Snapshot of the source text at fetch time, not a live mirror of the policy page.
Plain-English summary
This policy from Chipotle highlights several areas of concern. Your data shared during business transactions could be used under a new privacy policy (risk_flags-1). There's no guarantee of 100% data security. Interactions with the chatbot may be recorded, shared, and analyzed by Chipotle and third-party service providers (risk_flags-3, risk_flags-4). Content you post on social media that interacts with Chipotle's services may become publicly visible (risk_flags-5). Chipotle may use deidentified or aggregated customer information for commercial purposes. Different service providers hosting parts of Chipotle's website may use varying tracking technologies, requiring you to manage preferences multiple times. General location data can be used for targeted advertising (data_use-3), and nutrition preferences might also be used for personalization and advertising (data_use-4). Finally, once you turn 18, your account will automatically be enrolled in personalized experiences and marketing (data_use-5).
90% confidence
Ask Verbaterm
Follow up on findings with grounded answers from this review. Not legal advice.
Risk Flags
3 findings
Critical issues and red flags that could indicate significant risk, harm, or unfairness to the user. These are often buried in dense legal language.
high95% confidence
Data disclosed in business transactions may be used under a new privacy policy
In the event of a business transaction, Chipotle reserves the right to disclose any information obtained through its services, and the acquiring party may use this information according to its own privacy policy instead of Chipotle's.
Why it matters: Your personal information may be transferred to another company as part of a business transaction, and that company may then use your information under its own, potentially different, privacy policy.
In the event of a business transaction, such as if we sell or transfer all or a portion of our business or assets (e.g., further to a merger, reorganization, liquidation, or any other business transaction, including negotiations of such transactions), we reserve the right to disclose any information we obtain through the Services. You acknowledge that such transfers may occur and are permitted by this Privacy Policy. To the extent legally permitted, the acquiring party may use the information pursuant to their own privacy policy instead of this one.
Information Disclosed By Us, paragraph 3 · Citation strength: strong
medium90% confidence
Chatbot interactions may be recorded, shared, and analyzed
When you contact Chipotle through their AI-powered chatbot, Pepper, your calls or chats may be recorded, shared, or transcripts created, and this information may be retained, collected, and analyzed by Chipotle and its service providers.
Why it matters: Your conversations and personal information shared with the chatbot may be recorded, shared with third parties, and analyzed, which could impact your privacy.
We may record, share, or create transcripts of your calls to us, your chats with Pepper, or any other method by which you connect with us and may retain the information disclosed during these interactions to assist you in the future, to improve our customer service and service offerings, to meet our legal obligations or to protect our legal interests, as well as for other business purposes that are detailed in this Privacy Policy. We may also use service providers to provide these services which means they may create or have access to these recordings or transcripts, including in real time.
COLLECTION OF INFORMATION, paragraph 10 · Citation strength: strong
medium95% confidence
Public visibility of social media content
When you post or comment on social media or interact with the Services, this content may be visible to the public.
Why it matters: Content you post or comment on social media related to Chipotle's services may become publicly visible, meaning others can see and access it.
When you post or comment on social media or interact with the Services this content may be visible to the public.
Information Disclosed By You, paragraph 1 · Citation strength: strong
Data Use
3 findings
How the company collects, uses, and shares your data, and for what purposes. This includes personal information, browsing history, and location data.
medium90% confidence
Geolocation data can be used for targeted advertising
Chipotle retains general location data, such as zip code, city, state, and country, and this data may be used to identify an audience for targeted advertising.
Why it matters: Even if precise location isn't stored, your general location data can still be used to target you with advertisements.
Chipotle does retain general location data such as your zip code, city, state, and country and this general location data may be used to identify an audience for targeted advertising.
COLLECTION OF INFORMATION, paragraph 11 · Citation strength: strong
medium90% confidence
Nutrition preferences may be used for personalization and advertising
Chipotle may use your nutrition preferences to personalize your experience on their Website and App and to send you advertisements related to these preferences.
Why it matters: Your stated nutrition preferences can be used to tailor your online experience and marketing messages, potentially influencing your choices based on past information.
We may use your nutrition preferences to personalize your experience on our Website and App and we (or entities who send advertisements on our behalf) may also send you advertisements related to these preferences (e.g. we may suggest vegetarian options when you are on our Website or send you advertisements associated with your nutritional preferences).
COLLECTION OF INFORMATION, paragraph 13 · Citation strength: strong
medium90% confidence
Automatic enrollment in personalized experience and marketing for 18-year-olds
Once an individual turns 18, their account will automatically be enrolled in personalized experience and marketing.
Why it matters: Upon turning 18, your account will automatically begin receiving personalized experiences and marketing, potentially without your explicit consent at that time.
Once an individual turns 18, their account will automatically be enrolled in personalized experience and marketing.
PRIVACY FOR THOSE UNDER THE AGE OF 18, paragraph 2 · Citation strength: strong
Cancellation and Renewal
Not clearly stated
Details on how subscriptions or services can be cancelled or renewed, including any associated fees or notice periods.
?
Not clearly stated
No cited billing terms — wording is unclear
The policy does not contain information about cancellation or renewal terms for any services.
Gotchas
Not clearly stated
Potentially overlooked clauses that could lead to unexpected outcomes or costs.
?
Not clearly stated
No cited gotchas — wording is unclear
The policy does not contain any obvious 'gotchas' based on the provided text.
Protections
3 findings
User-friendly clauses and company commitments that provide transparency, control, or recourse for the user.
Protection95% confidence
No collection of personal information from children under 13
Chipotle's online services are not intended for children under 13, and they do not knowingly request or seek to collect personal information from anyone under 13.
Why it helps: This commitment helps protect the privacy of young children by preventing the intentional collection of their personal data.
The online Services are not intended for, and are not intentionally targeted to, children under 13, and we do not knowingly request or seek to collect personal information from any person under 13 years of age through the Services.
PRIVACY FOR THOSE UNDER THE AGE OF 18, paragraph 1 · Citation strength: strong
Protection95% confidence
Deletion of personal information for children under 13 if collected
If Chipotle learns that their online services have received personal information directly from a child under the age of 13, they will delete that information in accordance with applicable law.
Why it helps: This offers a safeguard for children's privacy by ensuring that any inadvertently collected personal data from those under 13 will be removed.
If we learn that the online Services have received personal information directly from a child who is under the age of 13, we will delete the information in accordance with applicable law.
PRIVACY FOR THOSE UNDER THE AGE OF 18, paragraph 1 · Citation strength: strong
Protection90% confidence
Privacy settings for minors aged 13-17 are high by default
Account settings for individuals aged 13-17 ("Minors") will be set to high privacy selections by default, meaning they will not receive marketing emails, text messages, push notifications, personalized marketing, or have their precise geolocation used or personal information sold/shared with non-service provider third parties unless they specifically opt in or consent.
Why it helps: This provides enhanced privacy protection for minors by requiring explicit consent for various marketing and data-sharing activities, ensuring their data is not used for these purposes by default.
The account settings for individuals who indicate they are age 13-17 (“Minors”) will be set to high privacy selections by default. Minors will not receive marketing emails, text messages, push notifications, personalized marketing, personalized experience, or have their precise geolocation utilized/have their personal information sold or shared with non-service provider third parties unless they opt in/consent to these respective options.
PRIVACY FOR THOSE UNDER THE AGE OF 18, paragraph 2 · Citation strength: strong
Report an issue
Flag a citation problem, stale policy text, or incorrect company match.
Verbaterm boundaries
This public review is informational only and is not legal advice. Verbaterm shows only findings tied to the cited source snapshot above.