At Muse & Co, we respect your privacy and are committed to protecting your personal information. This policy explains what data we collect, how we use it, and your rights regarding your information. We only collect data necessary to provide our services and never sell your personal information to third parties.
1. Overview
Muse & Co ("we," "us," "our") operates a hybrid art studio and tea house located at 311 Hay Street, Fayetteville, NC 28310, as well as the website ncmuse.co and related digital services.
This Privacy Policy describes how we collect, use, store, and protect your personal information when you:
Visit our website or mobile application
Create an account or membership
Place orders for food, beverages, or merchandise
Book art classes, workshops, or private events
Use our complimentary WiFi network
Interact with our AI chatbot (BaristaBot)
Subscribe to our newsletter or communications
Visit our physical location
By using our services, you consent to the data practices described in this policy.
2. Information We Collect
2.1 Information You Provide Directly
Account & Profile Information:
Name (first and last)
Email address
Phone number
Password (encrypted)
Profile preferences and settings
Date of birth (optional, for membership birthday rewards - cannot be changed once set)
Dietary restrictions or allergen information (optional)
Payment Information:
Credit/debit card details (tokenized and processed securely via Stripe)
Billing address
Transaction history
Note: We do NOT store full credit card numbers. Payment data is encrypted and processed by our PCI-compliant payment processor (Stripe).
Order & Booking Information:
Order details (items, customizations, quantities)
Pickup/delivery preferences
Class and workshop registrations
Private event booking details
Special instructions or requests
Order timestamps and fulfillment status
2.2 Information Collected Automatically
Technical & Usage Data:
IP address and device information
Browser type and version
Operating system
Pages visited and time spent on site
Referring/exit pages
Click patterns and navigation paths
Search queries on our website
Date and time of access
2.3 Analytics & Tracking
We use analytics tools (including custom analytics via Cloudflare Workers) to understand how users interact with our website. This helps us improve user experience, optimize content, and identify technical issues.
2.4 AI Chatbot Interactions (BaristaBot)
When you interact with BaristaBot, our AI-powered assistant:
We log conversation messages to improve service quality
Chat data may be analyzed to identify common questions and improve responses
Conversations are stored temporarily and reviewed for quality assurance
Important: Do not share sensitive personal information (credit card numbers, passwords, SSN) in chat conversations
2.5 WiFi Usage Data
When you connect to our complimentary WiFi network at our physical location:
Device MAC address (anonymized)
Connection duration and bandwidth usage
General location within premises (for network optimization)
No browsing history or website visits are tracked
3. How We Use Your Information
We use collected information for the following purposes:
3.1 Service Delivery & Operations
Order Processing: Fulfill food, beverage, and merchandise orders
Reservations: Manage art class registrations, workshop bookings, and private event scheduling
Membership Management: Administer membership benefits, track drop-ins, process renewals
Customer Support: Respond to inquiries, resolve issues, provide assistance
Payment Processing: Complete transactions securely via Stripe
3.2 Communication
Transactional Emails: Order confirmations, receipts, booking confirmations, class reminders
Marketing (with consent): Newsletters, promotional offers, new menu items, event announcements
Feedback Requests: Surveys to improve our services
You can opt out of marketing emails at any time using the unsubscribe link in emails or by contacting us.
3.3 Personalization & Improvement
Menu Recommendations: Suggest items based on past orders and preferences
User Experience: Remember preferences (language, ice level, sugar level)
Analytics: Understand user behavior to improve website navigation, content, and features
A/B Testing: Test different layouts, features, or promotions to optimize user experience
3.4 Security & Fraud Prevention
Detect and prevent fraudulent transactions
Protect against unauthorized account access
Monitor for suspicious activity or security threats
Enforce our Terms of Service
3.5 Legal Compliance
Comply with legal obligations (tax reporting, health regulations)
Respond to law enforcement requests or legal processes
Protect our legal rights and interests
4. Cookies & Tracking Technologies
Cookies are small text files stored on your device that help websites remember your preferences and improve functionality.
4.1 Types of Cookies We Use
Essential Cookies (Required) — Enable core website functionality like login sessions, shopping cart, and secure checkout. Cannot be disabled.
Preference Cookies (Functional) — Remember your settings (language, customization preferences, menu favorites) for a better experience.
Analytics Cookies (Performance) — Help us understand how visitors use our site (page views, bounce rate, traffic sources) to improve performance.
Marketing Cookies (Optional) — Track your interests to deliver relevant ads and measure campaign effectiveness. You can opt out of these.
4.2 How to Manage Cookies
You can control cookie preferences through your browser settings:
Chrome: Settings → Privacy and security → Cookies
Firefox: Options → Privacy & Security → Cookies
Safari: Preferences → Privacy → Cookies
Edge: Settings → Privacy → Cookies
Note: Blocking essential cookies may prevent certain features from working properly (login, checkout, cart).
4.3 Third-Party Tracking
We use third-party services that may set their own cookies:
Stripe: Payment processing and fraud detection
Cloudflare: Content delivery, security, and analytics
Google Analytics: Website traffic analysis and user behavior insights
Google Ads: Conversion tracking on order success pages to measure advertising effectiveness
4.4 Conversion Tracking on Success Pages
When you complete a purchase on our website, the order confirmation/success page may include conversion tracking pixels from Google Ads. This helps us measure the effectiveness of our advertising campaigns and improve our marketing efforts. No personal payment information is shared with these services - only that a purchase was completed and the general order value.
5. Third-Party Services & Data Sharing
We may share your information with trusted third-party service providers who help us operate our business. These providers are contractually obligated to protect your data and only use it for the purposes we specify.
Cloudflare (Hosting & Security): Provides website hosting, CDN services, security (DDoS protection), and data storage (D1 database). Privacy Policy: cloudflare.com/privacypolicy
OpenAI (AI Chatbot): Powers BaristaBot using GPT-4 technology. Chat conversations are processed to generate responses. Privacy Policy: openai.com/privacy
Uber Eats (Third-Party Delivery): If you order through Uber Eats, your information is subject to Uber's privacy policy. We receive limited order data. Privacy Policy: uber.com/legal/privacy
Google Analytics & Google Ads: We use Google Analytics to understand website traffic and user behavior, and Google Ads conversion tracking to measure the effectiveness of our advertising campaigns. This includes tracking on order confirmation/success pages. Privacy Policy: policies.google.com/privacy. Opt-out: Google Analytics Opt-out Browser Add-on
5.2 We Do NOT Sell Your Personal Information
We do NOT sell, rent, or trade your personal information to third parties for marketing purposes.
5.3 Legal Disclosures
We may disclose your information if required to:
Comply with legal obligations (court orders, subpoenas)
Protect our rights, property, or safety
Investigate fraud or security incidents
Enforce our Terms of Service
6. Data Security
We implement industry-standard security measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction.
6.1 Security Measures
Encryption: All data transmitted to our servers uses SSL/TLS encryption (HTTPS)
Password Security: Passwords are hashed using bcrypt with salt
Payment Security: Credit card data is tokenized and processed via PCI-compliant Stripe
Access Controls: Employee access to customer data is restricted and logged
Database Security: Cloudflare D1 database with encrypted storage and backup
Regular Audits: Security reviews and vulnerability assessments
6.2 Your Responsibility
You can help protect your account by:
Using a strong, unique password
Not sharing your password with others
Logging out after using shared devices
Reporting suspicious activity immediately
No System Is 100% Secure: While we strive to protect your information, no internet transmission is completely secure. You use our services at your own risk.
7. Data Retention
We retain your personal information for as long as necessary to provide our services and comply with legal obligations.
7.1 Retention Periods
Account Data: Retained while your account is active, plus 2 years after account closure (for legal/tax purposes)
Order History: 7 years (tax and financial record-keeping requirements)
Payment Information: Tokenized data retained by Stripe per their policy
Chat Logs (BaristaBot): 90 days for quality assurance, then anonymized/deleted
Analytics Data: Aggregated and anonymized data retained indefinitely for business insights
Marketing Data: Until you opt out or request deletion
7.2 Data Deletion
You can request deletion of your personal data at any time (see Section 8: Your Privacy Rights). Some information may be retained as required by law or for legitimate business purposes (e.g., fraud prevention, dispute resolution).
8. Your Privacy Rights
You have the right to:
Access Your Data — Request a copy of all personal information we have about you
Correct Inaccurate Data — Update or correct your personal information if it's wrong
Delete Your Data — Request deletion of your personal information (subject to legal requirements)
Opt Out of Marketing — Unsubscribe from promotional emails at any time
Data Portability — Export your data in a machine-readable format
Restrict Processing — Limit how we use your data in certain circumstances
Communication Preferences: Opt in/out of emails, notifications
Order History: View past orders and transactions
Delete Account: Permanently delete your account and data
9. Children's Privacy
Age Requirement: Our services are not directed to children under 13 years old. We do not knowingly collect personal information from children under 13 without parental consent.
If you are a parent or guardian and believe your child has provided us with personal information without consent, please contact us immediately at [email protected]. We will delete the information promptly.
9.1 Minors Ages 13-17
Users between 13-17 years old must have parental consent to use our services. By creating an account, minors represent that they have obtained permission from a parent or legal guardian.
10. California Privacy Rights (CCPA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):
10.1 Your CCPA Rights
Right to Know: Request details about personal information collected, used, disclosed, or sold
Right to Delete: Request deletion of personal information (with exceptions)
Right to Opt-Out: Opt out of the sale of personal information (we do NOT sell your data)
Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights
10.2 Information We Collect (CCPA Categories)
Identifiers: Name, email, phone, IP address
Commercial Information: Purchase history, order details
Internet Activity: Browsing history, search queries on our site
Geolocation Data: Approximate location from IP address
Inferences: Preferences derived from browsing/purchase behavior
We will verify your identity before fulfilling the request
11. International Users & Data Transfers
Our services are operated in the United States, and our servers are located in the US (via Cloudflare's global network). If you access our services from outside the United States, your information may be transferred to, stored, and processed in the United States.
11.1 GDPR (European Users)
If you are located in the European Economic Area (EEA), UK, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):
Legal Basis for Processing: We process your data based on contract performance, legal obligations, legitimate interests, or your consent
Right to Object: Object to processing based on legitimate interests
Right to Complain: Lodge a complaint with your local data protection authority
Data Controller: Muse & Co is the data controller for your personal information
11.2 Data Transfer Safeguards
We rely on standard contractual clauses and appropriate safeguards to ensure your data is protected when transferred internationally.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.
12.1 How We Notify You
Website Notice: Updated "Last Updated" date at the top of this page
Email Notification: For material changes, we will send an email to registered users
In-App Banner: Prominent notification on our website/app
Your continued use of our services after changes take effect constitutes acceptance of the updated policy. If you do not agree to changes, please discontinue use of our services.
13. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
We will respond to your inquiry within 30 days. For urgent security concerns, please mark your message as "Urgent."
Thank You for Trusting Muse & Co We are committed to protecting your privacy and being transparent about our data practices. Your trust is important to us, and we continuously work to safeguard your information while providing you with exceptional service at our artist's lounge and tea house.