fraudulent orders and account activity. This includes:

• Logging IP addresses associated with checkout and account activity
• Rate limiting repeated checkout attempts from the same IP address
• Automatically blocking IP addresses that trigger our fraud thresholds via Cloudflare
• Alerting our operations team to suspicious activity in real time
• Using Cloudflare Turnstile (a privacy-preserving bot-detection challenge) to verify that users interacting with certain features — including our AI hiring screener — are human

Our published retention limit for IP address data collected for fraud prevention is up to 90 days, and its use is limited to security purposes. Verification of time-based cleanup is part of the enforcement review described in Section 8.

5. Third-Party Services

We use trusted third-party services to operate the site. Each has its own privacy practices:

• Stripe — payment processing
• DoorDash — third-party delivery fulfillment
• Clerk — secure account authentication
• Resend — transactional email delivery, including outbound support replies and inbound email parsing for the support ticket system
• Vonage — SMS text message delivery (used for account verification codes and opt-in marketing messages)
• Cloudflare — database and backup storage through Cloudflare D1, AI processing for Pitmaster Helper and our support chat through Workers AI, along with configured security services such as WAF, IP fraud blocking, and Turnstile bot-detection challenges. Relevant prompts, chat messages, and menu, order, or support context may be sent to Workers AI. Stored records may include orders, support conversations, uploaded resumes, and account or marketing-preference records
• Replit — application hosting and infrastructure used to operate the site and its service connections
• Sentry — error and performance monitoring, session replay, user feedback, and AI diagnostics. Data may include browser and device information, page activity, diagnostic logs, feedback you submit, and AI conversation prompts and responses. Personal information included in those inputs or logs may be processed by Sentry; this data is not necessarily anonymous
• Google Maps — location and directions
• HuggingFace — AI processing for our hiring screener. Relevant prompts, interview conversation text, and resume or other context supplied to that feature may be sent to the AI service, subject to the provider's data handling policies
• Google Sheets — internal transaction and hiring records. Hiring entries may include candidate name, position, screening result, suggested position, screening-integrity indicators, conversation summary, and a link to an uploaded resume
• Google and LinkedIn — account connection or sign-in services when you choose an available integration. Profile information shared with us depends on the feature and the permissions you grant
• Social media platforms — when you visit our linked social accounts, use an embedded media feature, or contact us through an available social messaging channel, that platform processes your interaction under its own privacy practices. Messages provided through a connected support channel may also be processed to respond to you

When you choose delivery through DoorDash, your name, address, and order details are shared with DoorDash to complete delivery. Please review their privacy policy at doordash.com.

When you use an AI support or hiring feature, relevant conversation content is processed by Cloudflare Workers AI and may also appear in Sentry AI diagnostics. Please avoid including sensitive information that is not needed for your request or application. Providers' own policies and configured retention settings also apply to copies held in their systems.

Our authorized staff may access relevant customer or applicant records through internal tools, including a self-hosted Frappe staff portal when enabled. Access is intended for service, hiring, and administrative work; staff action records may include the acting staff member's name, email address, and the action taken.

6. Support Ticket Email Parsing

When our team sends you a support reply by email, you may respond directly from your email client. Our system automatically receives that reply, extracts the new text you typed (above the "Reply above this line" separator), and appends it to your open support ticket. The quoted copy of the original email — which your email client includes below the separator — is discarded and not stored. Only the content of your new message is saved. By replying to a support email you consent to this processing.

7. Cookies

We use cookies and similar technologies to keep you signed in, remember your cart, and analyze site traffic. You can manage your cookie preferences at any time using the cookie settings panel on our site. Essential cookies (required for the site to function) cannot be disabled. Analytics and marketing cookies are optional and require your consent.

The cookie settings panel records your preferences. Server-side security and operational logs may continue independently of cookie choices. The October review also identified that Sentry session monitoring currently initializes independently of the stored cookie preferences; enforcement of the optional-monitoring consent commitment requires separate remediation. This notice does not replace consent where it is required.

8. Data Retention

We retain your account information and order history for as long as your account is active or as needed to provide services. Our existing published retention commitments remain unchanged: support ticket conversations are retained for up to two years after the ticket is closed; raw hiring screening session data (behavioral signals and resume content) is not to be retained after the screening session ends; the screening outcome summary is retained for up to one year; and fraud detection logs are retained for up to 90 days.

Retention-review notice: these deadlines are policy commitments, not a statement that deletion of every copy is currently automated. The October review confirmed that uploaded resumes are stored in our database and identified gaps in verifying enforcement of the stated cleanup periods, including provider-held records and backups. Records may remain beyond the stated limits while those gaps are addressed. This review does not extend the deadlines or authorize additional retention.

You may request access or deletion through our privacy-rights portal or by contacting us. We may need to verify your identity. Account deletion removes selected linked records and anonymizes identifiers on matching orders; financial transaction records and support or application records may require separate review. Information that must be retained for legal obligations or a dispute may be kept as permitted by applicable law.

9. Children's Privacy

Our website is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with their information, please contact us and we will delete it promptly.

10. Your Rights

Depending on your location, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your account and personal data, subject to identity verification and applicable legal exceptions
• Request a copy of your support ticket history or screening summary
• Opt out of marketing email communications at any time using the unsubscribe link in any message
• Opt out of SMS marketing at any time by replying STOP to any text we send, or clicking the opt-out link included in every marketing message

To request an export, review your support-ticket history, or begin verified account deletion, visit our privacy-rights portal. For corrections, hiring-record requests, retention concerns, or other rights requests, contact us at legal@unclebbq.com.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Where you have provided an email address and the change is material, we will send you a notification. Where consent is required for a new use of your information, continued use of the site does not replace that consent.

12. Contact Us

If you have any questions about this Privacy Policy, please reach out: