Privacy policy

What we collect

We only ask for what the kitchen needs to make your food and give it to the right person.

When you place an order

• Name for pickup, so we can call it out at the counter.
• Phone number, so we can reach you if something changes with your order.
• Email address, only if you choose to add one.
• Your order: the items, the options you picked, any special requests you typed, the tip, whether you chose ASAP or a scheduled pickup time, and how you chose to pay.

When you pay by card

Card details go into secure fields hosted by Shift4, our payment processor. Your card number, expiry date and security code never reach our servers and we can't see them. Shift4 sends back a charge id, the card brand and the last four digits, and that is all we keep.

When you visit the site

Like almost every website, our hosting provider keeps short-lived server logs with technical details such as your IP address, browser type and the pages requested. We use them only to run and protect the site. We don't run analytics scripts or advertising trackers, we don't ask you to create an account, and we don't track your location.

How we use it

We use your details to:

• make your order and hand it to the right person at the counter;
• call or text you about that order, for example if something sold out or you haven't turned up;
• take your payment and issue a refund if one is due;
• keep the records a business has to keep for accounting and tax;
• spot and stop fraud or abuse of the site.

That's the whole list. We don't send marketing emails or texts, and we don't build profiles or make automated decisions about you.

Who we share it with

We don't sell your information and we don't share it with advertisers. It goes to the people and services below, and to nobody else unless the law requires it.

Swipe sideways to see the whole table.

We may also share information if we're legally required to, for example in response to a valid court order, or to protect the safety of our staff and customers.

How long we keep it

Order records

As long as we need them for accounting and tax purposes.

Card details

Never held by us. Only the Shift4 charge id, card brand and last four digits stay with the order record.

Your cart

In your own browser, not on our servers, until you place the order or clear it.

Server logs

Kept briefly by our hosting provider, then discarded.

Cookies and local storage

We keep this very light.

Your cart

Saved in your browser's local storage (under the name phantom-burger-cart) so it survives a refresh. It never leaves your device until you place the order, and it's cleared once the order is placed.

Order status link

Your confirmation link contains a private token that lets you see that one order. Anyone with the link can see it, so don't share it.

Kitchen sign-in

Staff sign in to the kitchen board with a PIN, which sets a cookie on their device for 12 hours. It is never set for customers.

Advertising and analytics

None. No ad cookies, no third-party analytics scripts, no social media pixels.

Your choices and rights

New Jersey's Data Privacy Act gives you rights over your personal information, and we honor them for everyone, wherever you live.

• See it. Ask what we hold about you and get a copy in a usable format.
• Fix it. Ask us to correct a name, number or email we got wrong.
• Delete it. Ask us to delete your details. We'll do that, except for the parts of an order record we have to keep for tax and accounting.
• Opt out. You can opt out of the sale of your data, targeted advertising and profiling. We don't do any of those, so there is nothing to opt out of, but the right is yours.

To use any of these, contact us with the name and phone number on the order and, if you have it, the order number. We match the details against the order so we know the request is really yours. We'll respond within 45 days, as the law requires. If we turn a request down we'll tell you why, and you can appeal by writing back to us. If you're still not satisfied, you can contact the New Jersey Division of Consumer Affairs.

Children

This site isn't directed at children under 13, and we don't knowingly collect information from them. If you think a child has given us their details, contact us and we'll delete them.

Security

• Every page is served over HTTPS, so what you type is encrypted on its way to us.
• Card entry happens inside Shift4's secure fields. Shift4 is a PCI DSS compliant payment processor, and card numbers never touch our servers.
• Only our server can read the database, using a key that is never sent to your browser.
• Order pages are protected by a private link token, and the kitchen board by a staff PIN.

No website can promise perfect security. If you spot something that looks wrong, tell us and we'll look into it straight away.

Changes to this policy

If we change how we handle your information, we'll update this page and the effective date at the top. The version posted when you place an order is the one that applies to that order.

How to reach us

Questions, requests or worries about your information? Any of these will reach us:

Instagram

@phantomburger_nj

In person

At the counter, 188 Main St, Lincoln Park, NJ 07035, during opening hours (Every day, 11 am to 8:55 pm).

Our terms of service and refunds policy explain the rest of what happens with an order.