Effective: January 1, 2023
This Privacy Policy explains how Grubhub Holdings Inc. and its subsidiaries and affiliates (“Grubhub”, “we”, “us” or “our”) collect, use, disclose, and otherwise process personal information in connection with our Platform and Services. Our Platform includes: (i) our websites, including related subdomains, (ii) our mobile, tablet, and other smart device applications, (iii) application program interfaces, (iv) in-store kiosks and other online services, and (v) any other tools, technology, and programs now or in the future; in each case, that reference this Privacy Policy. “Services” includes all services associated with the Platform.
This Privacy Policy does not cover or address: the privacy practices of Merchants available on our Platform, including their authorized licensees and franchisees; branded channel services provided to Merchants, including those provided by our affiliate SCVNGR, Inc. d/b/a LevelUp (“LevelUp”) (where the data processing is performed on behalf of the Merchants); or our privacy practices relating to the personal information of job applicants, employees, Delivery Partners, and other personnel. For the LevelUp privacy policy, go here, and for the Delivery Partner privacy policy, go here.
If you see any undefined term in this Privacy Policy, it has the definition specified in our Terms of Use.
By accessing or using the Platform and/or Services, you agree that you have read, understood, and agree to our collection, storage, use, and disclosure of your personal information as described in this Privacy Policy and our Terms of Use.
1.1. Identifiers and Customer Records. When you create an Account, complete your Account profile, place an order, sign up for a mailing list, or otherwise communicate or interact with us (whether or not through an Account), we collect identifiers and customer records such as your name, address, phone number, and email address.We may also collect identifiers like your name or email address from other people or businesses. For example, we may receive identifiers (i) from a social network or authentication service, such as Facebook, Amazon, or Google, if you use those services to login to the Platform; (ii) from other Grubhub users who refer you to our Services or use our group order future; or (iii) from organizations you are part of, such as your employer or university, that use our enterprise services. Identifiers can also include numbers assigned to you like your IP address or a unique Grubhub account number and information about your device and its software like your browser type, device type/model/manufacturer, operating system, and other similar information. These identifiers are collected or created automatically when you use the Platform.
We may use this information to: (i) create and manage your Account; (ii) facilitate order and delivery services; (iii) communicate with you directly about the Services, including your orders, as well as answer any questions, issues, or concerns you or other users may have; (iv) analyze use of and improve the Platform and our Services; (v) detect and prevent fraud, abuse, or other harmful activities, conduct security investigations and risk assessments, and improve and enforce our security measures; and (vi) send you marketing communications.
We may share this information with ad networks and other advertising partners for the purpose of cross-context behavioral advertising. Please see Section 2.1 below for additional information about your choices with respect to such cross-context behavioral advertising. We may also provide identifiers and customer records to some Merchants when you order from them as part of our agreement with those Merchants. For campus users only, we may disclose identifiers and customer records to select food service providers that operate restaurants and other food ordering and delivery services on your campus so that they can communicate directly with you and send you personalized communications and marketing. We may also disclose this information to our service providers, or for other lawful purposes, as described in greater detail in Section 1.11 below.
Grubhub retains identifiers and customer records for as long as you have an account with Grubhub, and for such additional period as Grubhub determines is necessary to comply with its legal obligations and defend against legal claims.
1.2. Payment Information. We collect payment information from you, such as credit or debit card details, when you place an order or update your saved payment methods. We use this information to: (i) fulfill your requests and process payments (e.g., to allow you to order food from Merchants and have it delivered to you); and (ii) detect or prevent fraud, abuse, or other harmful activities.
We do not sell payment information to third parties or share it with third parties for cross-context behavioral advertising. We also do not share this information with third parties for business or commercial purposes, though we may disclose it to our service providers, or for other lawful purposes, as described in greater detail in Section 1.11 below.
Grubhub retains payment information for as long as you have an account with Grubhub, and for such additional period as Grubhub determines is necessary to comply with its legal obligations and defend against legal claims.
1.3. Commercial Information. Whenever you make purchases on the Platform, we collect commercial information about you, such as your ordering history, purchasing tendencies, and rewards program progress. This information may be used to (i) facilitate order and delivery services; (ii) analyze use of and improve the Platform and our Services; (iii) detect and prevent fraud, abuse, or other harmful activities, conduct security investigations and risk assessments, and improve and enforce our security measures; (iv) personalize your Grubhub experience, including which Merchants and items we recommend to you and any ads you may see from us; and (v) manage your rewards program progress.
We may share commercial information with ad networks and other advertising partners for the purpose of cross-context behavioral advertising. Please see Section 2.1 below for additional information about your choices with respect to such cross-context behavioral advertising. We may also provide commercial information to some Merchants when you order from them as part of our agreement with those Merchants. We may also disclose commercial information to our service providers, or for other lawful purposes, as described in greater detail in Section 1.11 below.
Grubhub retains commercial information for as long as you have an account with Grubhub, and for such additional period as Grubhub determines is necessary to comply with its legal obligations and defend against legal claims.
1.4. Internet Usage Information. When you use the Platform, we collect internet usage information from you automatically, such as information about how you interact with the Platform, your browsing history, and your search history. Depending on your device and/or browser settings, this information can include the site from which you came to our site, the site to which you are going when you leave our site, the pages you visit on the Platform, the links you click on the Platform, whether you open our emails or click the links we send, whether you access the Platform from multiple devices, page scrolling, and where you click or move your mouse on our website.
We use this information to (i) analyze use of and improve the Platform and our Services; (ii) detect and prevent fraud, abuse, or other harmful activities, conduct security investigations and risk assessments, and improve and enforce our security measures; (iii) personalize your Grubhub experience, including which Merchants and items we recommend to you and any ads you may see from us; (iv) evaluate the success of our advertising and marketing campaigns; and (v) send you marketing communications.
We may collect internet usage information through a variety of tracking technologies, including cookies, web beacons, embedded scripts, mobile SDKs, location-identifying technologies, and similar technology (collectively, “tracking technologies”), and we may use third-party partners or service providers to assist with this effort, such as Google. Information we collect automatically about you or your device may be combined with other personal information we collect directly, and our third-party partners may combine this information with information collected from other devices, websites, or apps. For information about our and our partners’ use of cookies and related technologies to collect information automatically, and choices you may have in relation to its collection, please see our "About Our Ads" policy. You can learn more about Google's practices at http://www.google.com/policies/privacy/partners.
We may share internet usage information with ad networks and other advertising partners for the purpose of cross-context behavioral advertising. Please see Section 2.1 below for additional information about your choices with respect to such cross-context behavioral advertising.We may also disclose internet usage information to our service providers, or for other lawful purposes, as described in greater detail in Section 1.11 below. Grubhub retains internet usage information for as long as you have an account with Grubhub, and for such additional period as Grubhub determines is necessary to comply with its legal obligations and defend against legal claims.
1.5. Geolocation Data. We may collect information about your approximate location automatically when you use the Platform. For example, your IP address tells us roughly where you are. We may also collect information about your precise location if you allow us to access your device’s location. We use location information to (i) facilitate order and delivery Services; (ii) analyze use of and improve the Platform and our Services; (iii) detect and prevent fraud, abuse, or other harmful activities, conduct security investigations and risk assessments, and improve and enforce our security measures; and (iv) personalize your Grubhub experience, including which Merchants and items we recommend to you.
We may use the Google Maps API to gather geolocation data. Google uses various technologies to determine your location, including IP address, GPS and other sensors that may, for example, provide Google with information on nearby devices, WiFi access points and cell towers (see the Google privacy policy and the Google Maps terms of service to learn more).
We do not sell geolocation data to third parties or share it with third parties for cross-context behavioral advertising. We also do not share this information with third parties for business or commercial purposes, though we may disclose it to our service providers, or for other lawful purposes, as described in greater detail in Section 1.11 below.
Grubhub retains geolocation data for as long as you have an account with Grubhub, and for such additional period as Grubhub determines is necessary to comply with its legal obligations and defend against legal claims.
1.6. Audio and Video Information. We may collect audio and video information from you, such as call recordings, when you contact our customer care team. We use this information to analyze use of and improve the Platform and our Services.
We do not sell audio and video information to third parties or share it with third parties for cross-context behavioral advertising. We also do not share this information with third parties for business or commercial purposes, though we may disclose it to our service providers, or for other lawful purposes, as described in greater detail in Section 1.1 below.
Grubhub retains audio and video information for as long as you have an account with Grubhub, and for such additional period as Grubhub determines is necessary to comply with its legal obligations and defend against legal claims.
1.7. Protected Characteristics. We may collect your age to enable, for example, the legal purchase of alcohol. We do not sell this information to third parties or share it with third parties for cross-context behavioral advertising. We also do not share this information with third parties for business or commercial purposes, though we may share it with our service providers, or for other lawful purposes, as described in greater detail in Section 1.11 below.
Grubhub retains characteristics information for as long as you have an account with Grubhub, and for such additional period as Grubhub determines is necessary to comply with its legal obligations and defend against legal claims.
1.8. Education Information. If you are a student at a school that participates in our Services, we may receive a student identification or billing number or campus dining card information from your school, in order to enable you to use our campus dining Services.
We may disclose education information to select food providers that operate restaurants and other food ordering and delivery services on your campus so that they can communicate directly with you and send you personalized communications and marketing. We may also share this information with our service providers, or for other lawful purposes, as described in greater detail in Section 1.11 below.
Grubhub retains education information for as long as you have an account with Grubhub, and for such additional period as Grubhub determines is necessary to comply with its legal obligations and defend against legal claims.
1.9. Inferences. When you use our Services, we may make inferences about your preferences, such as what kinds of restaurants you like to order food from and what dishes you might like. These inferences help us to personalize your Grubhub experience, including which Merchants and items we recommend to you and any ads you may see from us.
We do not sell this information to third parties or share it with third parties for cross-context behavioral advertising. We also do not share this information with third parties for business or commercial purposes, though we may disclose it to our service providers, or for other lawful purposes, as described in greater detail in Section 1.11 below.
Grubhub retains inferences about you for as long as you have an account with Grubhub, and for such additional period as Grubhub determines is necessary to comply with its legal obligations and defend against legal claims.
1.10. Communications Content. We maintain communications resulting from your interactions with us or with Delivery Partners, such as email, mail, and chat messages and comments and opinions you express when responding to surveys. We use these communications to (i) communicate with you directly about the Services, including your orders, as well as answer any questions, issues, or concerns you or other users may have; (ii) analyze use of and improve the Platform and our Services; and (iii) detect and prevent fraud, abuse, or other harmful activities, conduct security investigations and risk assessments, and improve and enforce our security measures.
We do not sell communications content to third parties or share it with third parties for cross-context behavioral advertising. We also do not share this information with third parties for business or commercial purposes, though we may disclose it to our service providers, or for other lawful purposes, as described in greater detail in Section 1.11 below.
Grubhub retains communications content for as long as you have an account with Grubhub, and for such additional period as Grubhub determines is necessary to comply with its legal obligations and defend against legal claims.
1.11. Other Circumstances Under Which we Might Use or Disclose Your Data. In addition to the above, Grubhub may need to use or disclose your personal information for:
(i) providing our Services, including by providing information to Merchants, delivery providers, payment processors, and other service providers that we rely on to process and fulfill orders or other service providers that help us keep the Platform and our Services running smoothly;
(ii) completing your requests, including by providing information to other Grubhub users when you use our group order feature or to Merchants who you direct us to provide information to;
(iii) allowing you to use our enterprise services, including by providing information to your university or employer so that you can use its enterprise account;
(iv) enabling your participation in Merchant reward programs, including by providing your information toe Merchants as needed to track points and otherwise facilitate your participation in the reward program;
(v) complying with legal and regulatory requirements and proceedings, including corporate reporting obligations, subpoenas, or law enforcement requests; and/or
(vi) enforcing our rights, including to (a) investigate, prevent, and/or mitigate violations of our Terms of Use, (b) detect, suppress, or prevent fraud or reduce credit risk and collect debts owed to us, (c) exercise or protect the rights, property, or personal safety of Grubhub, our visitors, or others, and/or (d) enforce our agreements with third parties and business partners.
In some cases when we disclose your information to third parties, those third parties will use and process your payment information in accordance with their own separate privacy policies and/or procedures. For example, we use a company called Braintree to process payments. Braintree’s privacy policy is available here.
We may also disclose your personal information to:
(i) other companies owned or controlled by Grubhub Holdings Inc., and other companies owned by or under common ownership as Grubhub Holdings Inc., which also includes our subsidiaries (i.e., any organization we own or control) or our ultimate holding company (i.e., any organization that owns or controls us) and any subsidiaries it owns, for operational or business purposes or as otherwise described in this Privacy Policy; or
(ii) a third party during negotiation of, in connection with, or as an asset in a corporate business transaction, such as a merger, acquisition, joint venture, or financing or sale of all or a portion of company assets, or in the event of insolvency, bankruptcy, or receivership.
Finally, we may use or disclose personal information for a specific purpose not contemplated by this Privacy Policy. In such an event, we will specifically disclose that use to you and, when necessary, obtain your consent.
2.1. Opting Out of Cross-Context Behavioral Advertising or “Sales” of your Information.
Under the laws of certain U.S. states, you may have the right to opt out of our processing or sharing of your information for online cross-context behavioral advertising purposes. Note that certain state laws also allow you to opt out of the “sale” of your information to third parties in exchange for valuable consideration. While we do not sell your information in exchange for money, some of the ways described in Section 1 in which we may disclose your information to third parties or use analytics or online advertising tools that result in the disclosure of your information to third parties may be subject to this opt out right. If you would like to opt out of sharing your personal information for cross-context behavioral advertising or out of “selling” your information, you may submit a request below:
You do not need to create an account with us to opt out, but we may ask you to provide additional personal information so that we can properly identify you to track compliance with your opt out request. We will only use personal information provided in an opt out request to review and comply with the request. If you choose not to provide this information, we may only be able to process your request to the extent we are able to identify you in our data systems, including only processing your request on the device from which you submitted the request.
Some devices and browsers may have settings for limiting how website and app operators like Grubhub can sell your information or use it for cross-context behavioral advertising. If we detect that you have enabled a legally-recognized browser-based opt out preference signal for your device or browser (such as Global Privacy Control), we will endeavor to recognize such preference in accordance and to the extent required by applicable law in required locations. If you are using an Apple device, you may be able to tell the Grubhub app to not “track” you, in which case we will not collect your device’s IDFA or use information you provide through the app for cross-context behavioral advertising.Even if you ask not to be tracked on an Apple device, you should still click on one of the links above if you want to opt out of “selling” your data or of cross-context behavioral advertising through your browser.
2.2. Push Notifications and our Access to Your Device Information. You may control our access to your device information or opt out of push notifications through the “Settings” app on your device. For instance, you can withdraw permission for the app to access your location data through your device settings, though we may continue to approximate your location based on your IP address or through other means.
2.3. Communications Preferences. You can stop receiving promotional email communications by clicking on the “unsubscribe link” provided in such communications. You may not opt out of service-related communications (e.g., Account verification, transactional communications, changes/updates to features of the services, technical and security notices). You may also unsubscribe from receiving certain order-related text (SMS) or multimedia (MMS) messages by replying "STOP" to the number sending the message. Please see our Terms of Use for more information on communications from or on behalf of Grubhub.
2.4. Managing Your Data. If you live in certain states such as California, Colorado, Connecticut, Utah, and Virginia, you have the right to request certain actions with respect to your data. We will endeavor to honor your requests if you live in another state as well, where possible and consistent with law.
You may submit a request to get a copy of your Personal Information, to understand what we collect and how we share your Personal Information, or to delete your Personal Information. We will need to verify your identity before processing your request, which may require us to request additional personal information from you or require you to log into your account.
In certain circumstances, we may decline such a request, such as when we are unable to verify your identity, or when we are unable to delete your information for legal or regulatory reasons. If we are unable to comply with all or a portion of your request, we will explain the reasons for declining to comply with the request.
You may submit a request through the following links:
Alternatively, you may email us at [email protected] with the subject line “Privacy Request.”
You may also correct or update your personal information, such as your name, email address, address, payment information, and phone number, in your account profile page.
If you choose to use any of these methods to manage your data, we will not penalize you, charge you different prices, or provide different quality of services, except to the extent you limit our ability to process personal information needed to provide our Services. For example, if you have your data deleted, we may no longer be able to provide you with our products and Services or engage with you in the same manner.
If you have any questions about your request, you may email us at [email protected]. Colorado, Connecticut, and Virginia residents may appeal the denial of a request made by emailing [email protected], and we will respond within the legally required time period, including a written explanation of the results of your appeal.
2.5. Requests From Others on Your Behalf. In certain circumstances, you may permit someone else (an “authorized agent”) to submit requests about your information on your behalf. The authorized agent must provide sufficient evidence to show that the authorized agent has authority to act on your behalf, including, without limitation, proof that the authorized agent has been lawfully vested with power of attorney. We may deny a request in the event we are not able to verify the authorized agent’s authority to act on your behalf.
Please note that for privacy and security reasons, we may direct communications in response to an authorized agent’s request to you rather than to the authorized agent. For example, we may need to verify your identity and confirm directly with you that you have provided the authorized agent permission to submit the request, and it may take additional time to fulfill requests from authorized agents.
3.1. Data Storage and Transfer. If you create an Account on the Platform as a visitor from outside the United States, by using and/or accessing the Platform or Services, you consent to the collection, transfer, storage, and processing of your information to and in the United States. If you are located in the European Union or other regions with laws governing data collection and use that may differ from U.S. law, please note that we may transfer information, including personal information, to a country and jurisdiction that does not have the same data protection laws as your jurisdiction.
3.2. Keeping Your Information Safe. We care about the security of your information and employ physical, administrative, and technological safeguards designed to preserve the integrity and security of all information collected through our Platform and Services. However, no security system is impenetrable and we cannot guarantee the security of our systems. Please recognize that protecting your personal information is also your responsibility. Accordingly, we strongly recommend that you change your passwords often and not reuse passwords, use a combination of letters and numbers, make sure you use a secure browser, and otherwise take precautions when communicating your personal information on the internet. If you know or have reason to believe that your Account credentials have been lost, stolen, misappropriated, or otherwise compromised or in case of any actual or suspected unauthorized use of your Account, please contact us following the instructions in the Contact Us section below.
Our websites and online Services are not directed to, and we do not intend to, or knowingly, collect or solicit personal information from children under the age of 16, nor do we knowingly sell or share personal information of children under the age of 16. In the event that we learn that we have inadvertently collected personal information from a child under age 16, we will endeavor to delete that information. If you have knowledge that we have collected personal information from a child under 16, please contact us at [email protected].
Our websites and online Services may include links to third-party websites, plug-ins, and applications. Except where we post, link to, or expressly adopt or refer to this Privacy Policy, this Privacy Policy does not apply to, and we are not responsible for, any personal information practices of third-party websites and online services or the practices of other third parties. To learn about the personal information practices of third parties, please visit their respective privacy notices.
We may offer promotional activities, such as contests, sweepstakes, joint promotional activities, or co-branded services, from time to time. You should carefully review the rules and/or terms of each promotion in which you participate, as the promotion may contain additional important information about our, a sponsor's, and/or other third party's use of your personal information. To the extent that the rules or terms of those promotions concerning the treatment of your personal information conflict with this Privacy Policy, the rules of those promotions will control. When such disclosure is necessary to fulfill your request or application or otherwise enable your participation in the promotion, we will disclose personal information to the promotion’s co-sponsors.
We may choose or be required by law to provide different or additional disclosures relating to the processing of personal information about residents of certain countries, regions or states. Please refer below for disclosures that may be applicable to you:
We may update this Privacy Policy from time to time. When we make changes to this Privacy Policy, we will change the effective date at the beginning of this Privacy Policy. In addition to posting the updated Privacy Policy and effective date, we may elect to provide additional notice to you of the updated Privacy Policy, such as by sending an email to you or providing a notice through the Platform and/or Services. All changes shall be effective from the date of publication unless otherwise provided. If you do not cancel your Account before the date the revised Privacy Policy becomes effective, your continued access to or use of the Platform and/or Services will be subject to the revised Privacy Policy.
If you have any questions or requests in connection with this Privacy Policy or other privacy-related matters, please send an email to [email protected].
Alternatively, inquiries may be addressed to:
Grubhub Holdings Inc.
Attention: Privacy Team
5 Bryant Park, 15th Floor
New York, NY 10018
Please note that email communications will not necessarily be secure; accordingly, please do not include credit card information and/or other sensitive personal information in your email correspondence with us.