Privacy Policy

Effective May 19, 2026 · Georgia Bison Co., Cumming, GA

1. Who we are

Georgia Bison Co. is a family-owned bison meat business based in Cumming, Georgia. "Georgia Bison," "we," "us," and "our" all refer to Georgia Bison Co.

This Privacy Policy explains what information we collect when you use georgiabison.com (the "Site"), how we use it, and the choices you have.

2. Information we collect

We collect only what we need to run a subscription meat business:

• Account information — your name, email address, phone number, and delivery address. You provide this when you sign up for a subscription.
• Order information — your subscription tier, the cuts you select for each box, delivery preferences, and order history.
• Payment information — handled entirely by Square, our payment processor. Square gives us a token (a meaningless string of characters) that we use to charge your card on file. We never see, store, or transmit your card number, CVV, or expiration date.
• Communications — when you contact us, we keep a record so we can help you.
• Basic technical information — like IP address and browser type, used to keep the Site secure and working. We do not use third-party advertising trackers or analytics that profile you across other sites.

3. How we use your information

• To deliver your boxes (we need an address to ship to)
• To process payments and manage your subscription
• To send you order confirmations, delivery notifications, and important account changes
• To send you occasional updates about new products, recipes, or promotions — only if you opted in, and you can unsubscribe at any time
• To respond when you contact us
• To meet legal obligations (taxes, food safety reporting, etc.)

4. Third parties we share information with

We share only what each of these providers needs to do their job:

• Square — payment processing and recurring subscriptions. See Square's privacy policy.
• Resend — transactional email (order confirmations, sign-in links).
• Email marketing platform (e.g., Mailchimp, Klaviyo, or ConvertKit) — for sending the newsletter and seasonal promotions to customers and newsletter subscribers who opted in. We share only the information needed to deliver the email (your email address, first name, city/state, and active tier for segmentation). We do not share order details or payment information with marketing platforms. You can opt out from your account dashboard or via the unsubscribe link in any marketing email.
• UPS / FedEx / USPS — to ship your box, we hand them your name, address, and (if you opted in) phone number for delivery notifications.
• Render & Cloudflare — our hosting and content-delivery providers. They process traffic on our behalf.
• Twilio (if and when we enable SMS sign-in) — for texting verification codes. Not active at launch.

We do not sell, rent, or trade your personal information to advertisers, data brokers, or anyone else.

5. SMS messaging consent (TCPA)

If you opted into delivery notifications at signup or sign in by text, you consented to receive automated SMS messages from us at the phone number you provided. Message and data rates may apply. Message frequency varies based on your subscription cadence and shipments. You can reply STOP to any message to opt out, or HELP for help. Consent to receive marketing or transactional SMS is not a condition of any purchase.

If you signed up directly with UPS My Choice or FedEx Delivery Manager for tracking notifications, that's a separate relationship between you and the carrier — their privacy policy applies.

6. Email and CAN-SPAM

At signup we ask for two separate email permissions:

• Transactional emails — required to run your subscription. These include order receipts, "build your box" reminders, shipping confirmations, sign-in links, account-change notifications, and important service notices (e.g., delivery delays). You cannot opt out of these while you have an active subscription. They are not promotional.
• Marketing emails — optional. With your consent we send occasional updates: new product launches, seasonal cuts, recipes, promotions, and farm news. The signup checkbox is pre-checked; you can uncheck it at signup, change your mind from your account dashboard at any time, or click the unsubscribe link in any marketing email. Opt-out takes effect immediately and is honored permanently unless you re-opt-in.

We record the date and source of your consent (signup form, account dashboard, etc.) so we can prove compliance if needed and so we know when to age off stale consent.

Newsletter subscribers who never become customers (people who entered email at the discount-code form) are treated the same as marketing-opted-in customers: they can unsubscribe from any email or by replying to us directly.

7. Cookies and tracking

This section is also our Cookie Policy. We organize cookies into three categories. You can change your choice at any time — see "How to change your choice" at the bottom of this section.

Strictly necessary (always on)

These cookies are required for the Site to work. Without them you cannot sign in or maintain a session. They are exempt from consent under GDPR/ePrivacy because they are necessary to deliver the service you're paying for.

• gb_session — keeps you signed in after you log in. Expires after 30 days.
• gb_staff — keeps Georgia Bison team members signed in to the internal staff site. Expires after 7 days. Not set on your visit unless you're a staff user.
• gb_cookie_consent — records the cookie choice you made in our banner so we don't ask you again on every visit. Expires after 365 days.

Analytics (off by default)

We are not currently using analytics cookies. If we add a service like Google Analytics in the future to understand which pages people visit and which products they're interested in, it will be loaded only after you click "Accept all" in our cookie banner. We will list it here when it's live.

Marketing (off by default)

We are not currently using marketing cookies. If we add advertising pixels like Meta (Facebook) Pixel or TikTok Pixel in the future to show our product to people who've visited the Site, those will also load only after you click "Accept all" in our cookie banner. We will list them here when they're live, and the categories they fall into.

What we don't use

We do not use cross-site tracking, third-party advertising trackers, fingerprinting, or any technology that profiles you across sites you visit outside of georgiabison.com. We do not sell, rent, or share personal information to advertisers or data brokers (see Section 4).

How to change your choice

You can change your cookie preferences at any time by clearing the gb_cookie_consent cookie in your browser settings — our banner will reappear on your next visit. You can also email us at info@georgiabison.com and we'll remove any analytics data tied to your account.

For California residents: under CCPA/CPRA, you have the right to opt out of the sale or sharing of personal information. We don't sell or share your personal information for advertising, so there's no opt-out for you to exercise — but you can still email us to confirm or to request deletion under Section 8.

8. Your rights

Regardless of where you live, you have the right to:

• Access the personal information we have about you
• Correct anything that's wrong (or update it yourself in your account)
• Delete your account and the personal information tied to it
• Cancel your subscription at any time
• Opt out of marketing emails and SMS

To exercise any of these, email us at the address below. We'll respond within 30 days. Note that we may need to keep some information for legal reasons (tax records, fraud prevention) — we'll tell you exactly what and why if that comes up.

9. Children's privacy

Our Site and services are intended for adults. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, please contact us and we will delete it.

10. Data security

We use HTTPS everywhere, hash passwords with bcrypt, store card details only as Square tokens (never raw), and host on secure infrastructure with daily encrypted backups. No system is perfect, but we take this seriously and will notify affected customers promptly if a breach ever occurs.

11. Data retention

We keep your account information as long as you have an active subscription. After you cancel, we keep the minimum necessary to comply with tax law (typically 7 years for financial records) and then delete the rest. You can request earlier deletion of non-required information at any time.

12. International users

We currently only ship within the United States. Our servers are located in the U.S. By using the Site from outside the U.S., you understand that your information will be transferred to and processed in the U.S.

13. Changes to this policy

If we make material changes, we'll email active customers and update the effective date at the top. The current version is always the one on this page. Continued use of the Site after a change means you accept the updated policy.

14. Contact us