Last updated October 4, 2026
Privacy Policy
On this page
- Who we are and what this policy covers
- Information we collect
- Cookies and similar technologies
- How we use information
- How we share information
- How long we keep information
- How we protect information
- Your choices and rights
- Additional information for residents of certain states
- Children’s privacy
- Links to other sites and services
- Visitors from outside the United States
- Changes to this policy
- Contact us
Who we are and what this policy covers
Chattahoochee Food Works (“CFW,” “we,” “us,” or “our”) is a food hall, communal bar, and events venue at The Works, 1235 Chattahoochee Ave NW, Atlanta, GA 30318. CFW is part of the Gansevoort Companies LLC family of food halls, and this website is operated by CFW together with the affiliated companies that own, manage, and operate the venue, including Baconboy Hospitality LLC.
This Privacy Policy explains how we collect, use, share, and protect personal information when you visit chattahoocheefoodworks.com (the “Site”), send us a message, join our email list, or submit an event inquiry through the Site. It also covers the staff dashboard our team uses to run the Site.
It does not cover what happens inside the hall or elsewhere offline. The independently owned kitchens and shops in the hall run their own point-of-sale, online ordering, and delivery services, and their privacy practices apply to anything you share with them. The Works and its other tenants are also independent of us.
Information we collect
We collect only what we need to run the Site and to respond to you.
Information you give us
- Messages. When you use the contact form on the Connect page, we collect your name, email address, phone number (optional), the type of inquiry you choose (general, press, private events, vendor leasing, or careers), and your message. If you reply by email to one of our responses, we keep your reply together with the original message so our team can follow the whole conversation.
- Email list. When you join our email list, we collect your email address and note which sign-up form you used.
- Event inquiries. The private-event inquiry form that opens on the Site is provided by Tripleseat, the event-management software we use. You enter details such as your name, contact information, event type, date, and guest count, and the form sends them to our Tripleseat account.
Please do not send payment card numbers, government ID numbers, passwords, or detailed health information through the Site. If you have a food allergy or dietary need, share only what is necessary to help us plan, and tell the kitchen directly when you order.
Information collected automatically
- Technical data. Like most websites, our servers and our hosting provider receive your IP address, browser and device type, the pages you request, the date and time, and the page that referred you. We use this to deliver pages, keep the Site secure, and diagnose problems.
- Abuse prevention. To stop spam and automated attacks, we limit how often forms and sign-in pages can be used. For that we use your IP address after scrambling it with a secret value (a hash), so the stored counter does not reveal it. The counters expire automatically after a short time, from minutes to hours.
- Browser storage. The Site saves two small preferences in your browser’s local storage: that you have seen the cookie notice, and whether you have already closed the welcome pop-up. They stay on your device and are not used to track you.
- Embedded content. The Visit page shows a Google map, and the event inquiry form loads software from Tripleseat and Google reCAPTCHA, a spam-protection tool. When these load, those companies receive your IP address and browser details and may set their own cookies. Their handling of that data is governed by their own policies, linked below.
Staff dashboard accounts
If you are a member of our team or a contractor we have invited to the Site’s dashboard, we keep your name, work email address, role, a hashed (not readable) password, an optional profile photo, and the records needed to keep your account secure, such as password-reset requests. A sign-in cookie keeps you signed in and expires after one hour. These accounts are not open to the public.
Information from other sources
Our service providers send us the information you submit through them (for example, Tripleseat passes along your event inquiry), and a planner, assistant, or colleague may contact us on your behalf.
How we use information
We use personal information to:
- respond to your messages and to press, careers, vendor, and event inquiries;
- plan, quote, and manage private events and vendor-leasing discussions;
- send the email updates you asked to receive, which you can stop at any time;
- operate, maintain, and secure the Site, including preventing spam, fraud, and abuse;
- improve the Site and our programming, for example by learning which questions people ask us;
- administer staff accounts; and
- comply with the law, respond to lawful requests, and protect our guests, our team, and our rights.
We do not use personal information to make automated decisions that have legal or similarly significant effects on you, and we do not build marketing profiles from it.
How long we keep information
We keep personal information only as long as we need it for the purposes above, and then delete or de-identify it. In practice:
- email-list addresses are kept until you unsubscribe or ask us to delete them;
- messages and event inquiries are kept for as long as needed to answer you and manage the related event, lease, or request, and afterward for our business, tax, and legal records;
- technical logs and abuse-prevention counters are short-lived and are managed by our providers; and
- deactivated staff accounts are permanently deleted after a short retention period (currently 90 days).
How we protect information
We use safeguards that are reasonable for a site of this size, including encrypted connections (HTTPS), hashed staff passwords, role-based access limited to authorized team members, limits on repeated sign-in and form attempts, spam controls, and one-hour staff sessions.
No website or email system is completely secure, so we cannot guarantee absolute security. If a security incident affects your personal information, we will notify you and the authorities as the law requires.
Your choices and rights
- Email. Every marketing email has an unsubscribe link, and you can also email us to opt out. We will stop promptly, and in any event within 10 business days. We may still send messages about a request you made.
- Access, correction, and deletion. You can ask us what personal information we hold about you, ask for a copy, ask us to correct it, or ask us to delete it. Email info@chattahoocheemrkt.com with “Privacy request” in the subject line, or write to the address below, and give us enough detail to find your records. We will ask you to confirm that you control the email address you used. We aim to respond within 45 days, and if we need more time we will tell you why.
- Cookies and storage. Use your browser settings, as described above.
We will not treat you differently for exercising any of these choices.
Additional information for residents of certain states
Depending on where you live, state privacy laws may give you rights over your personal information, including the right to know and access it, correct it, delete it, receive a portable copy, opt out of sale, targeted advertising, and certain profiling, and appeal if we refuse a request. We do not sell personal information, use it for targeted advertising, or use it for profiling, so there is nothing to opt out of. We extend the other choices described in Your choices and rights to all visitors, wherever you live.
To make a request, use the methods in that section. You may also use an authorized agent; we may ask for proof of the agent’s authority and may need to verify your identity. If we decline a request, you may appeal by replying to our decision with “Appeal” in the subject line, and if you are not satisfied with the outcome you may contact your state attorney general.
We do not knowingly collect sensitive personal information as those laws define it, apart from anything you choose to include in a message.
California
To the extent California law applies to us, these are the categories of personal information we have collected in the past 12 months. We disclosed them to the service providers described above for the business purposes described in this policy. We have not sold or shared any personal information in that period.
- Identifiers. Examples: Name, email address, phone number, IP address. Source: You and your browser. Used for: Responding to you, security, running the Site.
- Customer records (California Civil Code § 1798.80(e)). Examples: Contact details and the content of your messages and inquiries. Source: You. Used for: Responding to you, planning events and leases.
- Internet or similar network activity. Examples: Browser and device type, pages requested, referring page, request timing. Source: Your browser and our servers. Used for: Delivering and securing the Site.
- Professional information and photos (staff only). Examples: Name, work email, role, profile photo. Source: Staff members. Used for: Administering dashboard accounts.
California residents may also ask once a year for details about personal information we disclosed to third parties for their direct-marketing purposes. We make no such disclosures. Nevada residents may ask us not to sell their covered information; we do not sell it.
Children’s privacy
The Site is meant for a general audience and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has sent us personal information, contact us and we will delete it.
Links to other sites and services
The Site links to other websites and services, including vendors’ own menus and online-ordering pages, social platforms such as Instagram and Facebook, Google Maps, and Tripleseat. We do not control them and are not responsible for their privacy practices, so please read their policies before sharing information with them.
Visitors from outside the United States
We operate in, and store information in, the United States. If you use the Site from another country, your information will be transferred to and processed in the United States, where privacy laws may differ from those where you live.
Changes to this policy
We may update this policy from time to time. The “Last updated” date at the top shows the current version. If we make a material change, we will take reasonable steps to let you know, such as posting a notice on the Site. Using the Site after an update means you accept the updated policy.
Contact us
Questions, requests, or concerns about this policy or your personal information? Email info@chattahoocheemrkt.com with “Privacy” in the subject line, or write to us at:
Chattahoochee Food Works
Attn: Privacy
1235 Chattahoochee Ave NW, Atlanta, GA 30318