Privacy Policy

This Privacy Policy describes how Cabana Taco ("we," "us," "our," or "the Company") collects, uses, discloses, retains, and protects information about you when you visit our website at cabana-taco.digital, place an order with us, interact with our digital platforms, or otherwise engage with our services. We are committed to protecting your personal information and your right to privacy. Please read this policy carefully. If you disagree with its terms, please discontinue use of our site and services.

By accessing or using our website, submitting an order, creating an account, or communicating with us, you acknowledge that you have read, understood, and agreed to be bound by this Privacy Policy. This policy is incorporated into and forms part of our Terms of Service.

1. Who We Are

Cabana Taco is a food service business operating in the United States. We provide customers with an online ordering experience, menu browsing, promotional content, and customer service resources through our website and related digital channels.

For any questions, concerns, or requests related to this Privacy Policy, please contact us at the email address listed above. We aim to respond to all privacy-related inquiries within 30 business days.

2. Scope of This Policy

This Privacy Policy applies to:

• All visitors to our website at cabana-taco.digital
• Customers who place online or in-store orders with Cabana Taco
• Individuals who sign up for our newsletter, loyalty program, or promotional communications
• Anyone who contacts us through our website contact forms, email, phone, or social media
• Job applicants and prospective employees

This policy does not apply to third-party websites, services, or applications that may link to or be linked from our website. We encourage you to review the privacy policies of any third-party platforms you visit.

3. Information We Collect

We collect several types of information from and about users of our website and services, including information you provide directly, information collected automatically, and information received from third parties.

3.1 Information You Provide Directly

When you interact with Cabana Taco, you may voluntarily provide us with the following categories of personal information:

• Contact Information: Your full name, email address, mailing address, delivery address, and phone number.
• Account Credentials: Username, password, and account security questions if you create an account on our platform.
• Order Information: Food items selected, order history, special dietary instructions, delivery preferences, and order notes.
• Payment Information: Credit card or debit card numbers, billing address, and transaction details. Please note that payment information is processed through secure third-party payment processors. We do not store full card numbers on our servers.
• Communications: Messages, feedback, reviews, customer support inquiries, and any other content you send to us directly via email, contact forms, or social media.
• Marketing Preferences: Your choices regarding receiving promotional emails, SMS messages, and other marketing communications.
• Loyalty Program Data: Points balances, redemption history, and participation records if you join our loyalty or rewards program.
• Survey Responses: Feedback, ratings, and responses to questionnaires we may send.

3.2 Information Collected Automatically

When you visit our website, we and our service providers automatically collect certain technical and usage information, including:

• Device Information: Device type, operating system version, browser type and version, screen resolution, and unique device identifiers.
• Log Data: IP address, access times and dates, pages viewed, time spent on each page, referring URLs, and exit pages.
• Location Data: General geographic location derived from your IP address (such as city and state). We do not collect precise GPS location unless you explicitly grant permission.
• Usage Data: How you navigate and interact with our website, including links clicked, items added to cart, search queries entered, and features used.
• Cookie and Tracking Data: Information collected through cookies, web beacons, pixel tags, and similar tracking technologies. See Section 8 for more details on our cookie practices.
• Session Information: Session identifiers, session duration, and in-session activity logs.

3.3 Information From Third Parties

We may receive information about you from the following third-party sources:

• Payment Processors: Transaction confirmation, fraud alerts, and payment status updates from payment processing partners.
• Delivery Partners: Delivery status updates and address confirmation details from third-party delivery platforms or courier services we may work with.
• Social Media Platforms: If you connect your social media account or use social login features (such as "Sign in with Google"), we may receive profile information such as your name, email address, and profile picture in accordance with your social media platform's settings and privacy policy.
• Analytics Providers: Aggregated or anonymized information about website traffic and engagement patterns.
• Marketing Partners: Information about your potential interests, demographic data, or publicly available business contact information used to improve our marketing efforts.

4. How We Use Your Information

We use the personal information we collect for a variety of legitimate business purposes, as described below. In each case, we rely on applicable legal bases under U.S. law, including the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), and the Federal Trade Commission (FTC) Act, where applicable.

4.1 Service Provision and Order Fulfillment

• Processing and fulfilling your food orders, including coordination with kitchen staff and delivery partners
• Managing your account and providing access to account features
• Sending order confirmations, receipts, and status updates via email or SMS
• Processing payments and preventing fraudulent transactions
• Providing customer support and resolving disputes or complaints
• Administering our loyalty and rewards program

4.2 Business Operations and Improvement

• Analyzing how users interact with our website and services to identify areas for improvement
• Conducting internal research, testing, and quality assurance
• Monitoring and improving the performance, security, and reliability of our website
• Developing new menu items, features, and services based on customer feedback and behavior
• Training staff and evaluating service quality
• Maintaining accurate business and financial records

4.3 Marketing and Communications

• Sending you promotional emails, newsletters, and special offers about Cabana Taco products and services, subject to your communication preferences
• Serving you personalized advertisements and promotions based on your order history and browsing behavior
• Sending SMS marketing messages if you have opted in to receive them
• Conducting surveys and requesting reviews or feedback
• Personalizing your website experience with relevant content and recommendations

You may opt out of marketing communications at any time by clicking the "Unsubscribe" link in any marketing email, replying "STOP" to any marketing SMS, or contacting us directly at [email protected]. Opting out of marketing does not affect transactional communications related to your orders or account.

4.4 Legal and Compliance Purposes

• Complying with applicable federal, state, and local laws and regulations
• Responding to lawful requests from law enforcement or regulatory authorities
• Enforcing our Terms of Service and other legal agreements
• Protecting the rights, property, and safety of Cabana Taco, our customers, and the public
• Detecting, preventing, and investigating fraud, abuse, or other illegal activity

5. How We Share Your Information

We do not sell your personal information to third parties for monetary compensation. However, we may share your information in the following limited circumstances:

5.1 Service Providers and Business Partners

We engage trusted third-party service providers who perform services on our behalf, including:

• Payment Processors: To securely process credit card and online payments
• Delivery Services: To facilitate food delivery to your location
• Email and SMS Marketing Platforms: To send transactional and promotional communications
• Website Hosting and Cloud Services: To host our website and store data securely
• Analytics Providers: To help us understand website usage patterns (e.g., Google Analytics)
• Customer Support Tools: To manage and respond to support inquiries
• Fraud Prevention Services: To detect and prevent fraudulent activity

All service providers are contractually obligated to use your personal information only to perform services on our behalf, to protect it in accordance with this Privacy Policy, and to comply with applicable privacy laws.

5.2 Legal Requirements and Law Enforcement

We may disclose your personal information if we believe, in good faith, that such disclosure is necessary to:

• Comply with a legal obligation, subpoena, court order, or government request
• Enforce our Terms of Service or other agreements
• Protect the rights, property, or safety of Cabana Taco, our users, or the public
• Detect, prevent, or investigate fraud, security threats, or other illegal activity

5.3 Business Transfers

In the event that Cabana Taco undergoes a merger, acquisition, bankruptcy, reorganization, or sale of all or substantially all of its assets, your personal information may be transferred as part of that transaction. We will notify you via email or a prominent notice on our website of any such change in ownership or control of your personal information, and this Privacy Policy will continue to govern your information.

5.4 With Your Consent

We may share your personal information with third parties for other purposes when you have provided explicit consent for such sharing. You may withdraw your consent at any time by contacting us at [email protected].

5.5 Aggregated and De-Identified Data

We may share aggregated, anonymized, or de-identified information that cannot reasonably be used to identify you with partners, advertisers, or the public for business or marketing analysis purposes.

6. Your Privacy Rights

Depending on your state of residence, you may have certain rights regarding your personal information. We respect and honor these rights as described below.

6.1 Rights for California Residents (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA):

6.2 Rights for All U.S. Residents

Regardless of your state of residence, you have the right to:

• Access: Request a copy of the personal information we hold about you
• Correction: Request that we correct inaccurate or outdated information
• Deletion: Request deletion of your personal information, subject to legal obligations
• Opt-Out of Marketing: Unsubscribe from promotional communications at any time
• Withdraw Consent: Where we rely on your consent to process your information, withdraw that consent at any time

6.3 How to Exercise Your Rights

To exercise any of the rights described above, please submit a request to us by:

• Email: [email protected]

We will verify your identity before processing your request to protect your privacy and security. You may designate an authorized agent to submit a request on your behalf, provided you furnish written authorization or a valid power of attorney. We will respond to verified requests within 45 days of receipt. If we require additional time, we will notify you of the extension within the initial 45-day period.

7. Data Security

Cabana Taco takes the security of your personal information seriously. We implement a variety of administrative, technical, and physical security measures designed to protect your information from unauthorized access, use, disclosure, alteration, or destruction, including:

• Encryption: We use Secure Sockets Layer (SSL) / Transport Layer Security (TLS) encryption to protect data transmitted between your browser and our website.
• Access Controls: We restrict access to personal information to employees, contractors, and service providers who have a legitimate business need to access it, and who are bound by confidentiality obligations.
• Payment Security: We use PCI-DSS-compliant payment processors to handle payment card information and do not store full card numbers on our servers.
• Firewalls and Intrusion Detection: We employ firewalls, intrusion detection systems, and other technical safeguards to protect our network and systems.
• Regular Security Assessments: We periodically review and update our security practices and conduct vulnerability assessments.
• Incident Response: We maintain a data breach response plan and will notify affected individuals and relevant authorities as required by applicable law in the event of a security breach.

8. Cookie Policy

Our website uses cookies and similar tracking technologies to enhance your browsing experience, analyze website traffic, and deliver personalized content and advertisements. This section provides a brief overview of our cookie practices.

8.1 What Are Cookies?

Cookies are small text files placed on your device by a website when you visit it. They help the website remember information about your visit, such as your preferred language, login status, and items in your cart, making your next visit easier and the site more useful to you.

8.2 Types of Cookies We Use

8.3 Managing Cookies

You can control and manage cookies through your browser settings. Most browsers allow you to refuse cookies, delete existing cookies, and be notified when a cookie is set. Please note that disabling certain cookies may affect the functionality of our website and your ability to use certain features, such as the online ordering system.

Additionally, you may opt out of interest-based advertising by visiting:

• Digital Advertising Alliance (DAA) Opt-Out
• Network Advertising Initiative (NAI) Opt-Out

9. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, to comply with legal obligations, resolve disputes, and enforce our agreements. The following general retention periods apply:

When your personal information is no longer needed, we will securely delete or anonymize it in accordance with our data destruction policies. In some cases, we may retain anonymized or aggregated data indefinitely for analytical and business research purposes.

10. Children's Privacy

Cabana Taco's services are not directed toward children under the age of 18. In compliance with the Children's Online Privacy Protection Act (COPPA) and applicable state laws, we do not knowingly collect personal information from minors.

If you are a parent or guardian and believe that your child under the age of 18 has provided us with personal information without your consent, please contact us immediately at [email protected]. We will take prompt steps to delete such information from our records.

If we discover that we have inadvertently collected personal information from a person under 18 years of age, we will delete that information as quickly as reasonably practicable. We reserve the right to restrict or terminate access to our services for any user who we believe to be under the age of 18.

11. International Data Transfers

Cabana Taco is based in the United States, and our primary data processing activities occur within the United States. If you are accessing our website from outside the United States, please be aware that your personal information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country of residence.

Our service providers and business partners may also operate in other countries, which means your information may be processed in jurisdictions outside the United States. We take reasonable steps to ensure that any international transfers of personal information are subject to appropriate safeguards, including contractual protections requiring the recipient to protect your personal information to at least the same standard as we do under this Privacy Policy.

By using our website and services, you acknowledge and consent to the transfer of your personal information to the United States and other countries as described in this Privacy Policy.

12. Third-Party Links and Services

Our website may contain links to third-party websites, services, social media platforms, and applications that are not operated or controlled by Cabana Taco. These may include food delivery aggregators, review platforms, social media sites, and payment gateways. This Privacy Policy does not apply to such third-party services.

We are not responsible for the privacy practices of any third-party websites or services. We encourage you to review the privacy policies of any third-party services you access through links on our website before providing them with your personal information. The inclusion of a link to a third-party website does not constitute our endorsement of that website or its privacy practices.

13. Do Not Track Signals

Some web browsers allow users to send "Do Not Track" (DNT) signals to websites to indicate that they do not wish to be tracked. Currently, our website does not respond to DNT signals because there is no universally accepted standard for what "tracking" means or how websites should respond to DNT signals. We will continue to monitor developments in DNT technology and standards and may update this section accordingly.

California residents may also exercise rights related to the opt-out of sale and sharing of personal information under the CCPA/CPRA, which is a separate mechanism from DNT signals. See Section 6.1 for more information.

14. Sensitive Personal Information

In the course of providing our food services, we may collect certain categories of sensitive personal information in limited circumstances, including:

• Payment Card Information: Processed securely through PCI-DSS-compliant payment processors
• Dietary Information: Food allergy information or dietary restrictions you voluntarily provide when placing an order (e.g., nut allergies, gluten intolerance)
• Precise Location Data: Only if you grant permission for delivery purposes

We use sensitive personal information only for the specific purposes for which it was collected — primarily to fulfill your order safely and accurately, and to comply with applicable law. We do not use sensitive personal information for behavioral advertising or other purposes beyond what is necessary to provide our services. California residents have the right to limit the use and disclosure of sensitive personal information as described in Section 6.1.

15. Marketing and Promotional Communications

With your consent or where otherwise permitted by law, we may send you promotional and marketing communications about Cabana Taco's offerings, including new menu items, special discounts, seasonal promotions, and loyalty program updates.

15.1 Email Marketing

We use your email address to send promotional newsletters and offers if you have subscribed or opted in. You can unsubscribe at any time by clicking the "Unsubscribe" link at the bottom of any marketing email or by contacting us at [email protected].

15.2 SMS Marketing

We may send promotional text messages to your mobile phone number if you have explicitly opted in to SMS marketing. Standard message and data rates may apply. You can opt out at any time by replying "STOP" to any marketing text message.

15.3 Targeted Advertising

We may use cookies and tracking technologies to serve you targeted advertisements on third-party platforms, such as social media networks. You can manage your advertising preferences through your browser settings or by using the opt-out tools listed in Section 8.3.

16. How to File a Privacy Complaint

If you have concerns about how we handle your personal information, we encourage you to first contact us directly so we can attempt to resolve the issue:

• Email: [email protected]
• Website: cabana-taco.digital

We take all privacy complaints seriously and will investigate and respond to your concern within a reasonable timeframe.

16.1 Filing a Complaint with Regulatory Authorities

If you are not satisfied with our response or believe we are processing your personal information in violation of applicable law, you have the right to lodge a complaint with the appropriate regulatory authority:

17. Legal Basis for Processing (FTC Act Compliance)

As a food service business operating in the United States, we are committed to complying with the Federal Trade Commission Act (FTC Act), which prohibits unfair or deceptive acts or practices in commerce. Our privacy practices are designed to be transparent, fair, and consistent with our representations to consumers.

We process your personal information based on the following legal grounds:

• Performance of a Contract: Processing necessary to fulfill your food orders, manage your account, and provide our services
• Legitimate Business Interests: Processing for fraud prevention, security, analytics, and business improvement, balanced against your privacy rights
• Compliance with Legal Obligations: Processing required by applicable federal, state, or local law
• Your Consent: Processing based on your explicit consent, such as for marketing communications (which you may withdraw at any time)

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or business operations. When we make changes, we will:

• Update the "Last Updated" date at the top of this policy
• Post the revised policy on our website at cabana-taco.digital
• For material changes, provide prominent notice on our website or send you an email notification

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information. Your continued use of our website and services after the posting of changes to this policy constitutes your acknowledgment and acceptance of those changes.

19. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please do not hesitate to contact us. We are committed to working with you to address your privacy concerns promptly and transparently.

We will acknowledge receipt of your inquiry promptly and work to provide a substantive response within 30 business days. For California residents exercising CCPA/CPRA rights, we will respond within the statutory deadline of 45 calendar days, with a possible extension of an additional 45 days where reasonably necessary.

This Privacy Policy was last reviewed and updated on June 4, 2026. All previous versions of this Privacy Policy are superseded by this document.