3Specials Privacy Policy

Last updated: April 1, 2026

This Privacy Policy is designed for a nationwide United States launch covering food and beverage businesses, including restaurants, cafés, bakeries, dessert shops, ice cream shops, bars, food trucks, coffee shops, and similar merchants.

1. Scope and Controller

This Privacy Policy explains how 3Specials LLC (“3Specials,” “we,” “our,” or “us”) collects, uses, shares, and protects personal information when you use our website, mobile applications, progressive web apps, SMS and messaging programs, and related services (collectively, the “Service”).

3Specials is a United States‑based service. Privacy rights and obligations may vary based on where you live, how you use the Service, and which features you choose to use.

This Privacy Policy applies to consumers, business users, and other individuals who interact with the Service, including people who browse public listings, create merchant accounts, claim business profiles, submit support or privacy requests, request removal of a listing, redeem offers, or receive SMS, email, or push communications from us. Reports, removal requests, and privacy requests may be submitted without creating an account; any personal information you include in free‑text fields is collected as part of the submission.

3Specials LLC is the controller of personal information covered by this Privacy Policy, except where a law or contract states otherwise.

2. Who Uses the Service

The Service is used by both consumers and business users.

Consumersbrowse, search, and discover nearby food and beverage businesses and time‑sensitive specials. Consumers may use the Service without creating an account.

Business users(also called “merchants”) include food and beverage businesses such as restaurants, cafés, bakeries, dessert shops, ice cream stores, coffee shops, bars, food trucks, and similar businesses that create, manage, or claim listings or publish offers through the Service.

3. Information We Collect

The categories of personal information we collect depend on how you use the Service and which features you choose to use.

3.1 Contact and identifier information

This may include your name, display name, business name, email address, phone number, postal address, account identifiers, and similar contact details.

3.2 Account, verification, and profile information

This may include login credentials, hashed or tokenized verification data, claim‑verification details, uploaded business‑verification documents (such as business licenses, utility bills, or similar records submitted to verify business authority, address, or identity), business profile information, menu categories, operating hours, and subscription tier details.

3.3 Business content and user‑submitted content

This may include specials, events, offers, business descriptions, messages submitted through dashboards or messaging channels, photos, logos, support requests, reports, claim submissions, listing‑removal requests, and other content you send to us or publish through the Service.

3.4 Public or licensed listing data

We may obtain and display business‑related information from public, licensed, or third‑party sources, such as business names, addresses, categories, and approximate map locations, particularly for public or unclaimed listings.

3.5 Location information

We may process approximate location inferred from IP address or network data. If you allow it, we may process precise geolocation from your device to show nearby businesses, specials, or map results. When you browse or interact with the map, we also receive the visible map area (such as viewport bounds) to fetch relevant listings and points of interest for the area you are viewing.

3.6 Search, map, and engagement information

This may include search queries, selected cuisines or filters, viewport bounds, map interactions, clicks, impressions, redemption‑related activity, and other usage signals.

3.7 Device, app, and technical information

This may include IP address, browser type, operating system, device model, app version, language settings, unique device or installation identifiers, crash data, diagnostics, fraud signals, and log data.

3.8 Payment and billing information

If you purchase a subscription or other paid business feature, our payment processors may collect billing name, billing address, payment method details, and transaction data. 3Specials does not store full payment card numbers.

3.9 Communications information

This may include message content you send to us, SMS delivery status, push token data, support correspondence, consent records, opt‑in and opt‑out records, and communication preferences.

3.10 Browsing‑only data

If you browse 3Specials without creating a merchant account, we collect only limited information such as IP‑derived approximate location, device and browser characteristics, map viewport data, and interaction signals. This information is collected through automated means and is not linked to a named user profile.

4. Sources of Information

We collect information directly from you, automatically from your device or browser, from businesses and users who interact with us, from our service providers, from public or licensed business data sources, and from other lawful third‑party sources.

5. How We Use Information

We use information:

  • to operate, provide, maintain, and improve the Service;
  • to create and manage accounts, listings, and subscriptions;
  • to authenticate users, send one‑time passcodes, and help secure accounts;
  • to display business listings, specials, map results, and nearby recommendations;
  • to process payments, billing, cancellations, and subscription administration;
  • to send transactional, service, and, where permitted, marketing communications;
  • to analyze usage, diagnose errors, monitor performance, and prevent abuse or fraud;
  • to review, moderate, investigate, or respond to claims, reports, and removal requests;
  • to verify business claims, authority, and identity, including by reviewing submitted verification documents;
  • to assist internal review of verification materials using automated tools such as AI or optical character recognition (OCR), for example by extracting, matching, or comparing fields like business name and address;
  • to detect, prevent, and address fraud, impersonation, and unauthorized claims;
  • to comply with law, enforce our Terms of Service, and protect our rights, users, and business partners; and
  • for other purposes we describe at the time of collection or where otherwise permitted by law.

6. How We Share Information

We do not sell personal information for monetary consideration. We do not currently engage in cross‑context behavioral advertising. We do not intentionally share personal information with third parties for the purpose of cross‑context behavioral advertising. For information about how our service providers process data, see our Service Providers and Subprocessors section below.

Certain service integrations involve third‑party data processing that may be characterized differently under various state privacy laws. We are committed to transparency about these data flows and will update this policy as legal guidance evolves. See our Service Providers and Subprocessors section for details.

We may share personal information in the following circumstances:

  • Service providers.With vendors and service providers that help us operate the Service, such as hosting, database, messaging, payment, mapping, analytics, support, security, document‑processing, and AI/OCR‑processing providers.
  • Transactions and verifications. With a business, consumer, or other counterparty when reasonably necessary to complete a requested transaction, redemption, claim, correction, support request, or business‑verification process.
  • Public content. With the public when information is intentionally published through the Service, such as business names, addresses, hours, public listing details, and specials a business chooses to publish.
  • Professional advisors. With advisors, auditors, insurers, investors, and professional service providers under appropriate safeguards.
  • Corporate transactions. In connection with a merger, financing, acquisition, reorganization, bankruptcy, sale of assets, or similar corporate transaction.
  • Legal obligations. When required or permitted by law, regulation, legal process, or to protect rights, safety, and the integrity of the Service.

When a consumer redeems an offer at a merchant location, the merchant receives redemption confirmation, a timestamp, and offer details. The merchant does not receive the consumer’s full account information or contact details through the redemption process unless separately provided by the consumer through another workflow.

Service Providers and Subprocessors

We use the following service providers and subprocessors to operate our platform. Their roles, contractual terms, and data‑processing obligations vary by service. Some providers may also process limited data for their own purposes, such as fraud prevention, as described in their own privacy policies or terms.

CategoryProviderPurposeData Processed
Database, authentication, and storageSupabasePostgreSQL database hosting, user authentication, file storageAll application data including account information, business profiles, and uploaded documents
Payment processingStripeMerchant subscription billing and payment processingMerchant billing name, email, billing address, and subscription information. Payment card details are processed by Stripe through its checkout and billing tools. 
Messaging and phone verificationTwilioSMS delivery, OTP authentication, phone line‑type risk assessmentPhone numbers (E.164), SMS message content, delivery status, phone risk data 
Map rendering and searchMapboxInteractive maps, geocoding, point‑of‑interest searchMap viewport data, search queries, IP address, device information 
Web hostingVercelApplication deployment, edge functions, request routingHTTP request data (URLs, headers, IP addresses)
Transactional emailResendDelivery of operational emails (team invitations, account notifications)Recipient email addresses, email subject and body content
Error monitoring and diagnosticsSentryCrash reporting, error tracking, session replay for debuggingError stack traces, request context; session replay recordings with privacy masking applied
Bot and fraud detectionGoogle reCAPTCHADistinguishing legitimate users from automated activity (when enabled) §Device fingerprint, behavioral interaction patterns, IP address, cookies
Push notification deliveryGoogle FCM (Android), Apple APNs (iOS)Platform transport for push notificationsPush tokens, platform identifiers, routing information
AI text processingAnthropicStructured extraction of restaurant special text; document field extraction (when feature‑flagged)Merchant‑submitted special text (max 500 characters); document images when document analysis is enabled. See Section 10 for details.
Rate limitingUpstashAbuse prevention via sliding‑window rate limitingEphemeral cache keys containing IP addresses or phone numbers; automatically expired after the rate‑limit window closes. No persistent profiles are built.

Stripe and Twilio each process data on our instructions as service providers but may also process limited data in additional capacities under their own terms (for example, Stripe for fraud prevention and regulatory compliance, and Twilio for communications metadata and phone‑number enrichment via third‑party data sources). Their dual roles are governed by their respective commercial terms.

We have disabled optional Mapbox SDK telemetry in our application. Mapbox still receives data necessary to render maps and fulfill search requests.

§Google reCAPTCHA is conditionally enabled and may not be active on all pages or at all times. When active, Google reCAPTCHA collects device and behavioral signals through our pages under Google’s own terms.

Operational subprocessors. We also use Zoho Mail to handle inbound email for operational addresses such as support, legal, DMCA, and accessibility inquiries. Zoho Mail processes personal information contained in emails sent to those addresses.

These providers operate under their own privacy policies in addition to any contractual restrictions we impose. All current service providers listed above are based in the United States. If we engage providers that process personal information outside the United States, we will update this disclosure.

7. Cookies, Local Storage, SDKs, and Similar Technologies

On our website and web app, we use cookies, local storage, session storage, and similar technologies to keep you signed in, remember preferences, store map settings, support fraud prevention, measure performance, and operate browser features.

In our mobile apps, we may use device storage to maintain app‑operation identifiers, cache push‑notification tokens, and store preferences; we also use software development kits (SDKs) and similar technologies to provide map rendering, notifications, and core app features.

The following table summarizes the key technologies we use:

TechnologyProviderPurposeData Collected
Cookies / local storage3Specials (first‑party)Authentication, preferences, map settingsSession tokens, user preferences, viewport data
Session storage3Specials (first‑party)Temporary location data for current sessionApproximate location, viewport bounds
reCAPTCHAGoogleBot and fraud preventionDevice signals, interaction patterns
Map SDKMapboxMap rendering, points of interestViewport data, search queries, usage diagnostics
Error monitoringSentryCrash reporting, diagnosticsError data, device info, limited interaction data
Push deliveryFirebase (Google) / APNs (Apple)Push notification transportPush tokens, platform identifiers

You can manage some of these technologies through your browser, device, or app settings, but disabling them may reduce functionality.

8. Precise Geolocation and Sensitive Data

If you choose to allow device location, we may process precise geolocation to show nearby businesses, refine map results, and support location‑aware features. We treat precise geolocation as sensitive data where applicable law requires that treatment.

We request precise location only through your device, browser, or app permission flow. You can deny or withdraw location access at any time in your device, browser, or app settings, though some location‑based features may then work less effectively or not at all. Even without precise location permission, the map area you navigate to is used to load relevant content for that area.

Dietary and allergen filters. Dietary or allergen filter selections are processed only for the current browsing session and are not saved to a user profile or persistent consumer record.

9. SMS, Email, and Push Notifications

Transactional communications. We may send transactional or service‑related communications needed to operate accounts and requested features, including login codes, account security alerts, claim or redemption updates, billing notices, and support messages.

Marketing communications. Marketing communications by SMS, email, or push are optional where required by law. Where required, we will obtain the consent needed for those messages.

SMS program. Message frequency may vary. Standard message and data rates may apply. You may opt out of marketing texts by replying STOP. You may request help by replying HELP where that keyword is supported. Opting out of marketing messages does not prevent us from sending necessary transactional or security messages. For complete SMS/text messaging program terms, including carrier disclaimers, see our SMS/Text Messaging Terms.

Email.Where applicable, commercial emails we send will identify 3Specials as the sender, include our physical mailing address, and provide a working unsubscribe mechanism. We will honor email opt‑out requests within 10 business days.

Push notifications. If you enable push notifications, you consent to receive notifications through your device consistent with your settings and applicable law. You may disable push notifications through your device or application settings.

10. AI Processing and Automated Tools

We may use automated tools, including AI and optical character recognition (OCR) providers, to help classify, summarize, extract, structure, or compare business‑submitted content. This may include specials, listings, and business‑verification documents or related submission materials.

For business‑verification documents, AI or OCR tools may be used to extract, classify, or compare fields such as business name, address, or business identifiers to assist our internal review of claims and verification submissions. This processing is advisory and assistive only. We do not rely on AI or OCR output as the sole basis for approving, rejecting, or suspending a business claim, listing, or account. Human review may occur, and we may request additional information or documentation before making a determination.

We do not use AI, OCR, or other automated tools to collect, create, or store biometric identifiers such as facial geometry, fingerprints, voiceprints, or retina scans. Our document verification processes extract text fields only (such as business name and address) from business licenses and utility bills. We do not currently process driver’s licenses, passports, or government photo identification documents.

We do not use AI or automated‑tool processing to make legal, employment, housing, credit, insurance, or similarly significant decisions about consumers.

Our AI processing is provided by Anthropic. Anthropic acts on our behalf under its commercial data‑handling terms. Anthropic may retain submitted data for a limited period under its commercial terms before automatic deletion.

AI output retention. AI‑generated outputs (such as structured special text and expiration times) are retained in our database as part of the restaurant special record. Document analysis outputs are not retained; they are used only during the verification review session.

Model training.We do not use, and do not permit our AI service providers to use, merchant content or business‑verification documents to train, fine‑tune, or develop generalized AI models without explicit, separate, prior written consent.

11. Your Privacy Rights and Choices

Depending on your state of residence and applicable law, you may have some or all of the following rights regarding your personal information:

RightDescription
Access / KnowRequest confirmation of whether we process your personal information and, if so, access to or a copy of that information.
CorrectionRequest that we correct inaccurate personal information we maintain about you.
DeletionRequest that we delete personal information we collected from or about you, subject to legal exceptions.
PortabilityRequest a copy of your personal information in a structured, commonly used, machine‑readable format.
Opt out of targeted advertisingWhere applicable, request that we stop processing your personal information for targeted advertising purposes.
Opt out of sale or sharingWhere applicable, request that we stop selling or sharing (as those terms are defined by applicable law) your personal information.
Opt out of profilingWhere applicable, request that we stop using your personal information for profiling in furtherance of decisions that produce legal or similarly significant effects.
Limit sensitive data processingWhere applicable, request that we limit our use of sensitive personal information to uses that are necessary to provide the Service.
AppealIf we deny a privacy request, you may appeal the decision as described below.

Not all rights are available in every state. We will apply the rights that are required by the law of your state of residence. The following state‑specific information supplements the general rights described above. Whether a particular state law applies to 3Specials depends on factors such as revenue, consumer count, and other statutory thresholds that may not yet be met. We include this information for transparency and will update it as our operations grow.

State‑specific privacy rights

Texas(Texas Data Privacy and Security Act). If the TDPSA applies to 3Specials, Texas residents may exercise the rights listed in the table above. We process one category of sensitive personal information — precise geolocation — only with your opt‑in consent, consistent with TDPSA requirements. We honor Global Privacy Control as a universal opt‑out mechanism as contemplated by the TDPSA.

Colorado(Colorado Privacy Act). If the CPA applies to 3Specials, Colorado residents may exercise the rights listed above, including the right to opt out of targeted advertising and profiling. We honor Global Privacy Control as a universal opt‑out mechanism as required by the CPA. You may also appeal a denied privacy request as described below.

Connecticut(Connecticut Data Privacy Act). If the CTDPA applies to 3Specials, Connecticut residents may exercise the rights listed above, including the right to opt out of targeted advertising, sale of personal data, and profiling. We honor Global Privacy Control as a universal opt‑out mechanism as required by the CTDPA. You may appeal a denied request as described below.

Virginia (Virginia Consumer Data Protection Act). If the VCDPA applies to 3Specials, Virginia residents may exercise the right to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of targeted advertising, sale, and profiling. The VCDPA is enforced by the Virginia Attorney General; it does not provide a private right of action. You may appeal a denied request as described below.

Utah (Utah Consumer Privacy Act). If the UCPA applies to 3Specials, Utah residents may exercise the right to access, delete, and obtain a portable copy of their personal data, and to opt out of targeted advertising and sale. The UCPA does not include a right to correct personal data or to opt out of profiling.

Other states with comprehensive privacy laws. Several additional states have enacted comprehensive consumer privacy laws, including Oregon, Montana, Maryland, Delaware, New Hampshire, New Jersey, Tennessee, Minnesota, Indiana, Kentucky, Rhode Island, Nebraska, and Iowa. If any of these laws apply to 3Specials based on applicable thresholds, residents of those states may exercise some or all of the rights listed in the table above, as provided by their state’s law. Where a state requires recognition of a universal opt‑out mechanism, we honor Global Privacy Control. For details on California‑specific rights, see Section 12 below.

How to submit a request. You may submit privacy requests through our online privacy request form or by emailing support@3specials.com. You do not need a user account to submit a request.

Verification. We may ask you to verify your identity before we act on a request. For requests submitted by individuals without a merchant account, we may ask for information that allows us to match you to data we hold. If we cannot reasonably verify your identity, we will explain why.

Authorized agents. Where applicable law permits, you may designate an authorized agent to submit a request on your behalf. We may require the agent to provide written authorization from you and may separately verify your identity.

Response timeline. We will acknowledge your request promptly and will respond within 45 days of receipt. If we need additional time, we will notify you of the extension (up to an additional 45 days) and explain the reason.

Appeal. If we deny your request in whole or in part, we will explain the reason and inform you of your right to appeal where applicable law provides one. To appeal, contact legal@3specials.com with the subject line “Privacy Appeal,” or submit a new request through the privacy request form. You may also contact support@3specials.com for assistance. We will respond to appeals within the timeframe required by applicable law, generally within 45 days.

Non‑discrimination. We will not discriminate against you for exercising your privacy rights.

Do Not Track (DNT). We do not respond to Do Not Track browser signals, as there is no industry‑standard protocol for DNT compliance.

Global Privacy Control (GPC). We recognize and honor Global Privacy Control signals. When we detect that your browser is sending Sec‑GPC: 1, we treat it as a valid opt‑out of the sale or sharing of personal information under applicable state privacy laws. As described in Section 6, we do not currently sell personal information or engage in cross‑context behavioral advertising. If we introduce any such data flows in the future, your GPC signal will automatically apply to suppress them. You can enable GPC in supported browsers or extensions; no additional action on our platform is required. You may also submit privacy requests through our privacy request form or support@3specials.com.

12. Additional Information for California Residents

If 3Specials is subject to the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), California residents may have additional rights as described in Section 11 above. This section provides supplemental information that may be required under California law.

Categories of personal information collected

The following table summarizes the categories of personal information we may collect, our purposes, sale/sharing status, and general retention criteria.

Category (CCPA)ExamplesPurposeSold?Shared for Cross‑Context Behavioral Advertising?Retention
IdentifiersName, email, phone, account IDAccount management, authentication, communicationsNoNoLife of account + 1 year
Commercial informationSubscription tier, billing history, transaction recordsBilling, subscription managementNoNoGenerally 7 years
Internet or electronic network activityIP address, browser type, device info, search queries, map interactionsService operation, analytics, fraud prevention, diagnosticsNoNot intentionally (see Section 6)Generally 13 months
Geolocation dataPrecise location (with permission), IP‑derived approximate location, map viewportMap features, nearby resultsNoNoSession‑only for browsing; generally 13 months for analytics
Professional or employment‑related informationBusiness name, business address, verification documentsBusiness claim verificationNoNoGenerally 90 days after claim decision (documents); life of account (profile data)
Sensory dataPhotos, logos uploaded by merchantsListing displayNoNoLife of account + 1 year
InferencesEngagement patternsService improvementNoNoGenerally 13 months

Sale and sharing.We do not sell personal information for monetary consideration. We do not currently engage in cross‑context behavioral advertising and do not intentionally share personal information with third parties for the purpose of cross‑context behavioral advertising. Certain service integrations (such as Google reCAPTCHA, Mapbox, and error‑monitoring tools) involve third‑party data processing that may be characterized differently under the CCPA/CPRA. We are committed to transparency about these data flows and will update this disclosure as legal guidance evolves. See Section 6 for details on our service providers.

Sensitive personal information. The only category of sensitive personal information we may process is precise geolocation, and only when you grant device‑level permission. We use precise geolocation to provide location‑based features.

Financial incentive programs. We do not currently offer financial incentive programs that require CCPA/CPRA disclosure.

13. Children’s Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13 without legally required consent. If we learn that we collected personal information from a child under 13 in a manner not permitted by law, we will take steps to delete that information. Parents or guardians who believe a child provided personal information to us may contact support@3specials.com.

14. Data Retention

We retain personal information for as long as reasonably necessary for the purposes described in this Privacy Policy. The following table provides general retention guidance by data category. Actual retention may be shorter or longer based on legal requirements, dispute resolution needs, or fraud prevention.

Data CategoryGeneral Retention Guidance
Merchant account and profile dataLife of account plus generally 1 year after deletion or termination
Special edit history and audit recordsPersonal information within submitted text is automatically anonymized after 1 year; records are permanently deleted when the associated merchant account is deleted
Business‑verification documentsGenerally 90 days after claim decision, unless longer retention is needed for fraud prevention or dispute resolution
Billing and payment recordsGenerally 7 years (consistent with tax and financial recordkeeping practices)
SMS consent and opt‑out recordsGenerally 5 years from date of consent or opt‑out event
Privacy request recordsGenerally 3 years from date of request resolution
Analytics and engagement dataGenerally 13 months from collection
Server logs and diagnosticsGenerally 90 days
Browsing‑only data (non‑account visitors)Generally 13 months or less, depending on data type

We maintain an edit history of specials posted by merchants, including the original submitted text, for operational integrity, content‑moderation review, and dispute resolution purposes. Personal information within submitted text is automatically anonymized after one year. Edit history records are permanently deleted when a merchant account is deleted.

Business‑verification documents and related records may be purged in accordance with our internal retention schedule. Internal notes, extracted data, or review records derived from verification materials may be retained separately for fraud prevention, compliance, dispute resolution, and recordkeeping purposes. Third‑party service providers involved in document processing may retain submitted data for a limited period under their own commercial data‑handling terms.

15. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, or alteration. Sensitive materials such as uploaded business‑verification documents are stored in access‑controlled systems with restricted administrative access. No service can guarantee absolute security.

16. Breach Notification

If we become aware of a reportable security incident involving personal information, we will notify affected individuals and applicable regulators within the timeframes required by applicable state breach notification laws, and in no event later than the deadlines imposed by the laws of affected individuals’ states of residence.

17. Cross‑Border and Interstate Processing

3Specials operates in the United States and uses service providers that may process information in different U.S. states and, in some cases, outside the United States. By using the Service, you understand that your information may be transferred to and processed in locations where privacy laws may differ from those in your home jurisdiction.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will post the revised version and update the “Last updated” date. If a change is material, we may provide additional notice through the Service, by email, by SMS, or by another reasonable method where required by law.

19. Contact Us

For privacy questions or requests, use our privacy request form or contact support@3specials.com.

For formal legal or privacy correspondence: legal@3specials.com.

If you have a complaint about our privacy practices, please contact us using any of the methods above. We will investigate and respond to your concern. If you are not satisfied with our response, you may have the right to file a complaint with your state attorney general or other applicable regulatory authority, including:

3Specials LLC | Haslet, Texas 76052 | United States

© 2026 3Specials LLC. All rights reserved.