Effective date and last updated: September 29, 2026
This Privacy Policy explains how Cars Bikes N Bites LLC, a Utah limited liability company ("CBB," "we," "us," or "our"), collects, uses, discloses, and protects personal information in connection with the CBB platform — our web and mobile application, client and vendor portals, galleries, and related services (the "Service"). It applies to clients, vendors, ambassadors, sales representatives, staff, people who view shared galleries, and people who appear in photos delivered through the Service. It is also our notice at collection for California residents.
The short version
- We do not sell your personal information, and we have not sold it in the past 12 months.
- We do not share your personal information for targeted or cross-context behavioral advertising, and the Service shows no ads.
- The Service uses no third-party analytics, advertising cookies, or tracking pixels.
- We do not use facial recognition or collect biometric data from photos.
- We do not use your personal information to train artificial intelligence or large language models.
- You can see, download, correct, or delete your information — including deleting your own account from Account settings.
1. Personal Information We Collect
| Category | Examples | Source |
|---|---|---|
| Identifiers | Name, email address, phone number, mailing address, Instagram handle, account ID, IP address | You; a sign-in provider (Google or GitHub) if you choose to use one; automatically from your device |
| Customer records (Cal. Civ. Code § 1798.80(e)) | Name, address, phone number, payment-related records | You; our payment processor |
| Commercial information | Bookings, packages, tickets and products purchased, invoices, payment history | You; vendors and staff handling your booking |
| Event information | Events and meets you RSVP to, your RSVP and check-in status, and the vehicle you say you're bringing | You; the event's host or staff |
| Internet or other electronic network activity | Sign-in events, features used, timestamps, browser and device type | Automatically from your device |
| Audio, visual, or similar information | Photos and videos you upload or that are delivered to you; profile photo | You; the photographer, vendor, or client who uploads them |
| Professional information | For vendors, ambassadors, and sales representatives: business name, services offered, website and social links, rates and commissions | You; staff |
| Sensitive personal information | Account login credentials (your password is stored only as a salted hash); information an event form asks for with your consent, such as a driver's license number or emergency, medical, or health information relevant to your safety at an event | You |
| Approximate location | General (city or region) location derived from your IP address | Automatically from your device |
We do not collect Social Security numbers, precise geolocation, biometric identifiers, genetic data, or financial account log-in credentials, and we do not ask about racial or ethnic origin, religion, union membership, sexual orientation, or citizenship or immigration status. We do not create inferences or profiles about your preferences or characteristics. Payment card and bank details are collected and stored by our payment processor (Stripe); we receive only limited information such as transaction status, amount, and the last four digits of a card.
2. How We Use Personal Information
- To provide and operate the Service: accounts, bookings, galleries and media delivery, invoicing, payments, and agreements and signatures;
- To communicate with you about your account, bookings, agreements, security codes, and support requests, including by email, text message, and phone;
- To keep the Service secure, prevent fraud and abuse, and fix problems;
- To comply with legal obligations, enforce our Terms of Service, and establish or defend legal claims;
- To maintain and improve the Service using our own records; and
- For any other purpose we describe to you when we collect the information, with your consent where the law requires it.
We collect and use only the personal information that is reasonably necessary and proportionate for these purposes. We do not use personal information for targeted advertising, to sell it, to make decisions about you that produce legal or similarly significant effects through automated profiling, or to train artificial intelligence or large language models. Sensitive personal information is used only to authenticate you or for the specific event purpose you consented to.
3. How We Disclose Personal Information
| Recipient | Categories of personal information | Purpose |
|---|---|---|
| Service providers and processors: cloud hosting, storage, and security (Cloudflare) | All categories listed in Section 1 | Hosting and securing the Service |
| Service providers and processors: email and text message delivery | Identifiers; communications | Sending account and transactional messages |
| Service providers and processors: payment processing (Stripe) | Identifiers; customer records; commercial information | Processing payments and payouts |
| Sign-in providers (Google, GitHub), only if you choose to sign in with them | Identifiers | Signing you in |
| Other users, as part of how the Service works | Identifiers; commercial information; visual information | Vendors, photographers, and staff handling your booking; gallery recipients or the public when a gallery, listing, or ambassador profile is shared or published |
| Meet Hosts — the independent host of any meet you RSVP to | Identifiers (name, email address, phone number); what you said you're bringing; your RSVP and check-in status | Letting the host accept your RSVP, check you in, and contact you about their meet. The host keeps your details in their contacts and must use them only for their meets, never sell or share them, and delete them on your request |
| Government authorities, courts, and legal advisers | Any category, as required | Complying with law and legal process, and protecting rights and safety |
| A buyer or successor | Any category | A merger, acquisition, financing, or sale of assets, subject to this Policy |
In the preceding 12 months, we disclosed the categories of personal information above, for the business purposes above, to the categories of recipients above. Our service providers and processors are bound by contract to use personal information only to provide services to us. On request, we will give you a list of the specific third parties to which we have disclosed personal information.
4. We Do Not Sell or Share Your Personal Information
We do not sell personal information, and we do not share it for cross-context behavioral or targeted advertising. We have not done either in the preceding 12 months, and we have no actual knowledge of selling or sharing the personal information of anyone under 16. We do not sell sensitive personal information, precise geolocation, or the personal information of minors, and we do not sell personal information to data brokers or to government agencies.
Opt-out preference signals. We treat a Global Privacy Control (GPC) signal from your browser as a valid request to opt out of the sale and sharing of personal information and of targeted advertising, for that browser and for any account we know is associated with it. Because the Service does not track you across other websites or show ads, there is no cross-site tracking for a "Do Not Track" signal to turn off; we treat a Do Not Track signal the same way as a GPC signal.
5. Cookies and Similar Technologies
The Service uses your browser's local storage to keep you signed in and to remember your display theme. These are strictly necessary for the Service to work. We do not use advertising cookies, third-party analytics, or social media pixels. Our hosting provider, Cloudflare, may set strictly necessary security cookies to protect the Service against bots and abuse.
6. Photos and the People in Them
The Service delivers event, vendor, and portrait photography, so galleries may include people who do not have an account, including, at some events, minors. The photographer, vendor, or client who uploads a photo is responsible for obtaining any consent or model release the law requires. We do not run facial recognition on photos, and we do not create face templates, faceprints, or other biometric identifiers from them. If you appear in a photo on the Service, or you are the parent or guardian of a minor who does, you may ask us to review and remove it by emailing tobin@carsbikesnbites.com.
7. How Long We Keep Personal Information
| Information | How long we keep it |
|---|---|
| Account information (name, email, phone, address, profile photo, Instagram handle, password) | While your account is open. When you delete your account, we remove this information from your account record immediately; residual copies in routine backups expire on our provider's backup schedule, generally within 30 days. |
| Bookings, invoices, orders, and payment records | Seven years after the transaction, for tax, accounting, and legal purposes |
| Signed agreements and records of your acceptance of these policies | For as long as the agreement is relevant, plus up to seven years after our relationship ends, to establish or defend legal claims |
| Photos, videos, and galleries | Until deleted by the account that owns the gallery, until a gallery expires, or until removed at your request |
| Security and sign-in logs | Generally no longer than 12 months, unless needed to investigate an incident |
| Support and other communications | Up to three years |
| Event form information you provided with consent, including any health or safety information | No longer than one year after the event, unless the law requires otherwise or you ask us to delete it sooner |
8. Your Privacy Rights
We extend the following rights to everyone who uses the Service, wherever you live, and at minimum as your state's law requires:
- Access and know — confirm whether we process your personal information and get the categories and specific pieces we hold, where it came from, why we use it, and who we disclosed it to, including a list of specific third parties on request;
- Portability — get a copy of your information in a portable, readily usable format;
- Correction — correct inaccurate information (much of it you can edit yourself in Account settings);
- Deletion — delete your personal information (you can delete your account yourself from Account settings), subject to the records we must keep by law;
- Opt out of the sale or sharing of personal information, targeted advertising, and profiling that produces legal or similarly significant effects — we do none of these, but you may still submit a request and we will record it;
- Limit or withdraw consent for sensitive personal information or any other processing based on your consent;
- Non-discrimination — we will not deny you service, charge you a different price, or otherwise retaliate against you for exercising these rights.
Meet Hosts. To stop a Meet Host contacting you or have them delete your details, ask the host directly or email us and we will require them to. Cancelling your RSVP does not by itself remove you from a host's contacts.
How to submit a request. Email tobin@carsbikesnbites.com with the subject line "Privacy Request," or use the tools in Account settings. To protect your information, we verify requests by confirming they come from the email address on your account or by asking you to confirm details we already have; we use the information you provide only for verification. You may use an authorized agent, who must provide your signed permission; we may still verify your identity directly with you. A parent or guardian may make a request on behalf of a minor. We confirm receipt within 10 business days and respond within 45 days, and if we need more time (up to another 45 days) we will tell you why. Requests are free.
Appeals. If we decline your request in whole or in part, you may appeal by emailing tobin@carsbikesnbites.com with the subject line "Privacy Request Appeal." We will respond in writing within 45 days, explaining what we did and why. If we deny your appeal, you may contact your state's Attorney General, and our response will tell you how.
9. State-Specific Information
California. This Policy is our privacy policy and notice at collection under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and describes the categories of personal information we collect, their sources, our purposes, the categories of recipients, and how long we keep each category. We use sensitive personal information only for purposes the regulations permit, so we do not offer a separate right to limit it. If we offer a referral or reward program that involves your personal information, we will give you a notice of financial incentive before you join, and you may withdraw at any time. Under California's "Shine the Light" law (Civil Code § 1798.83), we do not disclose personal information to third parties for their own direct marketing purposes. California residents under 18 may ask us to remove content they posted by emailing tobin@carsbikesnbites.com.
Utah. Utah residents have the rights to access, correct, delete, and obtain a portable copy of their personal data and to opt out of targeted advertising and the sale of personal data.
Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Virginia, and, when their laws take effect, Louisiana, Oklahoma, Alabama, and Vermont. Residents of these states have the rights described in Section 8, including the right to appeal. We do not process sensitive data without consent, we do not sell sensitive data, biometric data, or precise geolocation, we do not process minors' personal data for targeted advertising or sale, and we do not use personal data to train large language models. Minnesota residents may also question the result of profiling; we do not profile consumers.
Nevada. We do not sell covered information as defined in Nevada law. You may still submit an opt-out request to tobin@carsbikesnbites.com.
Washington, Nevada, and Connecticut consumer health data. See our Consumer Health Data Privacy Policy.
Biometric privacy (including Illinois, Texas, Washington, and Colorado). We do not collect, capture, store, or use biometric identifiers or biometric information. If that ever changes, we will obtain your written consent first and publish a retention and destruction schedule.
10. Children and Teens
The Service is not directed to children or teens, and accounts are available only to people 18 and older. We do not knowingly collect personal information directly from anyone under 18 through the Service, and we do not sell or target advertising to minors. Photos of minors may appear in event galleries, uploaded by adults as described in Section 6. If you believe a child has given us personal information, email tobin@carsbikesnbites.com and we will delete it.
11. Security and Data Breaches
We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, salted and hashed passwords, and encryption at rest for sensitive fields such as your mailing address. No system is completely secure. If a security breach affects your personal information, we will notify you and the appropriate authorities as required by the data breach notification laws of your state.
12. International Users
The Service is operated in and intended for users in the United States. If you use it from elsewhere, your information will be processed in the United States.
13. Changes to This Policy
We will post any changes here and update the effective date. When we make material changes, we will notify you in the app and ask you to review them before you continue using the Service.
14. Contact Us
Cars Bikes N Bites LLC, Utah, USA — tobin@carsbikesnbites.com. If you need this Policy in an alternative format because of a disability, email us and we will provide it.