Privacy Policy

Effective date: September 19, 2026 · Last updated: October 8, 2026

1. Who We Are and What This Policy Covers

Little Mountain Creamery ("we," "us," or "our") operates a retail gelato and coffee shop at 7872 Crile Road, Painesville, Ohio 44077, and the website at lmcreamery.com (the "Site").

This policy explains what personal information the Site collects, why we collect it, which service providers receive it, how long it is kept, and what you can ask us to do about it. It covers the public pages of the Site only. It does not cover what happens after you leave the Site for a third-party platform — most importantly, it does not cover Clover, where online orders and payments are placed and processed. It also does not cover information you give us in person, by telephone, or on a social media platform.

2. The Short Version

• You can browse the entire Site without giving us any personal information and without creating an account. There is no customer login.
• We collect personal information in exactly two places: the contact form and the catering inquiry form.
• We do not sell, rent, or trade personal information, and we do not use it for advertising or behavioral targeting.
• The Site runs no analytics service, no advertising pixel, and no tag manager. We do not build visitor profiles.
• The Site itself sets no cookies and stores nothing on your device. Some content is loaded from Google and JotForm, which means those companies see your IP address — section 6 explains this in detail.
• Payment card information never reaches us or this Site. It is handled entirely by Clover.

3. What We Collect, Why, and Who Receives It

The table below is a complete inventory of the personal information this Site handles.

What we do not collect. We do not ask for and do not knowingly collect any of the following through the Site: payment card or bank account details; government identification numbers; precise device location; health, biometric, genetic, or dietary-health information; racial or ethnic origin; religious belief; political opinion; union membership; or sexual orientation. Please do not include any of that information in a contact or catering message. If you tell us about a food allergy so that we can serve you safely, we use it only for that purpose.

What our menu database holds. Our live menu, hours, pricing and news are stored in a Google Firebase database. That database holds business content only. It holds no customer records, and the Site never writes anything you submit into it.

4. How We Use Your Information

We use the information described above only for these purposes:

• To read and reply to a question, comment, or piece of feedback you send us;
• To prepare a quote for, arrange, and fulfill a catering request, custom cake, or event order;
• To answer gift card and event inquiries;
• To consider an employment inquiry you send us through the contact form, or an application you submit through our online employment application;
• To operate, secure, and maintain the Site, and to prevent spam and abuse;
• To keep ordinary business records and to comply with law.

We do not use your information to advertise to you, to build a profile of you, to make any automated decision about you, or to train any machine-learning or artificial-intelligence model. We will not add you to a mailing list because you sent us a message; if we ever start a mailing list, it will be a separate, clearly-labeled sign-up.

5. Service Providers We Rely On

The Site uses a small number of outside providers. Each one is named below, with what it does for us and a link to its own privacy policy. This list is complete as of the date at the top of this page.

• Netlify — hosts the Site, serves its pages, keeps server logs, and operates the contact form and stores its submissions — Netlify Privacy Policy
• JotForm, Inc. — hosts and operates the catering inquiry form embedded on our Catering page and the online employment application that opens from our Join the Team sections, and stores what you submit through them —JotForm Privacy Policy
• Google LLC — in three separate roles: Google Fonts delivers the Site's typefaces on every page; Google Firebase stores and delivers our menu, hours and news content, and holds our staff logins; and Google Maps supplies the embedded map on our Contact page — Google Privacy Policy
• Clover / Fiserv, Inc. — operates the online ordering and payment platform we link out to. Clover is not embedded in this Site; you leave our Site to use it, and there Clover acts on its own terms — Clover Privacy Policy

We use no other analytics, advertising, marketing, session-recording, chat, or tracking provider. If that ever changes, we will update this policy before turning the new service on.

6. Cookies, Web Storage, and Requests to Third Parties

What this Site does on your device

The Site sets no cookies of its own and stores nothing in your browser's local storage. There is no advertising cookie, no analytics cookie, and no visitor identifier. We do not need a cookie to run the Site because there is nothing to remember: no customer account, no shopping cart, and no session.

What third parties may do

Some of the Site's content is loaded from other companies' servers. Whenever your browser fetches something from another company, that company necessarily receives your IP address, your browser and device type, and the time of the request, and it may set its own cookies or use its own browser storage under its own policy. On this Site that happens in four ways:

• Typefaces from Google Fonts, on every page. This is a request for font files; Google receives your IP address as a result.
• Menu, hours and news content from Google Firebase, on every page. Every page shows our current hours in its footer, which are loaded live from that database, so this request happens site-wide. This is how a flavor change or an early closing made in our shop appears on the Site straight away.
• The embedded Google Map on our Contact page. This is the one place where an interactive Google product is placed directly into a page, and Google may set cookies on your device as a result. If you would rather avoid that, do not visit our Contact page, or use your browser's blocking or private-browsing features; our full address and telephone number appear in the footer of every page, so you never need the map.
• The embedded JotForm catering form on our Catering page. JotForm may set its own cookies or use browser storage to make the form work. If you would rather not load it, you can send us a catering inquiry by email or telephone instead.

The online employment application is different: it is not on this Site at all. The "Apply Today" buttons in our Join the Team sections are links. Nothing from JotForm loads on our pages until you select one, and the form then opens in a new tab on JotForm's own website. That page belongs to JotForm, not to us: JotForm may set its own cookies there, and it handles what you type into it under its own privacy policy (linked in section 5). If you would rather not use it, you can ask about a job by telephone or through the contact form instead.

Why there is no cookie consent banner

We have deliberately not put a cookie consent pop-up on this Site. A banner that appears to ask permission while the page has already loaded everything would be misleading, and we would rather tell you plainly what happens than show you a box to dismiss. Because this Site sets no cookies of its own, runs no analytics, and carries no advertising or tracking technology, there is nothing to consent to and no profile being built. The disclosure in this section is the honest description of what occurs.

Your controls

You can block or delete cookies, block third-party content, and send Do Not Track or Global Privacy Control signals through your browser settings or an extension. Blocking Google's servers will change how the Site looks — the typefaces will fall back to your system fonts and the map will not appear — but all of our information and every page will still work.

7. How We Share Information

We share personal information only in these circumstances:

• With the service providers named in section 5, and only so that they can perform the function described there for us;
• Where the law requires it — for example in response to a subpoena, court order, or lawful request from a public authority;
• To protect people or property — where we reasonably believe disclosure is necessary to prevent harm, fraud, or a threat to safety, or to establish or defend a legal claim;
• In a business transfer — if the business is sold or reorganized, business records may transfer to the new owner, who would remain bound by this policy until it gives notice of a replacement.

We do not share personal information with data brokers, advertising networks, or social media platforms. We do not sell or share personal information for money or for any other valuable consideration, and we do not disclose it for cross-context behavioral advertising.

8. How Long We Keep Information

We keep what you send us for as long as we need it to deal with your inquiry and to keep reasonable business records, and then we delete it.

• Contact form submissions held in Netlify: kept for as long as is reasonably necessary to answer your inquiry and to keep our ordinary business records, and then deleted when they are no longer needed
• Catering inquiries held in JotForm: kept for as long as is reasonably necessary to answer and fulfill your inquiry and to keep our ordinary business records, and then deleted when they are no longer needed
• Employment applications held in JotForm: kept for as long as is reasonably necessary to consider your application and to keep our ordinary business records, and then deleted when they are no longer needed
• Email correspondence with you: kept with our ordinary business records
• Records of a completed catering booking: kept as long as tax and accounting rules require
• Server logs: kept by Netlify under its own retention schedule; we do not copy them

You can ask us to delete your submission sooner at any time — see section 11.

9. Security and Breach Notification

The Site is served only over an encrypted connection (HTTPS), so what you type into our forms is encrypted in transit. We keep the number of people who can see form submissions small, and we rely on established providers to store them. We accept no payment card details on this Site at all, which removes that risk entirely.

No website or electronic storage can be made perfectly secure, and we do not claim otherwise. If personal information we hold about you were involved in a security breach, we would notify you as required by Ohio law, which currently requires notice in the most expedient time possible and not later than forty-five days after discovery, subject to the needs of law enforcement (Ohio Rev. Code § 1349.19).

10. Children's Privacy

Little Mountain Creamery is a family business, and we are glad that children enjoy our gelato. Please read this section carefully, because it is written for parents as much as for us.

The Site is a general-audience website about a local shop. It is not directed to children, it has no games, no accounts, no chat, no uploads, no rewards program, and no children's section. We do not knowingly collect personal information online from a child under 13. The only places the Site can collect anything are the contact form and the catering inquiry form, both of which are meant for adults arranging inquiries, orders and events.

If a child under 13 sends us information through a form anyway, we will delete it as soon as we become aware, and we will not use it or disclose it in the meantime. If you are a parent or guardian and you believe your child has sent us something, contact us using the details in section 19 and we will delete it and confirm that we have done so. You do not need to give a reason.

We ask that anyone under 13 not use our forms, and that a parent or guardian send the message instead. If you are a young person interested in working with us, please ask a parent or guardian to help you get in touch, or simply come and speak to us at the shop.

This section reflects our obligations under the United States Children's Online Privacy Protection Act and the Federal Trade Commission's Children's Online Privacy Protection Rule (16 C.F.R. Part 312).

11. Your Choices and How to Make a Request

These rights are offered to everyone who contacts us, wherever you live, regardless of whether a privacy statute happens to require it. You may ask us to:

• Tell you what we hold — we will describe the information we have about you and where it came from;
• Give you a copy of what you submitted;
• Correct anything inaccurate;
• Delete your submission and our related correspondence;
• Stop contacting you about an inquiry.

Email lmcteam@littlemountaincreamery.com or telephone 440.754.3158. Please tell us what you are asking for and use the email address you originally wrote from, or give us enough detail to find your message — this is the only way we can be sure we are not handing your information to someone else. We aim to respond within 30 days. There is no charge, and we will not treat you any differently for asking. We may keep what we must to comply with law, resolve a dispute, or complete a transaction you have asked for, and we will say so if that applies.

12. California Residents

We want to be straightforward about this rather than imply an obligation we do not have. The California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies to a business only if it meets one of the thresholds in California Civil Code § 1798.140(d) — broadly, annual gross revenues above a statutory figure (adjusted for inflation, and set at $26,625,000 with effect from January 1, 2025), or buying, selling, or sharing the personal information of 100,000 or more California consumers or households in a year, or deriving 50% or more of annual revenue from selling or sharing personal information. Little Mountain Creamery is a single-location shop in Lake County, Ohio and does not meet any of these thresholds, so the CCPA does not currently impose obligations on us.

We are telling you what we do anyway, because the substance matters more than the threshold:

• The categories of personal information we collect, our purposes, the categories of recipients, and our retention periods are set out in the table in section 3 and in section 8. That table is the notice-at-collection information in substance.
• We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are used in the CCPA. Because there is nothing to opt out of, we have no "Do Not Sell or Share My Personal Information" link, and we do not need one.
• We do not collect or process sensitive personal information through the Site, so there is nothing for you to limit.
• We do not use personal information for profiling or for any automated decision that affects you.
• We voluntarily honour requests to know, to obtain a copy of, to correct, and to delete personal information, and we will not discriminate against you for making one. Use section 11.
• An authorized agent may make a request on your behalf if you give us written permission we can verify.

If our business ever grows past those thresholds, or if we ever adopt advertising technology, we will amend this policy and implement the statutory mechanisms before doing so.

13. Ohio and Other U.S. States

Ohio has not enacted a comprehensive consumer data privacy law, so Ohio residents do not currently have statutory access, correction, deletion or opt-out rights against a private business under Ohio law. Ohio law does govern data breach notification, which is addressed in section 9. Several other states have enacted comprehensive privacy laws, and each applies only to businesses above its own thresholds, which a shop of our size does not meet. Wherever you live in the United States, the rights described in section 11 are available to you from us as a matter of practice.

14. Visitors From the EEA, the United Kingdom, and Switzerland

We serve a local market. We sell and serve at one location in Painesville, Ohio, our ordering and catering are for pickup and local events, our prices are in U.S. dollars only, and we do not advertise, ship, or offer services into Europe. On that basis we do not consider ourselves to be offering goods or services to, or monitoring the behavior of, people in the European Union or the United Kingdom within the meaning of Article 3(2) of the EU General Data Protection Regulation and the equivalent provision of the UK GDPR. For the same reason, and relying on the exemption in Article 27(2)(a) of the GDPR for processing that is occasional and low-risk, we have not appointed a representative in the EU or the UK.

You are nonetheless welcome to read the Site and to write to us, and if you do, we will treat your information as follows:

• Why we are allowed to hold it. If the GDPR were applied to an inquiry you choose to send us, we would rely on our legitimate interest in reading and answering correspondence addressed to us (Article 6(1)(f)); on the need to take steps at your request before entering a contract, where you are asking us to quote for catering or an order (Article 6(1)(b)); and on our legitimate interest in keeping the Site secure and available for server logs (Article 6(1)(f)).
• Your rights. We will honour requests for access, a copy, rectification, erasure, restriction, portability, and objection. Use section 11; we aim to respond within 30 days.
• Where your information goes. We are based in the United States and so are our providers (Netlify, JotForm, Google). Anything you send us is stored in the United States. We do not currently have Standard Contractual Clauses or any other Article 46 transfer mechanism in place, because we do not operate a European business. If you are in the EEA, the UK, or Switzerland and you would prefer that your details not be transferred to and stored in the United States, please telephone us instead of using a form.
• Complaints. You can always complain to us first. You also have the right to lodge a complaint with your national data protection authority, or with the Information Commissioner's Office if you are in the United Kingdom.

15. Do Not Track and Global Privacy Control

The Site does no tracking, so a Do Not Track or Global Privacy Control signal has nothing to switch off here. We do not sell or share personal information, so there is no opt-out for such a signal to exercise. We mention this only so that you know the absence of a response is not an oversight.

16. Other Websites and Social Media

The Site links out to Clover for ordering, to Google Maps for directions, and to our TikTok, Facebook and Instagram pages. Those social media links are ordinary links — there is no social media tracking pixel on this Site, and those platforms learn nothing about your visit unless you click through. Once you follow any external link, you are on someone else's website under their terms and their privacy policy, and this policy no longer applies. We are not responsible for their practices.

17. Our Staff Dashboard

The Site includes a staff-only page used by our team to update the menu, hours and news. It is protected by a login held with Google Firebase Authentication and holds staff accounts only. It contains no customer information. It is mentioned here only for completeness.

18. Changes to This Policy

If we change how we handle personal information, we will update this page and change the "last updated" date at the top before or when the change takes effect. If we ever make a change that materially affects information we already hold about you — for example adopting analytics or advertising technology, or using your information for a genuinely new purpose — we will say so prominently on the Site, and where the law requires your consent we will ask for it rather than assume it. Continuing to browse the Site does not, by itself, constitute your agreement to a materially different use of information you have already given us.

19. How to Contact Us

For any question about this policy, or to make any request described in section 11, contact us — a real person here reads these:

Little Mountain Creamery
7872 Crile Road, Painesville, Ohio 44077
Phone: 440.754.3158
Email: lmcteam@littlemountaincreamery.com

Please use the same details for any privacy question or request — there is no separate privacy address to write to, and a message sent to the email address above reaches us.

Read our Terms of Service.