Legal

Privacy & Cookie Policy

Effective May 25, 2026 · Last updated May 25, 2026

1. Who we are

This Privacy Policy explains how Bosq Aspen LLC, 312 S Mill Street, Aspen, CO 81611 ("Bosq", "we", "us") collects, uses, and shares personal information when you visit www.bosqaspen.com (the "Site") or make a reservation with us.

2. Personal information we collect

We collect only what we need to host you well. Specifically:

Category	Examples	Source
Identifiers	First and last name, email address, phone number	You, via Tock at the time of booking, or by email/phone
Reservation details	Date, time, party size, dietary restrictions or allergies you choose to share, special occasion notes	You, via Tock
Payment information	A credit-card token used to authorize a per-seat deposit. We do not see or store your full card number, expiration date, or CVV — those are held by Stripe, our PCI-DSS Level 1 payment processor, on Tock's platform.	Stripe / Tock
Communications	Content of emails you send to info@bosqaspen.com or molly@bosqaspen.com	You
Technical / Internet activity	IP address (truncated where possible), browser type, device type, pages viewed, referring URL, approximate city-level location derived from IP	Automatically, via our hosting provider Vercel

We do not collect government identifiers (SSN, driver's licence number), date of birth, home address, biometric information, precise geolocation, or sensitive categories such as health (beyond a dietary restriction you volunteer), race, religion, sexual orientation or political opinion.

3. How we use it

To accept, confirm, modify and honor your reservation.
To authorize and, where applicable, charge the per-seat deposit per our cancellation policy.
To prepare for and accommodate dietary restrictions or special occasions you tell us about.
To respond to your email or phone inquiry.
To send occasional service messages about your booking (we do not send marketing emails without your opt-in).
To operate, secure and improve the Site, including measuring aggregate traffic and detecting abuse.
To comply with legal obligations (tax, food-safety records, lawful requests from authorities).

We do not sell your personal information. We share it only with the limited service providers needed to run the restaurant:

Tock (Squarespace, Inc.) — reservation platform. Privacy policy: exploretock.com/privacy.
Stripe, Inc. — payment processing for deposits. Privacy policy: stripe.com/privacy.
Vercel, Inc. — hosting of this Site, at 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Privacy policy: vercel.com/legal/privacy-policy.
Google LLC — Google Fonts (Fraunces, Inter) and the embedded Google Maps tile in our footer. Google may receive your IP and user-agent when these resources load. Privacy policy: policies.google.com/privacy.
Email and accounting providers we use to run the business.
Authorities, where required by valid legal process or to protect rights, property or safety.

In the event of a merger, acquisition, or sale of substantially all of our assets, your information may be transferred as part of that transaction, subject to the same protections described here.

5. Retention

We keep reservation records for three (3) years from your last visit, then delete or anonymize them, unless a longer period is required by law (for example, tax records, typically seven years). Email correspondence is kept for three years from the date of the last message in the thread. Technical logs are kept for up to ninety (90) days for security purposes.

6. Security

The Site is served exclusively over HTTPS with HSTS, modern TLS, and a strict Content-Security-Policy. Reservation and payment data are encrypted in transit and at rest at Tock and Stripe. We restrict internal access to personal information on a need-to-know basis. No system is perfectly secure; we will notify affected guests and regulators of any qualifying personal-information breach as required by Colorado law (CRS § 6-1-716) and other applicable statutes.

7. Cookies & similar technologies

This Site is intentionally light on tracking. We do not run Google Analytics, Meta Pixel, Hotjar, or any third-party advertising or behavioural tracker by default.

Cookies and storage we use

Strictly necessary. The Site may use localStorage to remember small preferences such as reduced-motion or your selected tasting menu before you continue to Tock. No personal identifier is stored.
Third-party resources. Google Fonts and the embedded Google Maps tile may set their own cookies once loaded; we have no control over those. You may block them with your browser settings.
Reservation funnel. Once you click "Continue to Tock", you leave the Site and Tock's own cookie banner applies.

Most browsers let you refuse or delete cookies. You can also send a Global Privacy Control (GPC) signal — we honor it as a valid request to opt out of any "sale" or "sharing" under California law (see section 9).

8. Children's privacy

Our Site is intended for adults. We do not knowingly collect personal information from children under 13 (or under 16 in the EU/UK). Alcohol is served only to guests aged 21 or older. If you believe a child has provided us personal information, contact us and we will delete it.

9. California privacy rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the following rights:

Right to know the categories and specific pieces of personal information we have collected about you, the sources, the business purpose, and the categories of third parties we share it with.
Right to delete the personal information we hold about you, subject to limited legal exceptions.
Right to correct inaccurate personal information.
Right to limit the use of sensitive personal information (we do not use sensitive PI beyond what is necessary to provide the service).
Right to opt out of the "sale" or "sharing" of your personal information — see section 10.
Right to non-discrimination for exercising any of these rights.
Right to designate an authorized agent to exercise these rights on your behalf.

In the preceding twelve (12) months, we collected the categories of personal information listed in section 2, for the business purposes listed in section 3. We disclosed identifiers, reservation details, and payment tokens to the service providers listed in section 4. We did not "sell" personal information for monetary consideration in that period.

To exercise your rights, email info@bosqaspen.com with the subject "California Privacy Request" or call +1 (970) 710-7299. We will verify your identity using information you have already provided (for example, the email used to book) and respond within 45 days, as permitted by law.

10. Do Not Sell or Share My Personal Information

Bosq does not sell your personal information for money. However, certain third-party resources we use (e.g., Google Fonts, Google Maps) may transmit your IP address and user-agent to Google, which under California law's broad definition could be considered "sharing" for cross-context behavioural advertising purposes.

You can opt out at any time by:

Sending a Global Privacy Control (GPC) signal via your browser — we will treat it as a valid opt-out.
Emailing info@bosqaspen.com with the subject "Do Not Sell or Share".

Once we receive your request, we will remove the third-party Maps embed and Google Fonts for your session and ask our hosting providers to do the same where technically feasible.

11. Other US state rights

Residents of Colorado (Colorado Privacy Act), Virginia (VCDPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana and other states with comprehensive consumer-privacy laws have similar rights to access, correct, delete, and opt out of targeted advertising. To exercise these rights, contact info@bosqaspen.com. Colorado residents may also appeal a denial of a request by replying to our decision; if unsatisfied, they may contact the Colorado Attorney General at coag.gov.

If you visit the Site from the European Economic Area, the United Kingdom or Switzerland, our legal bases for processing your personal information are:

Performance of a contract (Art. 6(1)(b)) — to confirm and honor your reservation.
Legitimate interests (Art. 6(1)(f)) — to operate and secure the Site, prevent fraud, and respond to your inquiry.
Legal obligation (Art. 6(1)(c)) — to keep tax and food-safety records.
Consent (Art. 6(1)(a)) — for optional marketing emails, if any.

You have the right to access, rectify, erase, restrict, port, and object to the processing of your personal data, and to lodge a complaint with your local supervisory authority (in the EU, the list is at edpb.europa.eu; in the UK, the ICO at ico.org.uk). Personal data is transferred to the United States; transfers rely on the EU–US Data Privacy Framework (where applicable) and/or Standard Contractual Clauses entered into with our processors.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of the page and, for material changes, post a prominent notice on the Site.

14. Contact

Bosq Aspen LLC
312 S Mill Street, Aspen, CO 81611, United States
Email: info@bosqaspen.com
Phone: +1 (970) 710-7299

Hosting provider: Vercel, Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA — vercel.com/legal/privacy-policy.