Privacy Notice for Olo Account Holders – Guest Support

PRIVACY NOTICE FOR OLO ACCOUNT HOLDERS

Last Updated: July 24, 2025

Information for California Residents: Please see “Additional Information for Individuals Residing in California” for the Notice at Collection and other information specific to California residents.

About Your Olo Account

Olo Inc. (“Olo”, “we”, “us”, or “our”) allows guests at merchants powered by Olo (“Merchants”) to create an account with Olo (an “Olo Account”) to, among other things, check out faster at Merchants by saving payment and delivery information to their Olo Account, store and manage preferences across Merchants and receive personalized recommendations (the “Services”). The Olo Guest Support website is included as part of the Services. Please see here for a list of Merchants where you can use your Olo Account.

This Privacy Notice (“Notice”) explains how we collect, use and disclose personal data in connection with the Services and the rights and choices you have related to your personal data. It also provides information about how to contact us regarding our privacy practices. We recommend that you read this entire Notice so that you are informed about our privacy practices. However, if you want to skip to a particular section in the Notice, please refer to the Table of Contents below.

Personal Data We Collect

How We Use Your Personal Data

How We Share Your Personal Data

Your Choices

Your Privacy Rights

Exercising Your Privacy Rights

Security

Children

Other Sites, Mobile Applications and Services

Additional Information for Individuals Residing in California

Additional Information for Individuals in Canada

Changes to this Notice

Contact Us

Personal Data We Collect

We collect personal data when you use the Services. We collect personal data (i) directly from you, (ii) from third parties and (iii) automatically when you use the Services. We also draw inferences about you based on the personal data we collect. There is a description below of the types of personal data collected from each source.

Personal Data You Provide Directly to Us. When you directly interact with the Services, we collect personal data from you. This personal data may include:

Contact and account information that you provide, such as your first and last name, email address, home address, phone number and birth month and date.
Payment information that you provide, such as your payment card number and billing address.
Reservation, order and delivery/pickup information, including menu items and other details about the orders you place, your delivery address, pickup details (such as car model and license plate to identify your vehicle for pickup) and order history.
Order preferences, such as your preferred store locations, favorite menu items and food preferences.
Feedback or correspondence, such as information you provide when you contact us with questions, feedback or otherwise correspond.
Marketing information, such as your preferences for receiving communications about our or our Merchants’ products, activities, events and publications and details about how you engage with such communications.
Other information that you may provide voluntarily.

Personal Data We Obtain from Third Parties. We collect personal data about you from third parties, including from data providers. This personal data may include:

Social media information, such as personal data that you share through your interactions with our profiles, posts or other content on social media or if you use social media or other third-party platforms to sign in to your Olo Account.
Contact and account information, such as name, email address and phone number, from Merchants.
Information related to third-party products and services, such as loyalty numbers or other third-party account information, from Merchants, marketing partners, loyalty partners, coupon partners and business partners.

Personal Data We Collect Automatically. We and our service providers and certain third parties may automatically collect information about you, your device and your interactions over time with the Services and any communications we send. Information collected automatically by cookies or similar tracking technologies (described below in “Cookies and Similar Tracking Technologies”) may include:

Device data, such as your computer or mobile device operating system type and version, manufacturer and model; browser type; device type (e.g., phone, tablet); IP address; unique identifiers (including identifiers used for advertising purposes); language settings; mobile device carrier; radio/network information (e.g., Wi-Fi, LTE, 5G); and general location information such as city, state or geographic area.
Online activity data, such as pages or screens you viewed and how long you spent on them, the frequency of your visits, browsing history, navigation paths between pages or screens, information about your activity on a page or screen, access times and whether you have opened our marketing emails/texts or clicked links within them.

Information We Derive. We may derive personal data about you or draw inferences based on the personal data we collect, including from your interactions with the Services. For example, we may make an inference about your approximate location based on your IP address or what foods you may like based on your order history.

How We Use Your Personal Data

We use your personal data for the following purposes:

Provide, maintain and support the Services. We use personal data to provide, operate, maintain and support the Services. This includes, for example:

Creating and managing your Olo Account, including authenticating your account.
Facilitating orders and payment transactions that you initiate.
Maintaining your order history with Merchants.
Understanding your needs and interests and personalizing your experience with the Services, including with Merchants. For example, we may provide you with recommendations of Merchants based on your geographic area, food preferences, order history and other factors.
Developing, training and deploying algorithms and artificial intelligence models to provide, personalize and improve the Services.
Offering you products, services and promotions from our business partners and facilitating integrations and data sharing with business partners’ products, services and promotions.
Communicating with you about the Services, including by sending announcements, updates, security alerts, and support and administrative messages.
Performing necessary operations to maintain the Services, including diagnosing technical and service issues.
Providing customer support for the Services and responding to your requests, questions and feedback.

Research and development. We use personal data for research and development, including to:

Identify issues.
Understand how you use the Services.
Improve the Services.
Test and develop new services.

Marketing and advertising. We and our advertising partners use personal data for marketing and advertising purposes, including:

Sending you marketing communications (as permitted by law), including but not limited to, notifying you about special promotions and offers, Services and Merchants you may be interested in.
Services and about Merchants you may be interested in.
Personalizing marketing communications.
Administering surveys and sweepstakes.
Improving, developing and implementing marketing and advertising campaigns and analyzing whether such campaigns are effective.

Manage our business and for internal operational purposes. We use personal data to manage our business and internal operations, including to:

Analyze the performance of the Services.
Develop analytics about the Services and provide reporting.

Compliance and protection. We use personal data for compliance and protection purposes, including to:

Comply with applicable laws, lawful requests, government or law enforcement requests and legal process, such as to respond to subpoenas or requests from government authorities.
Secure and protect our network, systems and the Service.
Prevent, identify, investigate and deter fraudulent, harmful, unauthorized, unethical or illegal activity, including cyberattacks and identity theft.
Take any actions necessary to protect our, your or others’ rights, privacy, safety or property, including by establishing, exercising or defending legal claims and enforcing the Terms of Service.
Monitor our internal processes for compliance with legal and contractual requirements and internal policies.

How We Share Your Personal Data

We share personal data as part of providing the Services and for the other purposes described in this Notice. We share personal data with the entities listed below:

Merchants. We share personal data with Merchants from whom you order.

Service Providers. We share personal data with service providers that provide services on our behalf or help us operate the Services or our business, such as web hosting, information technology, customer support, identity verification and fraud prevention, email delivery and website analytics.

Business Partners. We share personal data with our business partners to provide, maintain, improve and expand the Services.

Third Parties. We share personal data with third parties with whom you have instructed us to share your personal data.

Affiliates. We share personal data with our affiliates.

Authorities and others. We share personal data with law enforcement, government authorities and private parties (e.g., our professional advisors and consultants), as we believe in good faith to be necessary or appropriate for the purposes described above in “How We Use Your Personal Data.”

Business transfers. We share personal data with acquirers and other relevant participants in business transactions (or negotiations for such transactions) involving a corporate divestiture, merger, consolidation, acquisition, reorganization, sale or other disposition of all or any portion of the business or assets of, or equity interests in, Olo or our affiliates (including, in connection with a bankruptcy or similar proceedings).

We also share aggregated and/or anonymized information derived from the Services that does not directly identify you.

All of the above sharing excludes text message originator opt-in data and consent; this information will not be shared with third parties.

Cookies and Similar Tracking Technologies

We use cookies and similar tracking technologies for the Services and for email communications.

Tracking Technologies We Use

Cookies are small text files that are placed and stored on your browser when you visit a website or on your device when you visit an app. We use both session cookies (cookies that expire when you close your browser) and persistent cookies (cookies that expire after a set period) to provide the Services. The cookies may be set by Olo or by a third party.

Local storage refers to files that are created by websites or apps and stored on your device or browser. These files function similarly to cookies.

Pixels, web beacons, embedded scripts or page tags are similar tracking technologies that are often used in connection with cookies or other identifiers associated with your device. These technologies are small blocks of code or transparent image files placed on webpages, apps, emails or ads that allow us to identify users when providing the Services and track interactions with the Services and our communications.

Software Development Kits (SDKs) are blocks of code used for mobile apps, which are functionally like cookies and pixels, web beacons and embedded scripts. SDKs enable developers to collect information about the device and network used to access an app and interactions with the app.

How We Use Cookies and Similar Tracking Technologies

We use cookies and similar tracking technologies for the following purposes:

Provide our services
Uniquely identify you or your device
Remember preferences and settings
Help navigate between pages efficiently
Enable functionality
Understand user activity
Analyze and monitor the performance of the Services
Deliver and measure the effectiveness of marketing and advertising campaigns

Please see “Your Choices” below for information about how to control the use of cookies and similar tracking technologies.

Your Choices

You have certain choices related to marketing communications and cookies and tracking technologies.

Opt-out of Marketing Communications. We may send you marketing or other promotional communications. These marketing communications may include emails or text messages (if you have opted in to receive marketing text messages). You can unsubscribe or opt out of any such marketing communications from us by following the instructions contained in the communications we send you. Please note that even if you opt-out of marketing communications, you may continue to receive non-marketing communications, such as authentication text messages to verify your identity.

Cookies. Your browser may allow you to decline cookies. If you decline certain cookies, it may impact the functionality of the Services, and the Services may not work properly. Since each browser is different, please consult the “Help” or “Preferences” menu of your browser for information about how to control cookies. We do not currently respond to Do Not Track signals.

Your Privacy Rights

Depending on where you reside, you have certain privacy rights in relation to your personal data. If you reside in California, see “Additional Information for Individuals Residing in California” below for information about your privacy rights. If you reside in a state other than California, depending on your state, you may have the following privacy rights, subject to conditions and exceptions:

Access/Portability. You have the right to confirm whether we process personal data about you. You may have the right to request access to your personal data and receive it in a portable and machine-readable format. If you reside in certain states, you may also have the right to request information about which third parties receive your personal data.

Deletion. You have the right to request us to delete your personal data.

Correction. You have the right to request that we correct or update inaccurate personal data that we hold about you.

Opt-Out. You have the right to opt-out of (i) the “sale” (as such term is defined under the privacy law in the state where you reside) of your personal data, (ii) targeted advertising and (iii) profiling in the furtherance of solely automated decisions that produce legal or similarly significant events.

Right to Appeal. You have the right to appeal decisions that we make with regards to your privacy rights request.

Right to Withdraw Consent. If you provide us with consent, you have the right to withdraw consent at any time, subject to legal and contractual restrictions and reasonable notice.

Exercising Your Privacy Rights

You can exercise your deletion right by logging into your Olo Account here and selecting “Delete Account” under “Account Support.” You can find more information about managing your Olo Account here.

You can exercise any of your privacy rights by clicking here and providing the required information.

Additionally, you can exercise any of your privacy rights by emailing us at privacyrequests@olo.com.

We will not discriminate against you if you exercise your privacy rights.

When we receive your privacy request, we may ask for additional information to verify your identity. Any such information requested will only be used for the purpose of confirming your identity.

If an authorized agent is submitting a privacy rights request on your behalf, they must submit proof of your authorization to make the request, such as a valid power of attorney or proof of signed permission from you or such other method as permitted by applicable law. We may deny a request from an authorized agent if proof is not provided that they are authorized to make the request on your behalf. The authorized agent should also provide us with the name and email of the individual exercising their privacy rights as well as the name and email of the authorized agent.

If we deny your privacy request, we will provide the reasons to you as permitted by applicable law. If we deny your request, we will notify you within the applicable statutory period (generally, 30-90 days from receipt of request depending on the applicable privacy law). Depending on the state you reside in, you may have the right to appeal our decision by contacting us at privacyrequests@olo.com and including “Privacy Appeal” in the subject line. If you have concerns about the results of an appeal, you may contact the attorney general in the state where you reside.

Security

We implement and maintain reasonable security procedures and practices designed to safeguard personal data we collect against theft, loss and unauthorized access, use, modification and disclosure. Even though we take such measures to protect your personal data, we cannot guarantee that your personal data will be completely secure.

Children

The Services are not intended for use by children under 13 years of age. If we learn that we have collected personal data through the Services from a child under 13 without the consent of the child’s parent or guardian as required by law, we will delete it.

Other Sites, Mobile Applications and Services

The Services may contain links to websites and other online services operated by third parties. These links are not an endorsement of, or representation that we are affiliated with, any third party. We encourage you to read the privacy notices provided by these other websites and online services.

Additional Information for Individuals Residing in California

This section applies only to California residents and supplements the information provided in the other sections of this Notice that pertains to all individuals.

When we use the term “personal data” in this section of the Notice, we mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.

Notice at Collection

For information on the categories of personal data we collect and the sources of such personal data, see “Personal Data We Collect” above.
For information on the purposes for which we collect personal data, see “How We Use Your Personal Data” above.
We do not “sell” or “share” your personal data (as such terms are defined under the California Consumer Privacy Act (“CCPA”)).
For information on how long we retain your personal data, see “Data Retention” below.

Supplemental Information

The CCPA requires that we provide certain additional information to California residents.

The table below summarizes the following information:

Categories of personal data we collected in the past 12 months.
Sources of collection of the personal data.
How we use your personal data.
Categories of recipients to whom we disclosed personal data for business purposes in the past 12 months.

Additionally, please refer to the other sections of this Notice that apply to all individuals for more detail on the information in the table below.

Category of Personal Data	Examples of Personal Data	Categories of Sources of Personal Data	Commercial or Business Purpose	Disclosure of Personal Data
Identifiers	Name, email address, IP address	• Provided directly to Olo • Provided by Third Parties • Automatically collected	• Provide, maintain and support the Services • Research and development • Marketing and advertising • Manage our business and for internal operational purposes • Compliance and protection	• Merchants • Service Providers • Authorities and Others
California Customer Records (Cal. Civ. Code §1798.80(e))	Name, telephone number, address	• Provided directly to Olo • Provided by Third Parties • Automatically collected	• Provide, maintain and support the Services • Research and development • Marketing and advertising • Manage our business and for internal operational purposes • Compliance and protection	• Merchants • Service Providers • Authorities and Others
Commercial Information	Order history	• Provided directly to Olo • Provided by Third Parties	• Provide, maintain and support the Services • Research and development • Marketing and advertising • Manage our business and for internal operational purposes • Compliance and protection	• Merchants • Service Providers • Authorities and Others
Internet/Network Information	Website browsing activity, device ID	• Automatically collected • Provided by Third Parties	• Provide, maintain and support the Services • Research and development • Marketing and advertising • Manage our business and for internal operational purposes • Compliance and protection	• Service Providers
Inferences	Preferences and behavior based on use of Service	• Provided directly to Olo • Provided by Third Parties • Automatically collected	• Provide, maintain and support the Services • Research and development • Marketing and advertising • Manage our business and for internal operational purposes • Compliance and protection	• Merchants • Service Providers

We do not “sell” or “share” personal data (as such terms are defined in the CCPA).

We do not offer financial incentives for the collection or sale of personal data.

We do not process sensitive personal data.

Privacy Rights

As a resident of California, you have the following privacy rights, subject to certain conditions and exceptions:

Access/Portability. You have the right to confirm whether we process any personal data about you. You have the right to request access to your personal data and receive it in a portable and machine-readable format.

Deletion. You have the right to request us to delete your personal data.

Correction. You have the right to request that we correct or update inaccurate personal data that we hold about you.

Opt-Out. If we “sell” or “share” (as such terms are defined in the CCPA) personal data, you have the right to opt-out of such sales or sharing.

Right to Withdraw Consent. If you provide us with consent, you have the right to withdraw consent at any time, subject to legal and contractual restrictions and reasonable notice.

To exercise these privacy rights, please see “Exercising Your Privacy Rights” above. We will not discriminate against you if you exercise your privacy rights.

Data Retention

We store personal data for as long as necessary to carry out the purposes for which we originally collected it or for the period that is required under applicable law. In determining the length of the retention period, we will consider the amount, nature and sensitivity of the personal data; the potential risk of harm for unauthorized use or disclosure of personal data; the purposes for which we collected personal data and whether we can achieve the purposes through other means; and applicable legal requirements.

Additional Information for Individuals in Canada

This section applies only to individuals in Canada and supplements the information provided in the other sections of this Notice that pertains to all individuals.

Consent

Our collection, use and disclosure of your personal data is based on your consent (implied or express) or where otherwise permitted or required by the laws of Canada, including the laws of the applicable province. By using the Services, you accept the terms of this Notice and consent to the collection, use, disclosure and retention of your personal data as described in this Notice. You may change or withdraw your consent at any time subject to legal or contractual obligations and providing reasonable notice. Upon receiving the notice of your withdrawal of consent, we will inform you of the likely consequences of the withdrawal of your consent.

Privacy Rights

You have the right to request access to, and correction of, personal data that we hold about you, subject to conditions and exceptions under applicable law. Depending on where you reside, and subject to conditions and exceptions under applicable law, you may also have the right to delete your personal data, restrict processing of your personal data and access information about how your personal data is used and disclosed.

To exercise your privacy rights, please follow the instructions under “Exercise Your Privacy Rights” above.

Transfers of Data

The personal data that we collect, use and disclose in connection with the Services is processed and stored in the United States. The privacy laws in the United States are different from Canadian privacy laws. US courts, law enforcement and regulatory agencies may be able to access your personal data. We will protect your information as described in this Notice. When you provide personal data to us through the Services, you consent to the transfer of your personal data to the United States, and processing of such data within the United States.

Data Retention

Right to Challenge

You may file a complaint by contacting us as described below if you believe we have not complied with any privacy laws relating to the protection of your personal data or the practices described in this Notice.

Email: privacyrequests@olo.com

Physical mail: Olo Inc., Attention: Chief Legal Officer, 285 Fulton Street, One World Trade

Center, 82nd Floor, New York, New York 10007.

We thoroughly investigate all complaints. To ensure we can best respond to your concerns, we may request additional information from you to help investigate your complaint. If our investigation determines your complaint is valid, we will take appropriate actions to resolve the issue, which may include updating our policies or procedures. If you are unsatisfied with the result of our investigation, you have the option to seek remedies available under applicable law and you should reach out to the Privacy Commissioner in the province where you reside. We will retain personal data related to our decision for at least one year after we make a decision.

Changes to this Notice

We reserve the right to modify this Notice at any time. If we make changes to this Notice,

we will notify you by updating the “Last Updated” date at the top of this Notice. We will

communicate changes to you in accordance with applicable law. Your continued use of

the Services after any update to this Notice will constitute your acceptance of our

changes.

Contact Us

You can reach us by: