Effective Date: October 16, 2026 · Last Updated: October 16, 2026 · Version 2.1. Tacos Gavilan explains here what information this website collects, how it is protected, and how California residents can exercise their CCPA/CPRA privacy rights.
1. Information We Collect & Location Data
Our hosting and database service providers (Vercel Inc., Supabase, Inc.) process technical request data (IP address, browser headers, timestamps, and—only when Analytics consent is granted—anonymous first-party session telemetry). If you click the optional "Near Me" store locator button, your browser calculates distance to our 15 restaurants locally in browser memory without transmitting or storing your GPS coordinates on our servers. Online food orders and payments are processed on order.online (operated by DoorDash, Inc.) integrated with Toast POS; we do not collect payment card numbers on tacosgavilan.com.
2. Contact, Catering, Employment & CCPA Privacy Inquiries
When you submit our Contact Form, we collect your name, email address, phone number, selected restaurant location, inquiry category, and message solely to respond to your inquiry or fulfill your CCPA privacy request. We do not operate an automated marketing newsletter or resume upload portal on this site. Please do not submit sensitive personal information (SSN, payment card numbers, or health data).
3. Data Retention, Safeguards & Children's Privacy
CCPA request records are retained for at least 24 months pursuant to 11 CCR § 7101(a); general inquiries are retained only for the duration reasonably necessary to address and resolve your request unless earlier deletion is requested (see our full Data Category Table at /privacy/#data-table). We use reasonable administrative, technical, and organizational safeguards appropriate to the information processed. We do not knowingly collect, sell, or share personal information from children under 16.
4. Cookies, Pixels & Right to Opt Out ("Do Not Sell or Share" / GPC)
Tacos Gavilan does not sell personal information for monetary consideration. Non-essential analytics and marketing tags (Google Tag Manager GTM-WW2N58Z, Google Analytics, Meta Pixel, TikTok Pixel) are blocked by default prior to your consent. You may manage preferences or opt out at any time via Your Privacy Choices (/privacy-choices/) or by broadcasting a Global Privacy Control (GPC) browser signal, which is automatically honored.
5. Your California Privacy Rights (CCPA / CPRA)
California residents have the right to Know/Access, Delete, Correct, and Opt Out of Sale/Sharing without discrimination. Submit verifiable requests via our Contact Form (selecting your CCPA request type) or by emailing info@tacosgavilan.com.