Privacy Policy

This Privacy Policy describes how Cabana Taco ("we," "us," "our," or "the Company") collects, uses, discloses, retains, and protects your personal information when you visit our website at tacocabana.rest, place orders, sign up for promotions, or otherwise interact with our services (collectively, the "Services"). Please read this document carefully. By using our Services, you acknowledge that you have read and understood the practices described herein.

We are committed to protecting your privacy and handling your data in an open and transparent manner. This Privacy Policy is designed to comply with applicable United States federal and state privacy laws, including but not limited to the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), the Federal Trade Commission Act (FTC Act), and other relevant consumer protection regulations.

1. About Us

Cabana Taco is a food service business operating in the United States. We are dedicated to delivering a high-quality dining experience to our customers, whether in-person or through our digital platforms. If you have any questions, concerns, or requests related to this Privacy Policy, please contact us using the information below:

2. Scope of This Privacy Policy

This Privacy Policy applies to all individuals who interact with Cabana Taco through any of the following means:

• Visiting our website at tacocabana.rest
• Placing online food orders or reservations through our platform
• Signing up for our newsletters, promotional emails, or loyalty programs
• Contacting us via email, phone, or other communication channels
• Engaging with us on social media platforms
• Participating in surveys, contests, or promotional events
• Visiting our physical locations where applicable data collection occurs

This Policy does not apply to third-party websites, applications, or services that may be linked from our website. We encourage you to review the privacy policies of any third-party services you use.

3. Information We Collect

We collect several categories of personal information depending on how you interact with our Services. The information we collect falls into the following categories:

3.1 Personal Identification Information

When you create an account, place an order, make a reservation, or contact us, we may collect:

• Full name
• Email address
• Phone number
• Mailing or delivery address
• Date of birth (for age verification or birthday promotions)
• Username and password (for account holders)

3.2 Order and Transaction Information

When you make a purchase or place an order through our Services, we collect:

• Order history and details (items ordered, quantities, special requests)
• Payment method type (e.g., credit card, debit card) — note: full payment card numbers are processed by our secure third-party payment processors and are not stored by us
• Billing address associated with your payment method
• Transaction amounts and timestamps
• Delivery instructions and preferences

3.3 Usage and Device Information

When you browse or interact with our website, we automatically collect certain technical information, including:

• IP address
• Browser type and version
• Operating system and device type
• Referring URL (the page you visited before arriving at our site)
• Pages visited and time spent on each page
• Links clicked and features used
• Date and time of your visit
• Session identifiers
• Mobile device identifiers (if applicable)

3.4 Location Information

We may collect general location information (such as city or region derived from your IP address) to improve our Services, show relevant restaurant locations, or offer localized promotions. If you use our mobile application or grant location permissions in your browser, we may collect more precise geolocation data to facilitate delivery services or provide store-finder functionality.

3.5 Communications and Feedback

When you contact us by email, through a contact form, or by phone, we collect the content of your communications, including:

• Inquiry or complaint details
• Feedback and reviews submitted about our food or services
• Survey responses
• Customer support correspondence

3.6 Marketing Preferences

We collect information about your preferences regarding marketing communications, including whether you have opted in or out of receiving promotional emails, SMS messages, or other marketing materials.

3.7 Cookies and Similar Tracking Technologies

We use cookies, web beacons, pixel tags, and similar technologies to collect information about your interactions with our website. Please refer to Section 9 of this Privacy Policy for detailed information on our use of cookies and your choices regarding them.

3.8 Information from Third Parties

We may receive information about you from third-party sources, including:

• Social media platforms (if you connect your account or engage with our social pages)
• Third-party food delivery platforms (e.g., DoorDash, Uber Eats, Grubhub) when orders are placed through those services
• Analytics and advertising partners
• Publicly available sources

4. How We Use Your Information

We use the personal information we collect for a variety of legitimate business purposes. Below is a detailed explanation of how and why we process your data:

4.1 Service Provision and Order Fulfillment

• To process and fulfill your food orders and reservations
• To facilitate delivery or pickup services
• To manage your account and authenticate your identity
• To send order confirmations, updates, and receipts
• To process payments and prevent fraudulent transactions
• To respond to your inquiries, complaints, and customer support requests

4.2 Business Operations and Improvement

• To analyze usage patterns and improve the functionality of our website and Services
• To develop new menu items, features, and services based on customer feedback and preferences
• To conduct internal research, analytics, and reporting
• To detect, investigate, and prevent security incidents, fraud, and abuse
• To ensure the technical performance and stability of our digital platforms

4.3 Marketing and Promotions

• To send you promotional emails, newsletters, and special offers if you have opted in to receive them
• To send SMS or push notification marketing messages where you have provided consent
• To personalize your experience and show you relevant content, deals, and recommendations
• To run loyalty programs, contests, sweepstakes, and promotional campaigns
• To display targeted advertising on our website and third-party platforms

You may opt out of marketing communications at any time. Please see Section 10 for information on your rights and how to exercise them.

4.4 Legal and Compliance Purposes

• To comply with applicable federal, state, and local laws and regulations
• To respond to lawful requests from government authorities, courts, or law enforcement agencies
• To enforce our Terms of Service and other agreements
• To protect the rights, property, and safety of Cabana Taco, our customers, and the public

5. Sharing Your Information with Third Parties

We do not sell, rent, or trade your personal information for monetary compensation. However, we may share your information with certain third parties under the following circumstances:

5.1 Service Providers and Business Partners

We engage trusted third-party service providers who perform functions on our behalf. These providers are contractually obligated to use your information only as directed by us and in accordance with this Privacy Policy. Categories of service providers include:

5.2 Legal Requirements and Law Enforcement

We may disclose your personal information when we believe in good faith that disclosure is necessary to:

• Comply with a legal obligation, court order, subpoena, or government request
• Enforce our Terms of Service or protect our legal rights
• Investigate potential violations of our policies
• Protect the safety and security of our users, employees, or the general public
• Detect, prevent, or respond to fraud, security threats, or illegal activity

5.3 Business Transfers

In the event that Cabana Taco undergoes a merger, acquisition, restructuring, sale of assets, or bankruptcy proceeding, your personal information may be transferred as part of such a transaction. We will notify you via email or prominent notice on our website before your personal information becomes subject to a different privacy policy.

5.4 With Your Consent

We may share your personal information with third parties not listed above when we have obtained your explicit consent to do so. You may withdraw this consent at any time by contacting us at [email protected].

5.5 Aggregated and De-Identified Data

We may share aggregated, anonymized, or de-identified information that cannot reasonably be used to identify you with third parties for research, marketing, analytics, or other business purposes. Such data sharing does not constitute the sharing of personal information.

6. Data Security

The security of your personal information is a priority for us. We implement a comprehensive set of technical, administrative, and physical safeguards to protect your data from unauthorized access, disclosure, alteration, or destruction.

6.1 Technical Safeguards

• Encryption: We use SSL/TLS encryption for data transmitted between your browser and our servers. Sensitive data such as payment information is encrypted both in transit and at rest.
• Firewalls and Intrusion Detection: Our servers are protected by firewalls and monitored for unauthorized access attempts.
• Access Controls: Access to personal data is restricted to authorized personnel who need it to perform their job functions.
• Secure Payment Processing: Payment transactions are handled by PCI DSS-compliant third-party processors. We do not store full credit card numbers on our systems.
• Regular Security Audits: We conduct periodic security reviews and vulnerability assessments of our systems.

6.2 Administrative Safeguards

• Employee training on data privacy and security practices
• Data handling procedures and internal privacy policies
• Vendor due diligence and contractual data protection requirements
• Incident response procedures in the event of a data breach

6.3 Limitation of Liability

While we take commercially reasonable steps to protect your personal information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify affected individuals and relevant authorities as required by applicable law.

7. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

When personal information is no longer needed, we securely delete, anonymize, or de-identify it in accordance with our data retention and disposal procedures.

8. Children's Privacy

Cabana Taco's website and online ordering services are not directed at children under the age of 13. We do not knowingly collect personal information from children under 13 years of age. If you are a parent or guardian and believe that your child has provided us with personal information without your consent, please contact us immediately at [email protected]. Upon verification, we will promptly delete such information from our records.

Furthermore, we encourage parents and guardians to monitor their children's internet usage and to help enforce this Privacy Policy by instructing their children never to provide personal information through our Services without parental permission.

If you are under 18 years of age, we ask that you do not use or access our Services without parental consent and supervision.

9. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience on our website, analyze site traffic, and deliver relevant advertising. This section provides a brief overview of our cookie practices.

9.1 What Are Cookies?

Cookies are small text files that are placed on your device by websites you visit. They are widely used to make websites work more efficiently and to provide information to website owners. Cookies can be "session cookies" (which expire when you close your browser) or "persistent cookies" (which remain on your device for a set period or until you delete them).

9.2 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the website to function properly. These cookies enable core functionalities such as account login, shopping cart, and order processing. The website cannot function properly without these cookies.
• Performance and Analytics Cookies: These cookies collect information about how visitors use our website, such as which pages are visited most often. We use tools like Google Analytics to collect this data. All information is aggregated and anonymous.
• Functional Cookies: These cookies allow our website to remember choices you make (such as your language or region) and provide enhanced, personalized features.
• Targeting and Advertising Cookies: These cookies are used to deliver advertisements more relevant to you and your interests. They are also used to limit the number of times you see an advertisement and help measure the effectiveness of advertising campaigns.

9.3 Third-Party Cookies

Some cookies on our website are placed by third-party services that appear on our pages, including analytics providers, advertising networks, and social media platforms. These third parties may use cookies to collect information about your online activities across different websites over time.

9.4 Managing Your Cookie Preferences

You can control and manage cookies through your browser settings. Most browsers allow you to refuse cookies or delete specific cookies. Please note that disabling certain cookies may affect the functionality of our website. You can also opt out of interest-based advertising through tools such as the Network Advertising Initiative (NAI) opt-out tool or the Digital Advertising Alliance (DAA) opt-out tool.

10. Your Privacy Rights

Depending on your state of residence, you may have specific rights regarding your personal information. We are committed to honoring these rights.

10.1 Rights for California Residents (CCPA/CPRA)

If you are a resident of California, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

To exercise your California privacy rights, please submit a verifiable consumer request by contacting us at [email protected]. We will respond to verified requests within 45 days. If we need additional time (up to 90 days total), we will notify you of the extension in writing.

10.2 Rights for Other US Residents

Residents of other US states that have enacted comprehensive privacy laws (including but not limited to Virginia, Colorado, Connecticut, Utah, and Texas) may also have rights including the right to access, correct, delete, or obtain a copy of their personal data, and the right to opt out of targeted advertising and profiling. We will honor these rights in accordance with applicable state law.

10.3 General Privacy Rights for All Users

Regardless of your location, you may exercise the following rights by contacting us:

• Access: Request confirmation of whether we hold personal information about you and obtain a copy of that data
• Correction: Request correction of inaccurate or incomplete personal information
• Deletion: Request deletion of your personal information (subject to legal retention requirements)
• Portability: Request that we provide your personal information in a structured, commonly used, and machine-readable format
• Opt-Out of Marketing: Unsubscribe from marketing communications at any time by clicking the "unsubscribe" link in any marketing email or by contacting us directly
• Withdraw Consent: Where processing is based on your consent, withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal

10.4 How to Exercise Your Rights

To exercise any of the rights described above, please contact us through one of the following methods:

• Email: [email protected]
• Website: tacocabana.rest

We may need to verify your identity before processing your request. This may involve asking you to confirm information we already hold about you. We will process all verified requests within the timeframes required by applicable law.

10.5 Authorized Agents

California residents may designate an authorized agent to submit privacy rights requests on their behalf. To use an authorized agent, please provide written authorization signed by you, and we may still require you to verify your own identity directly with us.

11. International Data Transfers

Cabana Taco is based in the United States and our Services are directed at users located in the United States. All personal information collected through our Services is processed and stored in the United States.

If you are accessing our Services from outside the United States, please be aware that your information may be transferred to, stored in, and processed in the United States, where data protection laws may differ from those in your home country. By using our Services and providing your personal information, you acknowledge and consent to the transfer of your data to the United States.

We take appropriate measures to ensure that any international transfers of personal data comply with applicable laws and that your information remains protected to a standard that is consistent with this Privacy Policy.

12. Third-Party Links and Services

Our website may contain links to third-party websites, social media platforms, delivery service applications, or other external services. These third-party sites have their own privacy policies and data collection practices, which are independent of ours. We are not responsible for the content, privacy practices, or data handling of any third-party websites or services.

We encourage you to review the privacy policies of any third-party sites you visit through links on our website. The inclusion of a link to a third-party website does not imply our endorsement of that website or its privacy practices.

13. Do Not Track Signals

Some web browsers have a "Do Not Track" (DNT) feature that sends a signal to websites requesting that they do not track your online activity. Currently, there is no universally accepted standard for how websites should respond to DNT signals. As a result, our website does not currently respond to browser DNT signals in a uniform way.

We do, however, provide you with choices regarding the collection of your information through our cookie preferences and opt-out mechanisms described in this Privacy Policy.

14. Marketing Communications

With your consent or where otherwise permitted by applicable law, we may send you promotional emails, SMS messages, push notifications, or other marketing communications about our menu, special offers, new locations, events, and promotions.

14.1 Email Marketing

If you have subscribed to our email newsletter or promotional communications, you will receive periodic emails from us. You can opt out of these communications at any time by:

• Clicking the "unsubscribe" link found at the bottom of any marketing email
• Emailing us at [email protected] with the subject line "Unsubscribe"

Please note that even if you opt out of marketing emails, we may still send you transactional or service-related communications (such as order confirmations or important account notifications).

14.2 SMS Marketing

If you have opted in to receive SMS marketing messages, you may opt out at any time by replying "STOP" to any SMS message you receive from us, or by contacting us at [email protected].

14.3 Loyalty Programs and Promotions

If you participate in our loyalty program or promotional contests, we may use your information to administer the program, notify you of rewards or prizes, and communicate about program updates. Additional terms and conditions may apply to specific promotions.

15. How to File a Privacy Complaint

If you have concerns about how we handle your personal information, we encourage you to contact us directly first so that we can attempt to resolve the issue promptly.

15.1 Contact Us

To file a privacy complaint or raise a privacy concern, please contact our privacy team at:

• Email: [email protected]
• Website: tacocabana.rest

We will acknowledge your complaint within 10 business days and endeavor to resolve it within 30 business days. For complex matters, we may need additional time and will keep you informed of the progress.

15.2 Filing a Complaint with a Regulatory Authority

If you are a California resident and are not satisfied with our response to your privacy complaint, you have the right to file a complaint with the California Privacy Protection Agency (CPPA) or the California Attorney General's Office.

• California Privacy Protection Agency (CPPA): cppa.ca.gov
• California Attorney General: oag.ca.gov/privacy

If you are located in another US state with a consumer privacy law, you may also have the right to file a complaint with your state's Attorney General office or applicable data protection authority. Common state resources include:

• Federal Trade Commission (FTC): ftc.gov/complaint — for concerns involving deceptive or unfair practices under the FTC Act
• Your State Attorney General: Contact your state's Attorney General office for state-specific privacy complaints

16. Changes to This Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time to reflect changes in our business practices, technological developments, legal requirements, or other factors. When we make material changes to this Policy, we will take appropriate steps to notify you, which may include:

• Posting a prominent notice on our website at tacocabana.rest
• Sending an email notification to the address on file for your account
• Updating the "Last Updated" date at the top of this Policy

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information. Your continued use of our Services after any changes to this Privacy Policy will constitute your acceptance of the updated terms. If you do not agree with the updated Privacy Policy, you should discontinue use of our Services and contact us to request deletion of your personal information.

17. Contact Information for Privacy Inquiries

For any questions, concerns, requests, or complaints regarding this Privacy Policy or our data handling practices, please do not hesitate to reach out to us. We are committed to resolving privacy concerns in a timely and transparent manner.

This Privacy Policy was last reviewed and updated on May 28, 2026. © 2026 Cabana Taco. All rights reserved.