Privacy Policy

1. Overview

We collect only the information we need to serve you: to take your order, respond to your message, process your job application, or improve the website. We do not sell your information. We do not share it with advertising networks. We do not track you across other websites.

You can use most of this website without giving us any personal information. Browsing the menu, reading about our history, or viewing specials requires no data. Personal information is collected only when you actively submit it through one of our forms.

2. Information We Collect

Information you give us directly

• Order pickup: name, phone number, pickup time, order items, and any special instructions you provide in the notes field.
• Contact form: name, email address, optional phone number, subject, and message content.
• Job application: name, email, phone, position of interest, availability, and any experience you choose to share.
• Newsletter signup: email address only.

Information collected automatically

• IP address: recorded server-side when you submit a form (for spam prevention and abuse protection). We do not link IP addresses to identities for marketing.
• Local browser storage: your shopping cart contents and cookie-banner preference are stored in your browser's localStorage. This data never leaves your device unless you submit an order.
• Server logs: standard web server access logs (IP, timestamp, user agent, requested URL) for security and troubleshooting. Retained for up to 30 days.

Information we do NOT collect

• Payment card numbers — we accept payment in person at the register only. No card data ever touches our website.
• Social security numbers, driver's license numbers, or government IDs — not collected anywhere on this site.
• Precise geolocation, biometric data, or facial recognition data.
• Behavioral tracking for advertising purposes.
• Information from third-party data brokers.

3. How We Use Your Information

We use the information you give us for specific, limited purposes:

• To fulfill pickup orders: prepare your food, notify you when it's ready, contact you if there's an issue with your order.
• To respond to inquiries: answer your message, address feedback, or follow up on a complaint.
• To process job applications: review your application, contact you to schedule an interview, and keep records required by employment law.
• To send newsletters: only if you've opted in, and only for updates about specials, hours, or events. Every newsletter includes an unsubscribe link.
• To protect the site: detect and prevent spam, abuse, or fraudulent submissions.
• To meet legal obligations: comply with tax, employment, and consumer protection laws as required by the State of Arkansas and applicable federal law.

We do not use your information for automated decision-making, profiling, or targeted advertising.

4. Sharing Your Information

We do not sell your personal information. We do not rent it, trade it, or share it with advertising networks, data brokers, or marketing platforms.

We share information only with:

• Our web hosting provider, which stores the site's files and database on our behalf. They do not have permission to use your data for any other purpose.
• Our email service, which delivers order confirmations, contact replies, and newsletters. Message contents are transmitted but not stored long-term.
• Law enforcement or regulators, if required by a valid subpoena, court order, or legal process. We will notify you if legally permitted to do so.
• A successor business, if Molly's Diner is ever sold or transferred. You would be notified in advance and could opt out.

We will never share your information for cross-context behavioral advertising.

5. Cookies & Browser Storage

We use a minimal set of cookies and browser storage technologies. For full details, see our Cookie Policy.

We do not use analytics cookies, advertising cookies, or social media pixels. There's no Google Analytics, Facebook Pixel, or similar tracker on this site.

6. How Long We Keep Information

• Pickup order records: 2 years from the date of order, for accounting and tax purposes.
• Contact form messages: 1 year from last correspondence, or sooner if you request deletion.
• Job applications: 6 months from submission, unless you're hired — then they become part of your employment record.
• Newsletter subscriptions: until you unsubscribe, plus 30 days for suppression (so we don't email you again).
• Server access logs: 30 days, then automatically rotated out.

You can request earlier deletion of your information at any time (see Your Rights below).

7. Your Rights

Regardless of where you live, we believe you should have control over your own information. You can contact us at any time to:

• Access a copy of the personal information we hold about you.
• Correct inaccurate information.
• Delete your information, subject to legal retention requirements.
• Opt out of marketing emails — every email includes a one-click unsubscribe.
• Withdraw consent at any time for anything you previously consented to.

To make a request, email [email protected] or call us at +1 (870) 226-9913. We respond within 30 days. We may need to verify your identity before fulfilling a request — we'll ask for the email or phone number you used when submitting your information.

8. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) gives you additional rights. Because we don't sell personal information or use it for cross-context behavioral advertising, our obligations are limited — but your rights are the same:

• Right to know what categories of personal information we collect, the sources, and the business purpose.
• Right to delete personal information we've collected from you.
• Right to correct inaccurate personal information.
• Right to opt out of "sale" or "sharing" — we do not sell or share your information, so there is nothing to opt out of.
• Right to limit use of sensitive personal information — we don't collect sensitive personal information as defined by CCPA.
• Right to non-discrimination for exercising your rights.

To submit a CCPA request, email [email protected] with the subject line "CCPA Request." You can also designate an authorized agent to make requests on your behalf, provided they have written authorization signed by you.

9. EU/UK Privacy Rights (GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, the General Data Protection Regulation applies to our handling of your information. Our lawful bases for processing are:

• Contract: to fulfill a pickup order you placed.
• Legitimate interest: to respond to a message, prevent fraud, and secure the site.
• Consent: for newsletter subscriptions (you can withdraw at any time).
• Legal obligation: to comply with tax and employment laws.

You have the right to access, rectify, erase, restrict processing, object to processing, and data portability. To exercise these rights, email [email protected].

Our data controller is Molly's Diner, 201 S Myrtle St, Warren, AR 71671, USA. For EU/UK individuals, please note that your information is transferred to and processed in the United States, which may not offer the same level of protection as your home jurisdiction. We use standard contractual safeguards where required.

10. Children's Privacy (COPPA)

This website is not directed to children under 13. We do not knowingly collect personal information from anyone under 13. If you are a parent or guardian and believe your child has submitted information to us, contact us at [email protected] and we will delete it immediately.

Teenagers 13–17 may use the site to place pickup orders or apply for a job (with appropriate work permit for the position) but are encouraged to have a parent involved when submitting personal information.

11. Security

We take reasonable steps to protect your information from unauthorized access, disclosure, alteration, or destruction:

• All connections to this website use HTTPS encryption.
• Submitted forms are stored on servers protected by firewalls and file-level access controls.
• Order, contact, and application records are kept in protected directories not accessible from the public web.
• Access to your information is limited to authorized Molly's Diner staff and management.

No system is completely secure. If we become aware of a data breach that affects your information, we will notify you and relevant authorities as required by law.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we'll change the "Last Updated" date at the top of this page. If the changes are material, we'll post a notice on our homepage for at least 30 days.

Continued use of the website after changes take effect constitutes acceptance of the revised policy.