Privacy Policy - Flynn Group

Flynn Group Privacy Policy

Effective Date: January 1, 2026

Flynn Group and its affiliated companies Apple American Group, Bell American Group, Pan American Group, RB American Group, Hut American Group, Wend American Group, and Flynn Fitness Group (collectively, “Flynn,” “we,” or “us”) care about your privacy. This Privacy Policy describes how we collect, use, and share information, including information we may collect at our restaurant locations or when you interact with our websites, social media sites and handles, tabletop/mobile applications, email and online services, and other Flynn personnel (collectively, our “Services”). This Privacy Policy explains:

the types of information we collect through our Services
how we use and protect that information
the types of information we may share with others and under what circumstances
the choices you have regarding our collection, use, and sharing practices
details regarding our use of third-party cookies and other tracking technologies

We also include specific disclosures for residents of certain jurisdictions.
This Policy applies to any information we collect when you use the Services. It also applies anywhere it is linked. It does not apply to non-Flynn websites, services, and applications that may link to the Services or be linked to or from the Services; please review the privacy policies on those websites and applications directly to understand their privacy practices. All capitalized terms shall have the meaning described in the Your Options and Rights Section at the end of this Policy.

Information We Collect

The following is a description of our data collection practices, including the Personal Information and/or Personal Data we collect, the sources of that information, the purposes for which we collect the information, whether we disclose that information to other companies, and how long we retain that information.

Categories	Purpose	Sharing	Retention
Personal Identifiers: We may collect your name, email address, telephone number, or postal address when you submit a form, claim, or survey to us, if you communicate with us by telephone or email, or when you submit your information to reserve a table or a seat at our restaurants. We collect your IP address automatically when you use our Services. We collect your Device ID automatically when you use our Services.	Provide, maintain, and improve Services Notify you about changes to our Services Provide customer support Analyze use of Services Monitor usage of Services Contact you about the Services	Service Providers and Contractors Companies involved in advertising Our affiliated or related entities, including our franchisors	As long as necessary to complete the purpose, unless otherwise instructed by consumer, or unless otherwise disclosed at the time of collection.
Protected Classifications: We collect your age in order to comply with laws that restrict collection and disclosure of Personal Information and Personal Data belonging to minors. We may collect your gender if you provide it in a survey you complete for us.	Provide, maintain, and improve Services Comply with legal requirements	Service Providers and Contractors	As long as necessary to complete the purpose, unless otherwise instructed by consumer, or unless otherwise disclosed at the time of collection.
Commercial Information: When you engage in transactions with us, we may create records of goods or services purchased, including financial information used to complete the transaction.	Provide, maintain, and improve Services Provide customer support Analyze use of Services Monitor usage of Services	Service Providers and Contractors Companies involved in advertising Our affiliated or related entities, including our franchisors	As long as necessary to complete the purpose, unless otherwise instructed by consumer, or unless otherwise disclosed at the time of collection.
Biometric Information or Biometric Data: We do not collect information about your physiological, biological, or behavioral characteristics.	N/A	N/A	N/A
Internet or Other Electronic Network Activity Information: We collect information about your browsing history, search history, and information regarding your interaction with our websites, applications, and advertisements automatically when you utilize our Services. We may collect your account ID, username, or other information if included in your posts available to us on a social media platform.	Provide, maintain, and improve Services Analyze use of Services Monitor usage of Services	Service Providers and Contractors Social Media Platforms Companies involved in advertising Our affiliated or related entities, including our franchisors	As long as necessary to complete the purpose, unless otherwise instructed by consumer, or unless otherwise disclosed at the time of collection.
Geolocation Data: As described above, we collect your IP address automatically when you use our Services. We may be able to determine your general location based on the IP address. We do not collect your precise location (i.e., your GPS coordinates).	Provide, maintain, and improve Services	Service Providers and Contractors Companies involved in advertising Our affiliated or related entities, including our franchisors	As long as necessary to complete the purpose, unless otherwise instructed by consumer, or unless otherwise disclosed at the time of collection.
Audio, electronic, visual, thermal, olfactory, or similar information: We may collect video surveillance at our stores. Otherwise, we do not collect this information.	Provide, maintain, and improve Services Comply with legal requirements	Service Providers and Contractors	As long as necessary to complete the purpose, unless otherwise instructed by consumer, or unless otherwise disclosed at the time of collection.
Professional or employment-related information: We may collect professional or employment-related information about you when you search for job openings or apply for a job with us.	Provide, maintain, and improve Services Comply with legal requirements	Service Providers and Contractors	As long as necessary to complete the purpose, unless otherwise instructed by consumer, or unless otherwise disclosed at the time of collection. As long as required under the applicable laws.
Education information: We may collect educational information about you if you apply for a job with us.	Provide, maintain, and improve Services Comply with legal requirements	Service Providers and Contractors	As long as necessary to complete the purpose, unless otherwise instructed by consumer, or unless otherwise disclosed at the time of collection.
Inferences drawn to create a profile about a consumer reflecting the consumer’s preferences or characteristics: We do not analyze your actual or likely preferences.	N/A	N/A	N/A
Sensitive personal information/sensitive personal data/sensitive data: We may collect certain Personal Information that is defined as Sensitive Personal Information or Sensitive Personal Data or Sensitive Data under the applicable data protection laws. This data varies depending on the context and purpose of collection.	Provide, maintain, and improve Services Comply with legal requirements Analyze use of Services Monitor usage of Services	Service Providers and Contractors	As long as necessary to complete the purpose, unless otherwise instructed by consumer, or unless otherwise disclosed at the time of collection.

We may disclose information to other parties who are not listed here when required by law or to protect our Company or other persons.

How We Secure the Information We Collect From or About You

We use a combination of physical, technical, and administrative safeguards to protect the information we collect through the Services. While we use these precautions to safeguard your information, we cannot guarantee the security of the networks, systems, servers, devices, and databases we operate or that are operated on our behalf.

Additional Information about our Data Collection and Sharing Practices

Sharing of Aggregated Data

We may analyze aggregated, de-identified data in accordance with the applicable data protection laws and share these analyses at our discretion, including with marketing agencies, media agencies, and analytics providers. These other companies will not be able to relate this data to identifiable individuals.

Combination of Information

We may combine information from the Services together with other information we obtain from our business records.

Change of Ownership or Corporate Organization

We may transfer to another entity or its affiliates or service providers some or all information about you in connection with, or during negotiations of, any merger, acquisition, sale of assets or any line of business, change in ownership control, or financing transaction.

Our Practices Regarding Information Belonging to Children

The Services are intended for users aged 16 and older. Flynn does not knowingly collect personal information or personal data from children. If we discover that we have inadvertently collected personal information or personal data from anyone younger than the age of 16, we will delete that information. We do not share or sell any data of any users that we know to be under the age of 16.

Do Not Track

We do not currently recognize automated browser signals regarding tracking mechanisms, which may include “Do Not Track” (DNT) signals sent by web browsers, mobile devices, or other mechanisms. Third parties may be able to collect information, including Personal Information or Personal Data, about your online activities over time and across different websites or online services when you use the Services. You may opt out of online behavioural ads at http://www.aboutads.info/choices/. You also may limit certain tracking by disabling cookies in your web browser.

Cookies and Analytics

We use cookies, pixels, tags, and other technologies, which may be provided by third parties, on our Services to enable certain functionality and for security and fraud detection and prevention, as well as to collect usage information about our Website and the emails that we send and to personalize content and provide more relevant ads and information. We may combine the information we collect via these technologies with other information, including Personal Information and Personal Data.

Cookies

Cookies are alphanumeric identifiers that are transferred to your computer through your web browser for record-keeping purposes. Some cookies enable you to log-in to our Services or save certain settings and preferences, while others allow us to track usage and activities on our Services, personalize content, or deliver more relevant ads. Most web browsers automatically accept cookies, but if you prefer, you can edit your browser options to block them in the future. The “Help” tab on the toolbar on most browsers will tell you how to prevent your computer from accepting new cookies, how to have the browser notify you when you receive a new cookie, or how to disable cookies altogether. If you block cookies, however, certain features on our website may not be available or function properly.

Third parties may use cookies and other similar technologies to collect or receive information from our Site and elsewhere on the Internet and use that information to provide you with targeted ads. If you would like to opt-out of such advertising practices on the particular device on which you are accessing this Privacy Policy, please go to http://optout.aboutads.info/. The Network Advertising Initiative also offers a means to opt-out of a number of advertising cookies. Please visit http://www.networkadvertising.org to learn more. Note that opting-out does not mean you will no longer receive online advertising. It does mean that the company or companies from which you opted-out will no longer deliver ads tailored to your preferences and usage patterns.

Pixel tags and embedded script (aka clear GIFs and web beacons).

Pixel tags are tiny graphics with a unique identifier, similar in function to cookies. In contrast to cookies, which are stored on your computer’s hard drive, pixel tags are embedded invisibly on web pages. We may use these, in connection with our Website to, among other things, track the activities of the users of our Services, improve ads, personalize and manage content, and gather usage information about our Website. We may also use these in HTML emails to help us track email response rates, identify when our emails are viewed, and track whether our emails are forwarded.

Third-Party Analytics Tools.

Our Website uses automated devices and applications operated by third parties, such as Google Analytics, which uses cookies and similar technologies to collect and analyze information about use of the Website and report on activities and trends. This service may also collect information regarding the use of other websites, apps and online resources. You can learn about Google’s practices by going to www.google.com/policies/privacy/partners/, and you can opt out of them by downloading the Google Analytics opt-out browser add-on, available at https://tools.google.com/dlpage/gaoptout.

Your Privacy Rights

Unless otherwise required by applicable law, the following terms shall have the following meaning:

“Personal Data” means any information, including sensitive data and derived data, unique identifiers, or pseudonymous data, that is linked or reasonably linkable to an identified or identifiable individual or household, or data linkable to a device that itself is linkable to an individual, not including deidentified or publicly available information.

“Personal Information” means any information that directly or indirectly identifies, relates to, describes, or is reasonably capable of being associated, linked or linkable with a particular individual or household.

“Process” or “processing” means any operation or set of operations performed, whether by manual or automated means, on personal data or on sets of personal data, such as the collection, use, storage, disclosure, analysis, deletion or modification of personal data.

“Targeted advertising” or “Cross-context behavioral advertising” means displaying advertisements to a consumer where the advertisement is selected based on personal data obtained from that consumer’s activities over time and across nonaffiliated websites or online applications to predict such consumer’s preferences or interests.

“Sale” means renting, releasing, disclosing, exchange, sharing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to a third party for monetary or other valuable consideration.

“Profiling” means any form of automated processing of personal information to evaluate certain personal aspects relating to a natural person and in particular to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.

U.S. data protection laws grant California, Colorado, Delaware, Iowa, New Hampshire, New Jersey, Oregon, Texas, Virginia, Utah, Connecticut, Tennessee, Minnesota, Maryland, Rhode Island, Indiana, and Kentucky residents the following data rights:

Right to Know and to Access

You have the right to request that we disclose certain information to you about our collection and use of your Personal Information and Personal Data over the past 12 months. This information is disclosed in the “Information We Collect” Section of this Privacy Policy.

You also have the right to request access to Personal Information or Personal Data collected about you and information regarding the source of that information, the purposes for which we collect it, and the third parties and service providers with whom we share it. You may submit such a request as described below. To protect our customers’ Personal Information or Personal Data, we are required to verify your identity before we can act on your request.

Right to Portability

You have the right to request that we provide a copy of the Personal Information or Personal Data we have collected about you, in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another entity without hindrance. Once we receive your request and confirm your identity, we will provide to you a copy of your data as required under the applicable data protection laws. We may provide this data to you through your user account with us, or via email to the email address you have provided with your request.

Right to Delete

Subject to certain exceptions, you have the right to request that we delete any of your Personal Information or Personal Data. Once we receive your request and confirm your identity, we will review your request to see if an exception allowing us to retain the information applies. We will delete or deidentify Personal Information or Personal Data not subject to one of these exceptions from our records and will direct our service providers to take similar action.

Right to Correct

Subject to certain exceptions, you have the right to request that we correct inaccurate Personal Information or Personal Data that we have collected about you. Once we receive your request and confirm your identity, we will review your request, taking into account the nature of the personal information or data and the purposes of the processing of the personal information or data to see if we can correct the data. We may also request additional information showing that the information you want to correct is inaccurate.

Right to Opt-out

You have the right to opt-out of processing of your Personal Information or Personal Data for the purpose of (i) targeted advertising, (ii) sale of Personal Information or Personal Data, or (iii) profiling to provide you with tailored content, including suggested advertising. We do not process your Personal Information or Personal Data for the purpose of (i) targeted advertising, (ii) sale of Personal Information or Personal Data, or (iii) profiling, as those terms are defined in the applicable laws.

Residents of New Jersey may designate an authorized agent to exercise their right to opt out on their behalf.

Non-Discrimination

We will not discriminate against you for exercising any of your data privacy rights.

By filling out a Consumer Data Request Form available here.
By calling us toll-free at 1-855-575-7220.

Verification Procedures

In order to process your request to exercise your rights, we must first verify it. We do this by asking you to:

Provide personal identifiers we can match against information we may have collected from you previously; and
Confirm your request using the email and/or telephone account stated in the request; or

We will not collect additional Personal Information or Personal Data from you for the sole purpose of your exercising your rights under the data protection laws. Similarly, we will not require you to create an account with us, solely for the purpose of exercising your rights under the data protection laws.

Authorized Agent

You may authorize another individual or a business registered with the California Secretary of State, called an authorized agent, to make requests on your behalf. We require that you and the individual complete notarized affidavits in order to verify the identity of the authorized agent and confirm that you have authorized them to act on your behalf. Parents of minor children may submit a birth certificate of the child in lieu of an affidavit, in order to make requests on the child’s behalf. Please see our required affidavits: Affidavit of Identity and Affidavit of Authorized Consumer Representative.

Additional Rights for California Residents

Financial Incentive Program.

We do not offer any financial incentives as those are defined under the applicable data protection laws.

California Shine the Light

Residents of the State of California have the right to request information about other companies to whom the company has disclosed certain categories of personal information during the preceding year for those companies’ direct marketing purposes. If you are a California resident and would like to make such a request, please email privacy@flynnrg.com or write to us or call us at

Flynn Group
225 Bush Street, Suite 1800
San Francisco, CA 94104
Attn: Legal Department, Privacy Inquiries
1-855-575-7220

Additional Rights for Oregon and Maryland Residents

Residents of the State of Oregon have the right to request a list of other companies to whom the company disclosed certain personal data during the preceding year. Residents of the State of Maryland have the right to request a list of categories of third parties to whom the company disclosed certain personal data during the preceding year.

If you are an Oregon resident or a Maryland Resident and would like to make such a request, please email privacy@flynnrg.com or write to us or call us at:

Flynn Group
225 Bush Street, Suite 1800
San Francisco, CA 94104
Attn: Legal Department, Privacy Inquiries
1-855-575-7220

Additional Rights for Minnesota Residents

Flynn does not currently engage in profiling consumers for purposes of making automated decisions that have legal or similarly significant effects.

Minnesota consumers have the right to request a list of third parties to which the controller has disclosed the consumer’s personal data. If you are a Minnesota consumer and would like to make such a request, please email privacy@flynnrg.com or write to us or call us at:

Flynn Group
225 Bush Street, Suite 1800
San Francisco, CA 94104
Attn: Legal Department, Privacy Inquiries
1-855-575-7220

Additional Rights for Oregon, New Hampshire, New Jersey, Minnesota, Maryland, Rhode Island, Indiana, and Kentucky Residents

Oregon, New Hampshire, New Jersey, Minnesota, and Maryland residents may revoke previously given consent to process your personal data in accordance with our data collection practices by emailing us at privacy@flynnrg.com.

Delaware, Iowa, New Hampshire, New Jersey, Virginia, Texas, Oregon, Colorado, Tennessee, Minnesota, Maryland, Rhode Island, Indiana, and Kentucky Residents

Right to Appeal

If you make a request to exercise any of the above data access rights and we are unable to comply with your request, you may request to appeal our decision. To appeal any data privacy request decision, please contact us by emailing privacy@flynnrg.com with the subject line “Data Access Request Appeal.” If after you complete the appeal process with us, you are still not satisfied with our response, you may contact your Attorney General to file a complaint. Below is the contact information for the appropriate entity where you can inquire about filing an appeal:

Virginia residents:
Office of the Attorney General
202 North 9th Street
Richmond, Virginia 23219
Phone: (804) 786-2071
https://www.oag.state.va.us

Colorado residents:
Office of the Attorney General
Colorado Department of Law
Ralph L. Carr Judicial Building
1300 Broadway, 10th Floor
Denver, CO 80203
(720) 508-6000
https://coag.gov

Delaware residents:
Delaware Department of Justice (Wilmington Office)
Carvel State Building
820 N. French Street
Wilmington, DE 19801
(302) 577-8400
https://attorneygeneral.delaware.gov/
Note: The Delaware Department of Justice also has offices in Dover and Georgetown (https://attorneygeneral.delaware.gov/contact/).

Iowa residents:
Office of the Attorney General of Iowa
Hoover State Office Building
1305 E. Walnut Street
Des Moines, IA 50319
(515) 281-5164
https://www.iowaattorneygeneral.gov/

New Hampshire residents:
New Hampshire Attorney General
NH Department of Justice
1 Granite Place South
Concord, NH 03301
(603) 271-3658
https://www.doj.nh.gov/

New Jersey residents:
Division of Consumer Affairs in the Department of Law and Public Safety
124 Halsey Street
Newark, NJ 07102
(973) 504-6200
https://www.njconsumeraffairs.gov/

Texas residents:
Office of the Attorney General
300 W. 15th Street
Austin, Texas 78701
Phone: (512) 463-2100
https://www.texasattorneygeneral.gov

Oregon residents:
Office of the Attorney General
Oregon Department of Justice
1162 Court St. NE
Salem, Oregon 97301-4096
Phone: (503) 378-4400
https://www.doj.state.or.us

Tennessee residents:
Tennessee Attorney General’s Office
P.O. Box 20207
Nashville, Tennessee 37202-0207
Phone: (615) 741-3491
https://www.tn.gov/attorneygeneral.html

Minnesota residents:
Office of the Minnesota Attorney General
445 Minnesota Street, Suite 600
St. Paul, Minnesota 55101
Phone: (651) 296-3353 (Twin Cities Calling Area)
(800) 657-3787 (Outside the Twin Cities)
(800) 627-3529 (Minnesota Relay)
https://www.ag.state.mn.us/default.asp

Maryland residents:
Maryland Attorney General, Consumer Protection Division
200 St. Paul Street
Baltimore, Maryland 21202
Phone: (410) 528-8662
https://www.marylandattorneygeneral.gov/Pages/CPD/default.aspx

Rhode Island residents:
Rhode Island Office of the Attorney General
150 South Main Street
Providence, Rhode Island 02903
Phone: (401) 274-4400
https://riag.ri.gov/

Office of the Indiana Attorney General
Indiana Government Center South
302 W. Washington St., 5th Floor
Indianapolis, Indiana 46204
Phone: (317) 232-6201
https://www.in.gov/attorneygeneral/

Kentucky residents:
Kentucky Attorney General
1024 Capital Center Drive, Suite 200
Frankfort, Kentucky 40601
Phone: (502) 696-5300
https://www.ag.ky.gov/Pages/default.aspx

Special Information for Delaware, Iowa, New Hampshire, Nevada, New Jersey, Oregon, Texas, Utah, Minnesota, Maryland, Rhode Island, Indiana, and Kentucky Residents

Residents of the States of Delaware, Iowa, New Hampshire, Nevada, New Jersey, Oregon, Texas, Utah, Minnesota, Maryland, Rhode Island, Indiana, and Kentucky have the right to opt out of the sale of certain pieces of their information to other companies who will sell or license their information to others. At this time, Flynn does not engage in the sale of information.

For residents of Oregon, the controller is defined as Hut American Group LLC, Apple American Group II, LLC, RB American Group LLC; Apple Oregon LLC; RB Idaho LLC; Hut Northwest LLC; or Flynn Restaurant Group LLC.

Residents of New Jersey may designate an authorized agent to exercise their right to opt out on their behalf.

Changes to This Policy

We may make changes to this Policy from time to time. We will post any changes, and such changes will become effective when they are posted. The date of the most recent update is listed under the “Effective Date” at the top of this Policy. Your continued use of our Services following the posting of any changes will mean you accept those changes.

For questions about our privacy practices, contact us at:

Flynn Group
225 Bush Street, Suite 1800
San Francisco, CA 94104
Email: privacy@flynnrg.com
1-855-575-7220