Privacy Policy

Effective date: 18^th March 2026

1. INTRODUCTION AND WHO WE ARE

Flatbread Queen Inc. (“Company,” “we,” “us,” or “our”) operates the website located at https://bolani.co (the “Website”) and is engaged in the manufacture and wholesale distribution of stuffed flatbread sandwiches (“Bolani”) and Sauces to grocery retailers and distributors across California and the United States.

This Privacy Policy explains how we collect, use, store, share, and protect information about you when you visit the Website, submit an inquiry, or engage in a commercial relationship with us. This Policy also explains your rights with respect to your information under applicable California and federal law.

This Privacy Policy applies to information collected through the Website and in connection with our B2B business operations. It does not apply to the privacy practices of grocery retailers, distributors, or other third parties who may sell our Products to end consumers. Those parties have their own privacy policies governing their customer relationships.

2. INFORMATION WE COLLECT

We collect different categories of information depending on how you interact with us. The table below summarizes the primary categories of information we collect, with examples and the main purpose for collection.

We collect information: (a) directly from you when you submit a contact or inquiry form on the Website, correspond with us by email or phone, or enter into a business relationship with us; (b) automatically through the Website using cookies and similar technologies as described in Section 7; and (c) from third parties such as business registries, credit reference agencies, or referral partners, where permitted by applicable law.

3. HOW WE USE YOUR INFORMATION

We use the information we collect for the following purposes:

• Order Fulfillment and Account Management: Processing and fulfilling Orders, managing wholesale accounts, issuing invoices, and maintaining transaction records.
• Business Communications: Responding to inquiries, sending order confirmations, providing product updates, and communicating regarding delivery, quality, or account matters.
• Food Safety and Traceability: Maintaining records necessary for product traceability, recall management, and compliance with food safety regulations including FSMA.
• Payment Processing: Processing payments, managing accounts receivable, and verifying billing information.
• Legal and Regulatory Compliance: Complying with applicable federal, state, and local laws; responding to regulatory inquiries; and maintaining records as required by law.
• Website Analytics and Improvement: Understanding how visitors use the Website in order to improve its content, structure, and functionality.
• Business Development: Identifying and pursuing potential wholesale partnerships, distributor relationships, and retail account opportunities.
• Security: Detecting, preventing, and responding to fraud, unauthorized access, and other security threats to our Website and systems.

We will not use your information for purposes materially different from those described in this Policy without providing you with advance notice and, where required by applicable law, obtaining your consent.

4. LEGAL BASES FOR PROCESSING (CALIFORNIA)

Under California law, including the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), we are required to describe the lawful bases on which we rely to collect and process personal information. We collect and process your information on the following bases:

• Contractual Necessity: Processing is necessary to fulfill Orders, manage wholesale accounts, and perform our obligations under commercial agreements with Buyers.
• Legal Obligation: Processing is necessary to comply with applicable laws, including Food Safety Laws, tax laws, and regulatory record-keeping requirements.
• Legitimate Business Interests: Processing is necessary for our legitimate business interests, including Website analytics, security, fraud prevention, and business development, where those interests are not overridden by your privacy rights.
• Consent: Where you have provided consent (for example, by subscribing to marketing communications), we process your information on that basis. You may withdraw consent at any time.

5. INFORMATION SHARING AND DISCLOSURE

We do not sell your personal information. We share your information only in the following circumstances:

• Service Providers: We share information with third-party vendors who assist us in operating the Website, processing payments, managing logistics, maintaining IT systems, and providing other business services. These vendors are contractually required to protect your information and to use it only for the services they provide to us.
• Food Safety and Regulatory Authorities: We may share information with the FDA, USDA, California Department of Public Health, or other regulatory authorities as required by law or in connection with a product recall, food safety investigation, or regulatory inquiry.
• Legal Proceedings: We may disclose information where required by court order, subpoena, legal process, or applicable law, or to protect our legal rights, enforce our Terms and Conditions, or respond to claims of illegal activity.
• Business Transfers: In the event of a merger, acquisition, sale of assets, or other corporate transaction, your information may be transferred to the acquiring entity as part of the transaction. We will notify you of any such transfer to the extent required by applicable law.
• With Your Consent: We may share your information for other purposes with your prior written consent.

We do not share Buyer contact or business information with unaffiliated third parties for those parties’ own independent marketing or advertising purposes.

6. BUSINESS-TO-BUSINESS CONTEXT AND NO CONSUMER SALES

The Website is operated for business-to-business purposes. We do not currently offer online consumer sales. Information collected through the Website is primarily business contact and inquiry information submitted by representatives of commercial entities (grocery retailers, distributors, food brokers, and similar businesses).

To the extent that any information submitted through the Website relates to an individual acting in a personal capacity (for example, an independent food buyer or sole proprietor), we treat such information as personal information subject to the full protections of this Privacy Policy and applicable California law.

Our wholesale Buyers are responsible for their own privacy practices with respect to the personal data of their own employees, customers, and other contacts. This Policy does not govern those relationships.

7. COOKIES AND WEBSITE ANALYTICS

The Website uses cookies and similar technologies to collect information about how visitors use the Website. This may include your IP address, browser type, operating system, pages visited, time and date of visit, and referring URL.

We use this information to understand Website traffic patterns, improve the user experience, and ensure the Website functions correctly. We do not use Website analytics data to build personal profiles or to serve targeted advertising.

You may configure your browser to refuse or delete cookies. Please note that doing so may affect the functionality of the Website. For more information about our use of cookies, please refer to our Cookie Policy, available on the Website.

We may use third-party analytics services, such as Google Analytics, to help us understand Website usage. These services may collect information through their own cookies. Google’s use of data is governed by Google’s Privacy Policy. You may opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on at tools.google.com/dlpage/gaoptout.

8. DATA RETENTION

We retain your information for as long as necessary to fulfill the purposes for which it was collected, to maintain our business relationship, to comply with our legal and regulatory obligations, and to resolve any disputes or enforce our agreements.

The following general retention periods apply:

• Business contact and account information: Retained for the duration of the business relationship and for five (5) years thereafter, unless a longer period is required by law.
• Order and transaction records: Retained for seven (7) years from the date of the transaction, to comply with California tax and commercial record-keeping requirements.
• Food safety and traceability records: Retained for a minimum of two (2) years from the date of production or delivery, as required under FSMA, or longer if required by applicable regulations.
• Website usage and analytics data: Retained for up to twenty-six (26) months, consistent with standard analytics data retention practices.
• Inquiry and correspondence records: Retained for three (3) years from the date of the most recent communication, unless the inquiry resulted in a business relationship, in which case the account retention period applies.

When information is no longer needed, we will delete, anonymize, or securely destroy it in accordance with our internal data retention procedures.

9. DATA SECURITY

We implement and maintain appropriate technical and organizational security measures designed to protect your information against unauthorized access, disclosure, alteration, loss, or destruction. These measures include, but are not limited to, use of secure communication protocols (HTTPS), access controls, password protection, and data encryption where appropriate.

No method of electronic transmission or data storage is completely secure. While we work diligently to protect your information, we cannot guarantee absolute security. You are responsible for maintaining the security of any credentials used to access our systems or the Website.

In the event of a data security incident that affects your personal information and that is required to be reported under applicable law, we will notify you and any applicable regulatory authorities as required by the California Consumer Privacy Act, the California Civil Code (including Civil Code Section 1798.82), and any other applicable data breach notification laws, within the timeframes required by law.

10. YOUR CALIFORNIA PRIVACY RIGHTS (CCPA / CPRA)

If you are a California resident, you have the following rights with respect to your personal information under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which it was collected, the business purpose for collection, and the categories of third parties with whom it has been shared.
• Right to Delete: You have the right to request that we delete personal information we have collected from you, subject to certain exceptions (for example, where retention is required by law or necessary to complete a transaction).
• Right to Correct: You have the right to request that we correct inaccurate personal information we hold about you.
• Right to Opt Out of Sale or Sharing: We do not sell or share your personal information for cross-context behavioral advertising purposes. No opt-out is required, but you may confirm this through the contact information in Section 20.
• Right to Limit Use of Sensitive Personal Information: To the extent we process any sensitive personal information as defined under the CPRA, you have the right to direct us to limit its use to what is necessary for the specified purpose.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your California privacy rights.

To exercise any of these rights, please submit a verifiable request to us using the contact information in Section 20. We will respond within forty-five (45) calendar days of receipt of a verifiable request, or within ninety (90) days where additional time is reasonably necessary, with written notice of the extension. We may need to verify your identity or authority before processing your request.

11. “SHINE THE LIGHT” LAW (CALIFORNIA CIVIL CODE SECTION 1798.83)

California Civil Code Section 1798.83 (the “Shine the Light” law) permits California residents to request, once per calendar year, information about the personal information (if any) that a business has shared with third parties for those third parties’ direct marketing purposes in the preceding calendar year.

We do not share personal information with third parties for their own direct marketing purposes. Accordingly, no Shine the Light disclosure is required. If you have questions about this, please contact us using the details in Section 20.

12. CHILDREN’S PRIVACY

The Website is not directed at children under the age of thirteen (13) and we do not knowingly collect personal information from children under 13. The Website is designed for use by business professionals engaged in the wholesale food trade and is not intended for use by minors.

If we become aware that we have inadvertently collected personal information from a child under 13 without verifiable parental consent, we will take prompt steps to delete such information from our records. If you believe we may have collected such information, please contact us immediately using the details in Section 20.

13. THIRD-PARTY WEBSITES AND LINKS

The Website may contain links to third-party websites, platforms, or resources. These links are provided for convenience only and do not constitute an endorsement of those third parties or their content. The Company has no control over, and assumes no responsibility for, the privacy practices, content, or availability of any third-party website.

We encourage you to review the privacy policies of any third-party website you visit through a link on our Website. This Privacy Policy applies only to information collected by the Company through the Website and in connection with our business operations.

14. INTERNATIONAL DATA TRANSFERS

The Website is operated from the United States and is intended primarily for users located in the United States. If you access the Website from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those of your country of residence.

By using the Website or providing information to us, you acknowledge and consent to the transfer and processing of your information in the United States in accordance with this Privacy Policy. We will take appropriate measures to protect your information consistent with applicable law.

15. MARKETING COMMUNICATIONS

If you have provided us with your business contact information and have not opted out, we may contact you by email or telephone with information about our Products, new product launches, promotions, industry updates, and wholesale opportunities. Such communications are directed at business contacts in a B2B context.

You may opt out of receiving marketing communications from us at any time by: (a) clicking the “unsubscribe” link in any marketing email we send; (b) replying to any marketing email with “unsubscribe” in the subject line; or (c) contacting us directly using the information in Section 20. Opting out of marketing communications will not affect transactional communications related to your account or outstanding Orders.

16. AUTOMATED DECISION-MAKING

We do not currently use automated decision-making or profiling technologies that produce legal or similarly significant effects on you. All material decisions regarding account approval, credit terms, and order acceptance involve human review.

If we introduce automated decision-making processes in the future that may significantly affect you, we will update this Privacy Policy and, where required by applicable law, provide you with information about the logic involved and your rights with respect to such processing.

17. FOOD SAFETY REGULATORY DISCLOSURES

As a food manufacturer operating under the jurisdiction of the FDA and the California Department of Public Health, we are subject to regulatory inspection, record review, and mandatory reporting obligations. In the event of a food safety investigation, regulatory audit, or product recall, we may be legally required to disclose transaction records, traceability data, Buyer contact information, and delivery records to regulatory authorities without prior notice to the affected Buyer.

Such disclosures are not a breach of this Privacy Policy and are a necessary component of our food safety compliance obligations. We will notify affected Buyers of any mandatory regulatory disclosure to the extent that we are legally permitted to do so.

18. CHANGES TO THIS PRIVACY POLICY

We reserve the right to update or modify this Privacy Policy at any time. Changes become effective upon posting of the revised Policy to the Website, with the updated “Last Updated” date noted at the top of the document. For material changes that significantly affect how we use your personal information, we will provide prominent notice on the Website and, where practicable, notify active Buyers by email.

We encourage you to review this Privacy Policy periodically to stay informed about our data practices. Your continued use of the Website or your continued business relationship with us after the posting of a revised Policy constitutes your acceptance of the updated Policy to the extent permitted by applicable law.

19. DATA PROTECTION OFFICER AND ACCOUNTABILITY

While California law does not require businesses of our current size to appoint a formal Data Protection Officer, we take our privacy obligations seriously and have designated a responsible internal contact for privacy matters. All privacy inquiries, rights requests, and data security concerns are handled directly by Company management.

We maintain internal privacy procedures and conduct periodic reviews of our data collection and processing practices to ensure ongoing compliance with applicable law. We train relevant employees on their obligations with respect to personal data and maintain appropriate records of our data processing activities.

20. CONTACT US AND EXERCISING YOUR RIGHTS

If you have any questions, concerns, or requests regarding this Privacy Policy, or if you wish to exercise any privacy rights available to you under applicable law, please contact us at:

Flatbread Queen Inc.
Website: https://bolani.co
Operating State: California, United States

To submit a California privacy rights request (Right to Know, Right to Delete, Right to Correct), please contact us using the above information with the subject line “California Privacy Rights Request” and include sufficient identifying information for us to verify your identity or authority. We will acknowledge receipt of your request within ten (10) business days and respond in full within the timeframes required by applicable law.

We are committed to resolving privacy concerns promptly, fairly, and in compliance with applicable law. If you are not satisfied with our response, you may have the right to lodge a complaint with the California Privacy Protection Agency (CPPA) at cppa.ca.gov.

This Privacy Policy is part of the Flatbread Queen Inc. suite of legal documents, which also includes the Terms and Conditions available at https://bolani.co.