privacy policy

last updated: march 2026 · Minneapolis, MN

    the short version: we collect only what we need to process your orders and communicate with you. we never sell your data. we use Stripe for payments and Firebase for our platform — both industry-standard, secure services. you can request deletion of your data at any time.
  

1. who we are

tandoco is a high-protein meal prep and bakery business based in Minneapolis, Minnesota. this privacy policy explains how we collect, use, store, and protect your personal information when you use our website (tandoco.com), place orders, create an account, or interact with us in any way.

2. information we collect

we collect the following types of information:

account information: name, email address, and phone number when you create an account or place an order.
guest checkout accounts: when you check out as a guest using Apple Pay (or any express-checkout method that shares an email address with us), we automatically create a passive Firebase Authentication record under that email so we can link your order to a customer record, send your receipt, and let you optionally claim the account later by setting a password. The record is created on your behalf at order time — we do not require you to fill out a sign-up form. You can request deletion of this record at any time by contacting us at hello@tandoco.com; it is also subject to the same retention rules as any other account.
SMS opt-in data: when you opt in to text messages from tandoco, we record your mobile phone number, the timestamp of your consent, the opt-in source (e.g., checkout form, account settings), the IP address you consented from, and your user agent string. We keep this record for as long as your opt-in is active and for a reasonable period after for audit and compliance purposes.
order information: items ordered, order history, pickup preferences, and any notes you include with your order.
payment information: payment is processed securely by Stripe, a PCI-DSS Level 1 certified payment processor. your credit card number, CVV, and expiration date are entered directly into Stripe-hosted fields and are never transmitted to or stored by tandoco. we only store non-sensitive references (Stripe customer ID, last 4 digits of card, card brand, and expiration month/year) so you can recognize your saved payment method on return visits.
communications: emails, messages, or feedback you send us directly.
usage data: basic page view data (page visited, device type, referral source) collected to understand how our site is used. this data is anonymous and does not include personally identifiable information.
email list: if you sign up for our founding member list, waitlist, or email alerts, we collect your email address.

3. SMS / mobile text messaging

This section details tandoco's SMS program under U.S. carrier and TCPA requirements. It applies to any text messages sent to your mobile phone number from tandoco or its service providers.

Full SMS Terms & Conditions → tandoco.com/terms#sms-terms
The terms page covers the program description, message categories, frequency, rates, opt-out (reply STOP), and support (reply HELP) in one place — primary reference for carrier and Twilio 10DLC review.

program name & sender identity

All SMS messages are sent by tandoco, a Minneapolis-based meal prep and protein bakery. The program name appears in the first message you receive after opting in.

how you opt in

You can provide express written consent to receive SMS messages from tandoco in any of the following ways:

At checkout: by checking the SMS opt-in checkbox on the checkout page and submitting your order. The checkbox is unchecked by default — enrollment is affirmative, not assumed.
In your account settings: by toggling on SMS notifications and confirming your phone number.
By texting a keyword (e.g., JOIN) to our dedicated tandoco number, if published.

By opting in, you agree to receive recurring automated text messages from tandoco at the phone number provided. Consent is not a condition of purchase — you can order meals without opting in to SMS.

what messages you'll receive

After opting in, you may receive:

Order confirmations — confirming your order details after checkout.
Pickup reminders — reminding you when your pickup window opens and closes.
Order status updates — letting you know when your meals are ready, delayed, or if there's an issue with your order.
Account & security alerts — transactional messages related to your account (e.g., sign-in from a new device, password changes).

Marketing SMS (promotions, new menu items, drops) requires a separate, explicit opt-in distinct from the transactional opt-in above. tandoco does not send marketing messages to transactional-only subscribers.

message frequency

Message frequency varies. Typical transactional volume is 1–4 messages per week, driven by your order cadence. Marketing messages (if separately opted in) are typically 0–2 per week.

message & data rates

Message and data rates may apply. Message frequency may vary. tandoco does not charge you for SMS messages, but your wireless carrier's standard messaging and data rates apply to every message you send and receive. Contact your wireless provider for details on your plan.

how to opt out

You can opt out of tandoco SMS at any time, free of charge:

Reply STOP to any SMS message from tandoco. You'll receive one final confirmation message, then no further texts.
Toggle SMS off in your tandoco account settings.
Email hello@tandoco.com or call 612-524-9104 and ask to be removed from the SMS list.

Opting out of SMS does not cancel your tandoco account or any pending orders. Transactional communications will shift to email only.

how to get help

Reply HELP to any tandoco SMS for support info and the keywords you can use. Or contact us anytime at hello@tandoco.com / 612-524-9104.

we do not share your SMS opt-in data

      Mobile opt-in data and consent are not shared with any third parties or affiliates for marketing purposes. Your phone number and SMS consent record are used solely by tandoco and our SMS delivery provider (Twilio) to send you the messages you signed up for.
    

SMS delivery provider

We use Twilio as our SMS delivery provider. Twilio receives your phone number and message content only for the purpose of delivering texts on our behalf. Twilio's privacy policy: twilio.com/legal/privacy.

carrier disclaimer

Carriers are not liable for delayed or undelivered messages. Message delivery depends on cellular signal, your device's status, and your carrier's network.

supported carriers

tandoco SMS is compatible with all major U.S. carriers including AT&T, Verizon, T-Mobile, Sprint, US Cellular, Boost, Cricket, MetroPCS, and most regional and MVNO carriers.

questions about SMS

Email hello@tandoco.com or call 612-524-9104.

4. how we use your information

we use your information to:

process and fulfill your meal prep orders
communicate with you about your orders, pickups, and account
send you updates about new menu items, weekly drops, and promotions (only if you opted in)
improve our website, menu, and services
respond to your questions, feedback, and support requests
comply with legal obligations

5. we never sell your data

we do not sell, rent, trade, or share your personal information with third parties for their marketing purposes. period. your data is yours.

6. third-party services

we use a small number of trusted third-party services to operate our business:

Stripe — payment processing. Stripe's privacy policy: stripe.com/privacy
Firebase (Google) — authentication, database, and hosting. Firebase's privacy policy: firebase.google.com/support/privacy

these services have access only to the data necessary to perform their functions and are obligated to protect your information.

7. cookies & tracking

our website uses minimal tracking:

session storage: we use browser session storage to generate a temporary session ID for basic analytics (page views, device type). this data is anonymous and expires when you close your browser.
authentication cookies: Firebase uses cookies to maintain your login session so you don't have to sign in every time you visit.
we do not use third-party advertising cookies, tracking pixels, or retargeting tools.

8. data security

we take reasonable measures to protect your personal information:

all data is transmitted over HTTPS (encrypted connections)
payment data is handled entirely by Stripe, a PCI-DSS Level 1 certified processor
user accounts are secured through Firebase Authentication
access to customer data is restricted to tandoco team members only

while we do our best to protect your data, no method of electronic transmission or storage is 100% secure. we cannot guarantee absolute security.

9. your rights

you have the right to:

access your personal data — view your account information and order history in your account portal
update your information — edit your name, email, or phone in your account settings
delete your account and data — email us at hello@tandoco.com and we will delete your account and associated data within 30 days
unsubscribe from marketing emails at any time using the unsubscribe link in any email, or by contacting us

10. children's privacy

our services are not directed to children under 13. we do not knowingly collect personal information from children under 13. if you believe we have inadvertently collected such information, please contact us and we will promptly delete it.

11. changes to this policy

we may update this privacy policy from time to time. if we make significant changes, we will notify you by posting the updated policy on this page with a new "last updated" date. your continued use of our services after changes are posted constitutes acceptance of the updated policy.

12. contact

questions about this privacy policy? reach out anytime.

email: hello@tandoco.com
Instagram: @tandoco

by using the tandoco website and services, you acknowledge that you have read and understood this privacy policy. tandoco reserves the right to update this policy at any time.