Mamoun’s Falafel — Privacy Policy 

Published by Mamouns Franchise Company, LLC.

Effective: July 23, 2026. This version replaces the version effective July 17, 2026, and the Mamoun’s Falafel Privacy Policy effective July 27, 2021.

1. Who we are and what this Policy covers

This Privacy Policy (the “Policy”) describes how Mamouns Franchise Company, LLC (“Mamoun’s,” the “Company,” “we,” “us,” or “our”) collects, uses, shares, and protects personal information when you:

• use our websites and mobile app (together, the “Online Services”);
• order from us online, through the app, or in our restaurants;
• participate in Mamoun’s Rewards, our loyalty program;
• receive email or text messages from us;
• use in-store technologies such as guest Wi-Fi or self-order kiosks, where offered; or
• otherwise interact with us over the phone or offline about our products and services

(collectively, the “Services”). This Policy is a notice describing our practices. Where applicable law requires your consent for a specific practice — for example, marketing text messages — we will ask for that consent separately, and you may withdraw it at any time.

Service providers. We use service providers to operate parts of the Services. For example, Olo provides our online ordering, mobile app, and guest email and text-messaging platform, and other providers support payment processing, loyalty program administration, website hosting, and analytics. These providers process personal information on our behalf, and we require them to protect it in a manner consistent with this Policy and applicable law. When you create or sign in to the account used for online ordering and Mamoun’s Rewards, you may also be asked to accept our platform provider’s own account terms and privacy notice (currently Olo’s Terms of Service and Privacy Notice for Olo Account Holders); those documents govern that provider’s own practices. Olo’s Privacy Notice for Olo Account Holders is available at https://ologuesthelp.zendesk.com/hc/en-us/articles/6300190883867-Privacy-Notice-for-Olo-Account-Holders.

Restaurants in the Mamoun’s organization. Mamoun’s restaurants are operated by companies that are part of the overall Mamoun’s organization, some of which are separately incorporated entities. When you place an order through the Online Services, we share with the restaurant that prepares and fulfills your order the order details and contact information needed to do so; when you earn or redeem Mamoun’s Rewards at a participating restaurant, that restaurant receives the member identifier, points, reward, and transaction information needed to process that activity. These restaurants handle that information consistent with this Policy.

Third-party services. The Services may contain links to websites, applications, or services owned and operated by other companies (“Third-Party Services”). This Policy does not apply to Third-Party Services; please consult those companies’ policies separately.

United States only. The Services are intended for users in the United States. If you reside outside the United States, please do not use the Services or submit personal information to us.

2. Personal information we collect

“Personal information” is information that identifies you or could reasonably be used to identify you.

Information you provide to us:

• identity and contact details — first and last name, email address, mailing address, and telephone number;
• account information — login credentials, date of birth (collected when you create a rewards account or choose to provide it, and used for program benefits we may offer, such as birthday rewards), and your favorite-store selection;
• purchase information — your orders and order history, and the payment details needed to complete a purchase (collected and processed through our ordering and payment service providers);;
• program participation — survey responses, feedback, contest or promotion entries, and catering inquiries; and
• correspondence — a record of your communications with us.

Mamoun’s Rewards information. If you join Mamoun’s Rewards, we use your mobile phone number as your member identifier and keep your points balance, reward redemptions, and program activity. If you were enrolled in our prior loyalty program, your enrollment information — such as your phone number, points balance, and favorite store — may be transferred to our current service providers so your membership and points continue.

Information collected automatically. When you use a computer, tablet, smartphone, or other device to access the Online Services, we and our service providers may collect information about the device and how you use it: device type, operating system, browser, internet service provider, domain name, internet protocol (IP) address (the number that identifies a device on the internet), the date, time, and pages of your access, and your interactions with our ads and emails. We collect this information using cookies, web beacons, and similar technologies, which are described in Section 5. We may also allow third parties to collect information through their own cookies, web beacons, and similar technologies.

Location information. We may collect approximate location (for example, derived from your IP address). We may collect precise device location only if your device’s permission settings allow it — for example, to help you find a nearby restaurant. You can stop the collection of precise location at any time by changing the settings on your device.

Information from other sources. We may receive information from social networks when you interact with our social features (see Section 5), and from service providers that help us fulfill orders and operate the Services.

3. How we use personal information

We use personal information to:

• provide the Services, and process and deliver orders;
• operate Mamoun’s Rewards — track points, provide rewards and benefits, and administer the program;
• communicate with you about orders, your account, and the Services (for example, order confirmations, receipts, and account notices);
• ask about your experience, including through post-order or post-visit surveys;
• send you promotions, personalized offers, advertisements, and other marketing — by email, text message, mail, or online advertising — with your consent where the law requires it, and always with the ability to opt out (see Section 6);
• maintain, analyze, and improve the Services, and develop new products and services;
• detect, prevent, and investigate security incidents and fraud;
• comply with legal obligations, enforce our rights and terms, and defend against legal claims; and
• maintain appropriate business records.

4. How we share personal information

We share personal information with:

• Service providers — companies that provide services to us, such as our ordering and app platform, payment processing, loyalty program administration, email and text-message delivery, website hosting, analytics, and customer support. They are permitted to process personal information to provide services to us, and we require them to protect it in a manner consistent with this Policy and applicable law.
• Restaurants in the Mamoun’s organization — the restaurant fulfilling your order or honoring your Mamoun’s Rewards benefits receives the information needed to do so, as described in Section 1.
• Advertising and analytics companies — as described in Section 5, these companies may collect information about your activity through cookies and similar technologies to measure and improve our marketing and to show you ads. Depending on your state’s law, some of this activity may be considered a “sale” of personal information, “sharing,” or “targeted advertising” — the terms some state privacy laws use for showing you ads based on your activity across different businesses’ websites and apps. You can opt out as described in Section 10.
• Parties to a corporate transaction — if we are involved in a merger, acquisition, financing, reorganization, or sale of some or all of our business or assets, personal information may be shared with the entities and advisors involved, subject to appropriate protections.
• Law enforcement, courts, and regulators — where required or permitted by law, including in response to subpoenas or court orders, to protect our customers, employees, or others, or to exercise or defend legal rights.

We do not sell personal information for money.

Text-message opt-in data. We do not sell or rent mobile phone numbers collected for our text message program or SMS opt-in and consent records, and we do not share them with third parties or affiliates for their own marketing or promotional purposes. We disclose them only to service providers that send messages, maintain consent and opt-out records, or otherwise operate the Program for us; when required by law; or at your direction.

Aggregated and de-identified information. We may use and share information that no longer identifies you — aggregated statistics or de-identified data — for any lawful purpose, and we may receive payment for it. Where we rely on de-identification, we commit to maintaining and using the data only in de-identified form and not attempting to re-identify it, except as permitted by law to test our de-identification.

5. Cookies, analytics, and advertising

A “cookie” is a small data file sent from a server and stored on your device; a “web beacon” is a small transparent image embedded in a web page, app, or email. We and third parties use cookies, web beacons, and similar technologies to make the Online Services work, remember your preferences, compile statistics about how the Services are used, measure the effectiveness of marketing (including whether an email was opened), and deliver ads, including ads on other websites and services, based on your activity.

Our Online Services may also include social-media features (from networks such as Facebook and Instagram) that allow those networks to collect information about your activity when you interact with the features.

Your controls. You can adjust your browser or device settings to refuse or delete most cookies, or to alert you when a cookie is set. Some cookies are required for the Online Services to function, so disabling all cookies may make some features unavailable. You may also opt out of targeted advertising or a “sale” or “sharing” of personal information, to the extent they occur, by contacting us as described in Section 10; we will apply verified requests to the systems within our control as applicable law requires.

Do Not Track and opt-out preference signals. Some browsers offer a “Do Not Track” setting. There is no industry consensus on how to respond to Do Not Track signals, and the Online Services do not respond to them at this time. We are assessing recognized opt-out preference signals, such as the Global Privacy Control (a browser setting that automatically sends websites a request to opt out); where applicable law requires us to honor such signals, we will honor them.

6. Your marketing choices — email and text messages

• Email. You can opt out of promotional email at any time by using the unsubscribe link in any promotional email we send, or by contacting us as described in Section 12.
• Text messages. Marketing text messages are sent only if you opt in, and consent is not a condition of purchase. Replying “STOP” to a Program message ends survey and marketing text messages from the Mamoun’s Falafel text message program; you can also revoke consent by any of the methods described in the SMS Terms, available at https://www.mamouns.com/termsandconditions/.
• Messages outside the Program. Order confirmations, receipts, account notices, sign-in verification messages sent by our platform providers, and responses to your requests are not marketing messages and are not affected by a marketing opt-out. A request that clearly identifies another message category will be handled as applicable law requires.

We honor opt-out requests promptly, and in any event within the time required by applicable law.

7. Mamoun’s Rewards

Participation in Mamoun’s Rewards is voluntary. If you join, we collect and use the information described in Section 2 — including your phone number, purchase history, favorite store, and (if provided) date of birth — to operate the program and provide its benefits: earning points on qualifying purchases, redeeming rewards, and receiving member offers. You can leave the program at any time by deactivating your account or contacting us as described in Section 12. If you leave the program, you may forfeit accrued points and unredeemed rewards. We will retain records we need to satisfy legal, tax, accounting, and fraud-prevention obligations, as described in Section 9.

8. How we protect personal information

We maintain administrative, technical, and physical safeguards designed to protect personal information, and we limit access to personnel and service providers who need it for the purposes described in this Policy. No method of transmission over the internet or of electronic storage is completely secure, however, and we cannot guarantee absolute security.

9. How long we keep personal information

We keep personal information for as long as needed for the purposes described in this Policy, and we then delete it or de-identify it. How long that is depends on the type of information and how it is used. For example: account and Mamoun’s Rewards information is kept while your account is active and afterward for as long as needed to complete transactions, resolve disputes, and meet the obligations described in this Policy; transaction records are kept as required by tax, accounting, and other laws; and marketing consent and opt-out records are kept as long as necessary to honor your choices and demonstrate compliance. We may retain information longer where required by law or to resolve disputes, enforce our agreements, or protect our legal rights.

10. Your privacy rights and choices

Depending on where you live, the law may give you specific rights in your personal information. We extend the ability to make the following requests to all of our customers, subject to verification and to limits and exceptions in applicable law. You may request:

1. Access — confirmation of whether we process your personal information, and a copy of it;
2. Correction — that we correct inaccurate personal information;
3. Deletion — that we delete the personal information we hold about you;
4. Portability — a copy of the personal information you provided to us in a structured, commonly used, machine-readable format, transmitted to you or, where technically feasible, to another party;
5. Opt-out of marketing — to stop receiving marketing communications at any time (Section 6);;
6. Opt-out of targeted advertising, “sale,” or “sharing” — to opt out of the practices described in Sections 4 and 5, to the extent they occur;
7. Opt-out of profiling — to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning you, to the extent we conduct that activity;
8. Restriction, objection, and withdrawal of consent — to restrict or object to certain processing, and to withdraw any consent you previously gave, without affecting processing that already occurred; and
9. Limits on sensitive information — we do not use or disclose sensitive personal information (such as precise location collected with your permission) for purposes that would require a right to limit under applicable law, other than to provide the Services you request or as otherwise permitted by law.

How to submit a request. Email feedback@mamouns.com, or write to Mamouns Franchise Company, LLC, 20 Witherspoon Street, Princeton, New Jersey 08542, Attn: Privacy. Please say which right you are exercising and give us enough information to locate your records (such as the email address or phone number on your account).

Verification. We will take reasonable steps to verify your identity before acting on a request — for example, by matching the contact details you provide against our records or confirming control of the email address or phone number on the account. We may decline a request we cannot verify.

Authorized agents. Where applicable law allows, you may designate an authorized agent to submit a request on your behalf; we may require proof of the agent’s authorization and verification of your identity.

Timing. We will respond within the time required by applicable law — generally within 45 days, with an extension where the law permits and we notify you.

Appeals. If we decline to act on your request, we will explain why. You may appeal by replying to our response or emailing feedback@mamouns.com with “Privacy Appeal” in the subject line. If your appeal is unsuccessful, you may contact your state Attorney General or another applicable regulator; you also have the right to lodge a complaint with a regulator at any time.

No discrimination. We will not deny you goods or services, charge you different prices, or provide a different level of quality because you exercised a privacy right. Note that Mamoun’s Rewards benefits are available only to program members, and deleting your account ends program benefits as described in Section 7.

11. Account deactivation and deletion

You can deactivate your account at any time in the Mamoun’s app. Deactivating your account ends your Mamoun’s Rewards participation, and you may forfeit accrued points and unredeemed rewards; deactivation does not by itself delete your personal information. To request deletion of your personal information, contact us at feedback@mamouns.com or at the mailing address in Section 12. We will delete or de-identify the personal information we hold about you and direct our service providers to do the same, except for records we are required or permitted by law to keep, such as transaction, tax, fraud-prevention, and consent records.

12. Contact us

If you have questions, comments, or concerns about this Policy or our privacy practices, or if you want to exercise any of the rights and choices in this Policy — including changing your information, opting out of promotional emails, text messages, telephone calls, or mailings, or requesting deletion — contact us:

• Email: feedback@mamouns.com
• Mail: Mamouns Franchise Company, LLC, 20 Witherspoon Street, Princeton, New Jersey 08542, Attn: Privacy

We will process your request once we have verified your identity. You can also opt out of a marketing channel by following the opt-out instructions in the communication itself (the unsubscribe link in an email, or texting “STOP” in reply to a text message from the Program).

13. Children and age requirements

The Online Services are not directed to children under the age of 13. If we learn that we have collected personal information from a child under 13 without legally valid parental consent, we will take reasonable steps to delete it. If you are a parent or guardian and believe a child under 13 has provided personal information to us, contact us as described in Section 12. You must be at least 13 years old to create an account or participate in Mamoun’s Rewards. If you are under the age of majority where you live, you may use the Online Services and participate in Mamoun’s Rewards only with the permission of a parent or guardian. The text message program remains limited to individuals 18 or older — see the SMS Terms & Conditions.

14. Former customers

This Policy continues to apply to the personal information of former customers in accordance with applicable law.

15. Changes to this Policy

We may update this Policy from time to time by posting the revised version on this page and updating its effective date. If we make a material change to how we collect, use, or share personal information, we will provide prominent notice — for example, on this page, in the app, or by email or text message — before the change takes effect, and we will obtain your consent where applicable law requires it. Material changes will apply to personal information collected after the change takes effect, unless we notify you otherwise and, where required, obtain your consent. A material change will not retroactively expand a consent you previously gave.

Effective July 23, 2026