This privacy ledger specifies how Nepenthe handles visitor data, advertising identifiers, and customer inquiries.

This privacy policy took effect on October 13, 2026 (2026-10-13) and governs all visiting sessions, table inquiries, and advertising interactions initiated on or after that date.

The data controller for this website is Nepentherestaurant, trading at nepentherestaurant.com. We operate from 48510 Highway 1, Big Sur, California 93920, Big Sur, California, United States. Governing law is the law of California, United States, with disputes heard in the courts of Big Sur.

We collect personal information you explicitly provide via our inquiry form (name, phone, email, address, the kind of enquiry, the message notes, the requested specification, and the consent tick) and support chat transcripts. When you load the site, our servers automatically record your IP address, browser user-agent string, referring URL, timestamp of render (the moment the form was rendered), the moment it was sent, and incoming advertising click identifiers including gclid, msclkid, and fbclid. The support chat keeps the conversation and a session token in your browser so you can return to it. Your cookie preference is saved in the browser under site_consent_v2. We record no account passwords, login credentials, or payment card details because this site is inquiry-only.

Data is processed to answer table capacity and group dining inquiries, provide real-time road conditions for Highway 1 travelers via support chat, analyze website traffic reliability, measure campaign performance across commercial advertising networks, and protect against fraudulent automated bot submissions.

We process your inquiry data on the basis of contract initiation or pre-contractual steps when you ask about dining with us. We process technical server logs and security honeypots under legitimate interest to maintain system uptime and prevent abuse. Advertising measurement and optional analytics cookies operate strictly on the basis of affirmative consent.

This website is a live commercial destination for paid advertising campaigns. Google Ads, Microsoft Advertising, and Meta Ads send visitor traffic to this site today. When an ad is clicked, these networks append unique click identifiers to the arrival URL: gclid for Google Ads, msclkid for Microsoft Advertising, and fbclid for Meta Ads. We state verbatim: gclid, msclkid, fbclid, google ads, microsoft advertising. These identifiers are logged to evaluate ad relevance, campaign cost effectiveness, and landing page quality. No platform has reviewed, approved or verified this site.

We run Google Consent Mode v2 on every page. Prior to affirmative visitor permission via our cookie banner, the four core consent signals—ad_storage, ad_user_data, ad_personalization, and analytics_storage—are held strictly in a denied status. Only if you select 'Allow Storage' are these signals granted. If you decline storage or later adjust your settings, all four signals are immediately reverted to denied. The contract terms ad_storage, ad_user_data, ad_personalization, analytics_storage, consent mode are applied exactly.

We share processing data with specific contracted providers: Google Ireland Ltd and Google LLC for Google Ads infrastructure (attaches gclid to a click and receives consent signals); Microsoft Ireland Operations Ltd for Microsoft Advertising (attaches msclkid; governed by the Microsoft privacy statement at privacy.microsoft.com); Meta Platforms Ireland Ltd for Meta Ads attribution (attaches fbclid); our regional hosting provider that serves this site and stores the enquiry database; and the mail provider that carries notification messages to our Big Sur floor desk.

Nepenthe is located in the United States. Data submitted by international travelers is transferred to and hosted on servers in the United States. We protect international transfers through Standard Contractual Clauses (SCCs) and adherence to valid cross-border privacy framework mechanisms.

We retain your data only for defined operational periods. Inquiry form records and their email copies are stored for 24 months. Support chat transcripts are kept for 18 months. Technical server and access logs are purged after 90 days. The record of a consent choice stored under site_consent_v2 is retained for 6 months.

All communications with nepentherestaurant.com are encrypted in transit using TLS 1.3 cryptographic protocols. Our backend database uses access-controlled file systems, automated honeypots for spam prevention, sanitized inputs, and routine security patching.

If you access our site from the European Union or United Kingdom, the gdpr guarantees you specific legal rights: right of access to your personal data, right to rectification of inaccurate records, right to erasure ('right to be forgotten'), right to restriction of processing, right to data portability, right to object to processing, and the right to withdraw your consent at any time without penalty.

Under the California Consumer Privacy Act as amended by the California Privacy Rights Act (ccpa), California residents have the right to know what personal information is collected, the right to request deletion, the right to correct inaccurate data, the right to non-discrimination for exercising privacy rights, and the right to opt out of the sale or sharing of personal data for cross-context behavioral advertising. We do not sell your personal data for monetary consideration.

We honor Global Privacy Control (GPC) signals broadcast by your web browser. If your browser transmits the Sec-GPC header, we recognize it immediately as a valid request to opt out of non-essential tracking and advertising storage without requiring you to open the cookie banner. We state verbatim: global privacy control.

Our website is designed for adults planning coastal dining and travel. We do not knowingly solicit or collect personal information from individuals under sixteen years of age. If a parent or guardian discovers that a child has submitted personal details through our forms, contact [email protected] for prompt deletion.

You have the legal right to lodge a formal complaint with a data protection supervisory authority. In California, you may file with the California Privacy Protection Agency (CPPA) or your state Attorney General. European visitors may lodge a complaint with their national data protection authority.

To exercise any privacy right—such as requesting a copy of your submitted inquiries or asking for permanent deletion—email [email protected] or write to our Big Sur office at 48510 Highway 1, Big Sur, California 93920, Big Sur, California, United States. We verify your identity using the email or phone number originally provided and answer every verified data request within 5 days.

When we update this policy, we post the revised version directly to this URL and revise the effective date at the top of this ledger. Material modifications that alter how your personal data is processed will be highlighted with a banner notice on the homepage.

If you have questions regarding this policy or our data practices, reach our privacy administrator directly by email at [email protected], by telephone at 831-667-2345, or by mail at Nepenthe Restaurant, 48510 Highway 1, Big Sur, California 93920, Big Sur, California, United States.