Origin Baking Co.

Privacy Policy

Effective Date: May 19, 2026

1. Overview

Origin Baking Co. ("Origin," "we," "us," or "our") is a wholesale artisan bakery operating in California. This Privacy Policy explains how we collect, use, and protect information provided by our wholesale customers ("you" or "your") in connection with order management, invoicing, and payment processing.

This policy applies to information collected through our order intake forms, invoices, and payment processing systems, including QuickBooks Online and Stripe.

2. Information We Collect

We collect only the information necessary to operate our wholesale business and process payments. This includes:

Business and Contact Information

•       Business name and address

•       Billing and delivery addresses

•       Contact name, email address, and phone number

•       Account and order history

Payment and Banking Information

•       Bank account and routing numbers (collected solely for ACH payment processing via Stripe)

•       Payment authorization records

•       Invoice and transaction history

Order Information

•       Product orders, quantities, and delivery schedules

•       Communications related to your account

3. How We Use Your Information

We use the information we collect exclusively for the following purposes:

•       Processing and fulfilling your wholesale orders

•       Generating and sending invoices through QuickBooks Online

•       Initiating ACH payment collections through Stripe on your authorized payment due dates

•       Communicating with you about your account, orders, and deliveries

•       Maintaining accurate financial and business records

•       Complying with applicable legal and regulatory obligations

We do not use your information for marketing to third parties, advertising, or any purpose unrelated to our wholesale business relationship with you.

4. ACH Payment Authorization and Nacha Compliance

When you provide your bank account information and authorize Origin Baking Co. to initiate ACH debits, you are granting us permission to electronically withdraw funds from your designated account in accordance with Nacha (National Automated Clearing House Association) Operating Rules.

Specifically:

•       ACH debits will be initiated only for amounts and on dates consistent with your invoice terms

•       You will receive an invoice in advance of any ACH collection

•       You may revoke your ACH authorization at any time by providing written notice to us with sufficient advance notice to allow processing

•       Unauthorized or erroneous debits should be reported to us promptly so we may initiate a reversal

5. How We Share Your Information

We do not sell, rent, or trade your information. We share your information only with the following service providers as necessary to operate our business:

•       Stripe, Inc. — payment processing and ACH collections. Stripe's privacy policy is available at stripe.com/privacy

•       Intuit Inc. (QuickBooks Online) — invoicing and accounting. Intuit's privacy policy is available at intuit.com/privacy

Both service providers are contractually required to protect your information and are prohibited from using it for purposes other than providing services to us. We may also disclose information if required by law, court order, or governmental authority.

6. Data Security

We take reasonable measures to protect your information from unauthorized access, use, or disclosure. Banking and payment information is handled exclusively through Stripe's secure, PCI-DSS-compliant infrastructure. We do not store your full bank account numbers in our own systems.

While we use industry-standard practices to protect your data, no method of electronic transmission or storage is completely secure. We encourage you to contact us immediately if you suspect any unauthorized use of your account information.

7. Data Retention

We retain your business and transaction information for as long as your wholesale account is active and for a period thereafter as required by applicable law, including California tax and business record requirements. Banking authorization records are retained for a minimum of two years from the date of the last transaction in accordance with Nacha guidelines.

8. Your Rights Under California Law

As a California business, we respect your rights under the California Consumer Privacy Act (CCPA) and applicable law. You have the right to:

•       Know what personal information we have collected about you or your business

•       Request correction of inaccurate information

•       Request deletion of your information, subject to our legal retention obligations

•       Opt out of any sale of your information (we do not sell personal information)

To exercise any of these rights, please contact us using the information below. We will respond to verifiable requests within 45 days.

9. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting the updated policy on our website. Your continued business relationship with us after the effective date of any update constitutes your acceptance of the revised policy.

10. Contact Us

If you have any questions about this Privacy Policy or how we handle your information, please contact us:

Origin Baking Co.

Garden Grove, California

Email: bwong@originbakingco.com

Phone: (657) 790-1391

Origin Baking Co. — Privacy Policy — Effective May 19, 2026