Tropical Smoothie Cafe

"Geolocation data such as physical location or movements. Sensitive Personal Information in the form of precise geolocation but only if you turn on location services in your Tropical Smoothie Cafe App."

The app collects precise geolocation data including physical location and movements, which is classified as sensitive personal information. This geolocation data is also shared with third parties for advertising purposes.

"Where users have chosen to enable Google to associate their web and app browsing history with their Google account, and to use information from their Google account to personalize ads they see across the web, Google will use data from its signed-in users together with our Google Analytics data to build and define audience lists for cross-device remarketing."

TSC uses Google remarketing to track users across devices, combining browsing history with Google account data to build audience profiles for cross-device advertising.

"We may also disclose the Personal Information we collect to our analytics vendors and partners to develop aggregate analysis and business intelligence for our advertising and marketing purposes. We also disclose Personal Information to social media platforms and third-party advertising platforms for purposes of targeted advertising of promotions, products, and services we think may be of interest to you."

Personal information is shared broadly with analytics vendors, social media platforms, advertising networks, franchisees, delivery platforms, and various service providers — creating a wide web of third-party data access.

"We reserve the right to change this Privacy Policy at any time and in our sole discretion. If we change our Privacy Policy, we will post the revised version on our website and indicate the date that the changes are effective. Your continued use of the Services after the changed Privacy Policy is posted constitutes your acceptance of the changes."

TSC can modify the privacy policy unilaterally at any time with no requirement to notify users directly — simply posting the change on the website is sufficient, and continued use is treated as consent.

"We generally retain your Personal Information for as long as you have an account or as long as required to comply with legal requirements or fulfill the purpose of the collection."

The retention policy is vague, with no specific timelines for data deletion. The open-ended language of retaining data to 'fulfill the purpose of the collection' gives TSC broad discretion to keep data indefinitely.

"We also log the details of your visits to our Services and information generated in the course of using our Services, such as mouse movements, clicks, page visits, text entered, how long you spent on a page, and other details of your actions on our Services."

TSC logs granular user behavior including mouse movements, keystrokes (text entered), clicks, and time on page — session replay-level tracking that goes beyond what's needed for a smoothie ordering app.