Sign In

Privacy Policy

Last updated: October 6, 2026 (version 2026-10-06)

1. Who We Are and What This Policy Covers

This Privacy Policy explains how APETii Corporation (“APETii,” “we,” “us,” or “our”), located at 3423 Summer Ranch Dr, Katy, TX 77494-3694, United States, collects, uses, shares, and protects personal information when you use the BonCibi online ordering service, including its website, checkout, optional accounts, delivery, group-order, and catering features, and the emails and text messages we send (together, the “Service”). We are the controller of the personal information described in this policy.

The Service is operated by APETii on behalf of the storefront you are using. Where your order is prepared by an independent restaurant partner (the “Merchant”), that Merchant receives the order details it needs to prepare and serve your order, as described in Section 5.

2. Information We Collect

Information you give us.

  • Contact details: your name, email address, and phone number.
  • Order details: the items, modifiers, quantities, special instructions, tip, pickup location, table (for dine-in QR orders), delivery building and delivery date, and the order history tied to your email address.
  • Account details (optional): if you create an account, the password you choose, which we store only as a one-way cryptographic hash.
  • Payment details: when you pay, your card details go directly to our payment processor, Square. We never receive or store your full card number or security code. If you choose to save a card, Square stores it and we keep only the card brand, last four digits, expiration date, and a reference token.
  • Group-order and catering requests: your company or group name, event date, guest count, delivery address, budget, and any notes you include.
  • Building requests: if you ask us to bring service to your building, your name, contact details, and the building address.
  • Preferences and consents: whether you opted in to marketing email, when you did so, and the version of our Terms in force when you last placed an order, with the time you placed it.
  • Messages you send us: the contents of emails or other communications you send to us.

Information collected automatically.

  • Device and usage data: IP address, browser type and version, operating system, device type, screen size, referring page, the pages and menu items you view, buttons you click, the storefront and ordering channel you use, and the date, time, and duration of your visits.
  • Approximate location: our analytics provider, PostHog, receives your IP address with the analytics events your browser sends, stores it, and derives an approximate location from it, which can include your country, state or region, city, postal code, and approximate latitude and longitude. Our hosting provider also infers your country and state or region from your IP address, which we use to decide whether a session replay may be recorded. We do not collect precise geolocation data, such as GPS location from your device.
  • Session replays: on some visits we may record how you interact with the page (mouse movement, scrolling, clicks) to find and fix usability problems. Everything you type is masked in these recordings, and we do not record visitors located in California.
  • Error and security logs: technical details about errors and about attempted misuse of the Service, such as rate-limit events.

We do not knowingly collect sensitive personal information as defined by Texas law, such as racial or ethnic origin, religious beliefs, health information, sexual orientation, citizenship or immigration status, genetic or biometric data, precise geolocation, or the personal data of a child under 13. Please do not include such information in order notes or messages.

3. How We Use Your Information

We use personal information for the following purposes:

  • to accept, prepare, deliver, and hand off your orders, and to identify you when you collect them;
  • to process payments and refunds through Square, and to detect and prevent fraud, chargebacks, and abuse;
  • to send order confirmations, receipts, status updates, and account and security notices, and, if we add a feature that requires it, one-time verification codes;
  • to create and operate your optional account where the storefront offers one, including signing you in, resetting your password, pre-filling your name and email address when you order, and keeping and removing the cards you choose to save;
  • to respond to your questions, catering and group-order requests, and building requests, and to send you proposals you asked for;
  • to send marketing email if, and only if, you have opted in;
  • to understand how the Service is used, fix errors, improve menus and features, and measure the performance of the Service;
  • to protect the security and integrity of the Service, our customers, Merchants, and staff;
  • to comply with tax, accounting, and other legal obligations, to enforce our Terms, and to establish or defend legal claims; and
  • for any other purpose we describe to you when we collect the information, or with your consent.

We do not use personal information for targeted advertising, we do not sell it, and we do not make automated decisions about you that have legal or similarly significant effects.

4. Cookies, Local Storage, and Analytics

We use cookies and similar browser storage that are necessary to operate the Service and a first-party analytics tool. We do not use third-party advertising cookies or cross-site tracking.

  • Necessary: session cookies that keep you signed in to an optional account (for up to 30 days) or, for staff, to the admin tools; browser storage that keeps your cart, your last selected location, building, and delivery date; and short-lived storage used for security checks.
  • Analytics: we use PostHog, a product analytics service, to measure page views, ordering funnels, and errors. PostHog sets a first-party identifier so it can tell visits from the same browser apart, and it receives your IP address and the approximate location derived from it, as described in Section 2. We configure it not to create a profile for visitors who have not signed in, to strip order and table links from what it records, and to mask everything you type. When you sign in to an account, PostHog links that browser’s analytics to your account. Analytics traffic is routed through our own domain.

You can block or delete cookies and site data in your browser settings. Blocking necessary storage may prevent you from ordering. The Service does not currently respond to browser “Do Not Track” signals, because there is no cross-site tracking to turn off; we honor opt-out requests made under Section 8.

5. Who We Share Information With

We share personal information only as described below. We do not sell it and we do not share it with third parties for their own marketing.

  • The Merchant preparing your order. The restaurant, kitchen, or location fulfilling your order receives your name, contact details, and order details so it can prepare, hand off, and support your order. Independent Merchants are responsible for their own use of that information in their restaurants.
  • Service providers who process information on our behalf under contracts that restrict their use of it:
    • Square, Inc. for payment processing, refunds, and card-on-file storage (Square’s own privacy notice applies to the card data you enter);
    • Supabase for our database, authentication, and file storage;
    • Vercel for hosting and content delivery;
    • Resend for sending email;
    • PostHog for product analytics and masked session replay;
    • Sentry for server-side error monitoring;
    • Google Maps Platform for address suggestions when you type a delivery or event address (Google receives the text you type and your IP address under Google’s privacy policy); and
    • if we add a feature that sends one-time verification codes by text message, a telecommunications provider to deliver them.
  • Buildings you order to. For building delivery, we may share your name and order reference with the building’s front desk or management so your order can be handed off to you.
  • Professional advisers such as accountants, auditors, and lawyers, under confidentiality obligations.
  • Legal and safety. We may disclose information where required by law, subpoena, or court order; to respond to a lawful request by a public authority; to enforce our Terms; or to protect the rights, property, or safety of APETii, our customers, Merchants, staff, or the public.
  • Business transfers. If we are involved in a merger, acquisition, financing, reorganization, or sale of some or all of our assets, personal information may be transferred as part of that transaction. We will notify you of any change in ownership or in the use of your personal information.
  • With your direction or consent.

Categories summary. The categories of personal information we share are contact details, order details, transaction details (excluding full card numbers), device and usage data, and the contents of your requests. The categories of third parties we share them with are Merchants, payment processors, hosting and infrastructure providers, communications providers, analytics and error-monitoring providers, mapping providers, buildings you order to, professional advisers, and government authorities where legally required.

6. How Long We Keep Information

  • Orders, payments, and refunds: at least four years after the transaction, and longer if a dispute, audit, or legal obligation requires it. Texas sales-tax and federal tax rules require us to keep transaction records for that period.
  • Account and contact details: for as long as you have an account or an active customer relationship with the storefront, and afterwards as needed to honor your marketing choices and keep the transaction records above.
  • Marketing consent and opt-out records: for as long as needed to prove your choice and honor it.
  • Catering, group-order, and building requests: for as long as needed to respond to and, if applicable, fulfill the request, and afterwards as part of our transaction records.
  • Analytics and session replays: retained by our analytics provider for a limited period under our account settings, then deleted or aggregated.
  • Error and security logs: for a limited period needed to diagnose problems and investigate abuse.

When information is no longer needed, we delete it or de-identify it. Where we must keep transaction records after you ask us to delete your data, we keep only what the law requires and stop using it for any other purpose.

7. Your Choices

  • Marketing email. Promotional email is opt-in only. You can unsubscribe at any time using the link in any marketing email or at /unsubscribe. You will still receive transactional messages about orders you place.
  • Text messages. We do not currently send text messages. If we add a feature that requires it, we will send text messages only to deliver one-time verification codes for that feature. We do not send marketing texts without your separate express written consent, which you can withdraw by replying STOP.
  • Saved cards. You can remove a saved card from your account at any time, or by contacting us.
  • Account. You can order as a guest without an account. If you have an account, the account area lets you view and remove saved cards and sign out, and you can reset your password from the sign-in page. The account area does not let you change your name, email address, or phone number; to update or correct them, contact us at team@boncibi.com.
  • Cookies and site data. See Section 4.

8. Your Privacy Rights

We extend the following rights to every customer, wherever you live. Texas residents have these rights under the Texas Data Privacy and Security Act, and residents of other states may have similar rights under their state’s law.

  • Access: confirm whether we process your personal information and obtain a copy of it.
  • Correction: correct inaccurate personal information.
  • Deletion: delete personal information you provided or that we obtained about you, subject to the records we must keep under Section 6.
  • Portability: receive a copy of the personal information you provided in a portable, readily usable format.
  • Opt out: opt out of the sale of your personal information, of targeted advertising, and of profiling that produces legal or similarly significant effects. We do none of these today, so there is nothing to opt out of, but we will honor a request if that ever changes.
  • No discrimination: we will not deny you service, charge you a different price, or provide a different level of service because you exercised a privacy right.

How to make a request. Email team@boncibi.com with the subject line “Privacy request,” or write to APETii Corporation, 3423 Summer Ranch Dr, Katy, TX 77494-3694, United States. Tell us which right you are exercising and the email address and phone number you used with the Service, so we can verify that the request comes from you. We may ask for additional information if needed to verify your identity, and we will only use it for that purpose. An authorized agent may make a request on your behalf if they provide proof of your written authorization and we can verify your identity.

Timing. We will respond within 45 days of receiving your request. If we need more time, we may extend that period once by a further 45 days and will tell you why within the first 45 days. Requests are free, except that we may charge a reasonable fee or decline a request that is manifestly unfounded, excessive, or repetitive.

Appeals. If we decline all or part of your request, we will tell you why. You may appeal within 60 days by replying to our decision or emailing team@boncibi.com with the subject line “Privacy appeal.” We will respond in writing within 60 days with the outcome and the reasons for it. If your appeal is denied and you are a Texas resident, you may submit a complaint to the Texas Attorney General at texasattorneygeneral.gov. Residents of other states may complain to their state attorney general.

9. California Residents

If the California Consumer Privacy Act applies to you, you have the rights to know, delete, correct, and port your personal information, to opt out of the sale or sharing of personal information, to limit the use of sensitive personal information, and not to be discriminated against, and you may exercise them as described in Section 8. In the past 12 months we collected the categories described in Section 2 (identifiers, customer-record information, commercial information, and internet activity) from you directly and from your device, used them for the purposes in Section 3, and disclosed them for business purposes to the recipients in Section 5. We have not sold or shared personal information for cross-context behavioral advertising, and we have no actual knowledge that we sell or share the personal information of anyone under 16. We do not collect precise geolocation, and we do not record session replays for visitors in California.

10. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has given us personal information, contact us at team@boncibi.com and we will delete it.

11. Security

We protect personal information with technical and organizational safeguards appropriate to its sensitivity, including encryption in transit and at rest, tokenized payments so that card numbers never reach our systems, one-way hashed passwords, tenant-level access controls in our database, role-based access for staff, and monitoring for abuse. No system is completely secure, so we cannot guarantee absolute security. If a breach of security affects your unencrypted personal information, we will notify you as required by Texas law and any other applicable law.

12. Where Information Is Processed

We are based in Texas and our service providers process information in the United States. The Service is intended for customers in the United States. If you use it from elsewhere, you understand that your information will be transferred to and processed in the United States.

13. Third-Party Links and Services

The Service may link to third-party websites and relies on third-party services such as Square and Google Maps. Their privacy practices are governed by their own policies, which we encourage you to read. We are not responsible for the privacy practices of third parties.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will post the updated policy with a new “Last updated” date, and for material changes we will provide additional notice through the Service or by email where we have your address. When you place a pickup, delivery, or catering order, we record on your customer record the version in force and the time you placed the order. Each new order replaces that record, so it shows the version in force when you last ordered; it is not kept separately for each order. Dine-in orders collect no contact details, so no version is recorded for them.

15. Contact Us

For privacy questions or to exercise your rights, contact APETii Corporation at team@boncibi.com or by mail at 3423 Summer Ranch Dr, Katy, TX 77494-3694, United States.

Privacy Policy