Privacy Policy & California Notice at Collection

A. Identity of the Business & Contact Information

This Privacy Policy and California Notice at Collection describes how Tacos Gavilan ("Tacos Gavilan," "we," "us," or "our") collects, uses, discloses, retains, and safeguards information when you visit https://tacosgavilan.com (the "Site") or contact us.

• Business / Brand Name: Tacos Gavilan (operating 15 restaurant locations in Southern California)
• Privacy & Guest Support Email: info@tacosgavilan.com
• Online Privacy Request & Support Portal: https://tacosgavilan.com/contact/ and https://tacosgavilan.com/privacy-choices/
• Restaurant Street Addresses & Direct Telephone Numbers: Complete physical addresses and direct telephone numbers for all 15 Southern California Tacos Gavilan locations are published on our Locations Page (/locations/).

B. Categories of Personal Information Collected

Depending on how you interact with our Site, we collect or receive the following specific categories of information:

• 1. Full Name, Email Address, and Telephone Number: Collected when you voluntarily submit our Contact Form on /contact/ or the homepage (#contact-form), or when you email info@tacosgavilan.com.
• 2. Physical / Delivery Address: We do not require your street address on tacosgavilan.com unless you voluntarily include it in a message. When you place a delivery order on order.online (operated by DoorDash, Inc.), that platform collects your delivery address to coordinate courier delivery.
• 3. Approximate or Precise Geolocation ("Near Me"): If you click the "Near Me" / "Cerca de Mí" button in our Locations section and grant browser permission, your browser provides your latitude and longitude to our client-side script solely to calculate the distance to our 15 restaurants. Your precise coordinates are processed in your browser memory and are never transmitted to or stored in our database.
• 4. IP Address, Browser, Device & Server Security Logs: When your browser requests pages or calls our /api/contact endpoint, our hosting provider (Vercel) and API process your IP address, HTTP headers (Origin, Referer, User-Agent), and request timestamps to deliver content, prevent automated spam, and enforce rate limits.
• 5. First-Party Anonymous Session Telemetry (/api/track): Only when you opt in to Analytics Cookies (and Global Privacy Control is not active), our first-party endpoint records aggregate page views, "Order Online" button clicks, device category (desktop/tablet/mobile), screen width, and language using a temporary random session identifier (tg_session_id in sessionStorage).
• 6. Cookies, Analytics & Advertising Identifiers: Strictly necessary preferences are stored in local storage (tacosgavilan_lang, tg_cookie_consent, tacosgavilan_cookie_consent, tg_a11y_prefs). Non-essential analytics tags (Google Tag Manager GTM-WW2N58Z / Google Analytics) and advertising pixels on our homepage (Meta Pixel 2180512185415859 and TikTok Pixel C72F1PTP2K6V4FLP2V5G) are blocked by default prior to your consent and only load if you explicitly opt in (and Global Privacy Control is not active).
• 7. Language & Accessibility Preferences: Your chosen site language (en or es) and any optional visual or motor adjustments selected in our Accessibility Toolbar are saved locally in your browser's localStorage.
• 8. Contact Messages, Fiesta Platter / Catering Inquiries, Employment Questions & Contest Archives:
  • Contact & Catering Messages: When you contact us regarding customer service or Fiesta Platter / catering orders, we collect your name, email, phone number, selected restaurant location, inquiry category, and message content.
  • Employment / Careers Inquiries: Visiting /careers/ redirects to our Contact Page. We do not operate an online resume upload portal or collect Social Security numbers, background checks, or driver's license numbers on this website.
  • Contest Archives: Historical blog posts referencing past promotional events (such as the concluded October 5, 2021 Taco Eating Contest) are preserved solely as historical archives; we do not operate active contest entry forms on this website.
• 9. Online Ordering Data Sent to Toast / order.online (Operated by DoorDash, Inc.): When you click "Order Online" to order food or Fiesta Platters, you are directed to order.online, an external ordering portal operated by DoorDash, Inc. integrated with our restaurants' Toast Point-of-Sale (POS) system. DoorDash collects your name, email, phone number, payment card information, delivery address, and order items under its own Privacy Policy, and transmits your order fulfillment details to the selected Tacos Gavilan restaurant so we can prepare and fulfill your order.
• 10. Sensitive Personal Information: Tacos Gavilan does not intentionally collect Sensitive Personal Information (such as Social Security numbers, driver's license or state ID numbers, financial account or payment card numbers on tacosgavilan.com, health/medical data, or biometric identifiers). Please do not include sensitive personal information in free-text contact messages.

C. Comprehensive Data Category, Purpose, Recipient & Retention Table

The table below summarizes each category of personal information collected or processed in connection with our Site over the preceding 12 months, its source, business purpose, third-party service providers or recipients, whether it is sold or shared under the CCPA/CPRA, its retention period or criteria (pursuant to Cal. Civ. Code § 1798.100(a)(3) and 11 CCR § 7012(b)(4)), and the operational basis for retention:

D. California Notice at Collection (CCPA / CPRA)

Notice at Collection for California Residents (Cal. Civ. Code § 1798.100(a)): At or before the point of collection, we inform California consumers of the following:

• Categories Collected: Identifiers and Contact Records (name, email, phone number, message content, store selection, inquiry type); Network & Device Activity (IP address, browser headers); Local Browser Preferences (language, cookie consent, accessibility settings); Ephemeral Browser Geolocation (only in-browser when clicking "Near Me"); and—strictly if you opt in—First-Party Session Telemetry (tg_session_id) and Analytics/Advertising Identifiers (Google Tag Manager/Analytics, Meta Pixel, TikTok Pixel).
• Purposes of Collection: Responding to guest inquiries, catering and employment questions, accessibility barrier reports, and CCPA requests; operating our interactive store locator; maintaining website security and rate limiting; and (only with your prior opt-in consent) measuring website analytics and marketing effectiveness.
• Do We Sell or Share Personal Information? Tacos Gavilan does not sell personal information for monetary consideration. Non-essential advertising pixels (Meta Pixel, TikTok Pixel, Google Ads via GTM)—which may constitute "sharing" for cross-context behavioral advertising under the CCPA/CPRA—are blocked by default and only run if you explicitly opt in. We do not knowingly sell or share the personal information of consumers under 16 years of age.
• Categories of Third Parties: Infrastructure service providers (Vercel Inc., Supabase, Inc.), map and font providers (Google LLC), independent online ordering portals when you click Order Online (order.online operated by DoorDash, Inc. and Toast, Inc.), and—only if you opt in—analytics and advertising providers (Google LLC, Meta Platforms, Inc., TikTok Inc.).
• Retention Periods & Criteria: Please see the Data Category & Retention Table (Section C) above for the retention period or criteria applicable to each category (including statutory 24-month retention for CCPA requests under 11 CCR § 7101(a), 0-day server storage for ephemeral browser geolocation, 10-minute in-memory rate-limit windows, and purpose-based inquiry retention). We do not retain personal information longer than reasonably necessary for the disclosed purpose.
• Direct Links: Manage your preferences or opt out at any time on Your California Privacy Choices (/privacy-choices/), or review this complete Privacy Policy (/privacy/).

E. Your California Privacy Rights (CCPA / CPRA)

Under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (Cal. Civ. Code § 1798.100 et seq.) and California Privacy Protection Agency (CPPA) regulations, California residents have the following rights:

• 1. Right to Know & Right to Access (§ 1798.100, § 1798.110, § 1798.115): You have the right to request that we disclose the categories of personal information we collected about you, the categories of sources, the business or commercial purpose for collecting or sharing it, the categories of third parties to whom we disclosed it, and the specific pieces of personal information we have collected about you.
• 2. Right to Delete (§ 1798.105): You have the right to request the deletion of personal information we have collected from you, subject to statutory exceptions (such as completing a transaction you requested, detecting security incidents, complying with legal obligations, or maintaining required CCPA request logs).
• 3. Right to Correct Inaccurate Personal Information (§ 1798.106): You have the right to request that we correct inaccurate personal information that we maintain about you, taking into account the nature of the personal information and the purposes of processing.
• 4. Right to Opt-Out of Sale or Sharing (§ 1798.120): You have the right to direct us not to "sell" or "share" your personal information for cross-context behavioral advertising. Non-essential advertising tags are blocked by default on our Site, and you can exercise or confirm your Opt-Out at any time via /privacy-choices/ or by enabling the Global Privacy Control (GPC) signal in your browser.
• 5. Right to Limit Use and Disclosure of Sensitive Personal Information (§ 1798.121): Tacos Gavilan does not collect or use Sensitive Personal Information for purposes other than those exempted under Cal. Civ. Code § 1798.121(a) (and instructs guests not to send sensitive data). If you believe sensitive information was inadvertently submitted to us, you may request its immediate deletion via our Contact Form or info@tacosgavilan.com.
• 6. Right to Non-Discrimination (§ 1798.125): We will not discriminate against you for exercising any of your CCPA/CPRA rights, such as by denying goods or services, charging different prices, or providing a different level or quality of food or service.

F. How to Submit a Privacy Request, Verification, Authorized Agents & Appeals

1. Methods for Submitting a Request: You may submit a verifiable consumer request (Right to Know/Access, Right to Delete, Right to Correct, Opt-Out of Sale/Sharing, or Authorized Agent Request) through any of the following working channels:

• Interactive Web Form: Visit our Contact & Privacy Request Form (/contact/) (or the Contact Form on our homepage), select the specific CCPA request category from the dropdown menu (CCPA Request: Right to Know / Access, Right to Delete, Right to Correct, Opt-Out of Sale/Sharing, or Authorized Agent), and submit your request. You will immediately receive an on-screen confirmation displaying a unique Reference ID (e.g., TG-2026...) and the exact UTC timestamp recorded in our system.
• Email: Send an email to info@tacosgavilan.com with the subject line "California CCPA Privacy Request" and specify the right you wish to exercise.
• Instant Opt-Out of Sale/Sharing: Visit /privacy-choices/ or click "Do Not Sell or Share My Personal Information" in our website footer to immediately disable non-essential analytics and marketing tags without needing identity verification.

2. Identity Verification Process: To protect your privacy and security, we must verify your identity before fulfilling a Request to Know, Access, Delete, or Correct. We verify requests by matching at least two (or three for specific pieces of information) data points you provide (such as your name, email address, telephone number, and approximate date or subject of your prior interaction with us) against records maintained in our database. We will never ask you to provide a Social Security number, driver's license, or payment card number to verify a request.

3. Authorized Agents: You may designate an authorized agent to make a CCPA request on your behalf. For Requests to Know, Delete, or Correct, we require: (a) written, signed permission from the consumer authorizing the agent to submit the request (or a valid power of attorney under the California Probate Code), and (b) direct confirmation from the consumer of their identity and that they granted the agent permission (unless a power of attorney is provided). Requests to Opt-Out of Sale/Sharing submitted by an authorized agent with signed permission or via an automated browser signal (GPC) are honored without requiring additional consumer re-verification.

4. Response Timelines, Extensions, Denials & Appeals:

• Confirmation of Receipt: In addition to your immediate on-screen Reference ID, we confirm receipt of your request within 10 business days.
• Substantive Response: We respond to verifiable requests within 45 calendar days of receipt. If we reasonably require additional time (up to one additional 45-calendar-day extension, for a maximum total of 90 calendar days), we will notify you in writing within the initial 45-day period explaining the reason for the extension.
• Fulfillment & Denials: When fulfilling a deletion or correction request, we update or delete the record in our database and confirm completion to you. If we must deny a request in whole or in part (for example, if identity cannot be verified or a statutory exception applies), we will explain the basis for the denial in writing.
• Appeals & Regulatory Contact: If you wish to appeal our decision regarding a privacy request, you may reply to our response email or write to info@tacosgavilan.com with "CCPA Privacy Appeal" and your Reference ID. If you have unresolved concerns, you may also contact the California Privacy Protection Agency (CPPA) at https://cppa.ca.gov/ or the California Attorney General's Office at https://oag.ca.gov/privacy/ccpa.

G. Privacy Choices Center & Global Privacy Control (GPC)

You have complete control over non-essential cookies and tracking technologies on our Site:

• Strict Prior-Consent Default: Before you make a choice on our Cookie Banner, all non-essential Analytics and Marketing tags default to denied and do not load.
• Granular Preference Center: At any time, you can visit /privacy-choices/ or click "Do Not Sell or Share My Personal Information" in the footer to view your current consent status, toggle Analytics or Marketing on or off, or exercise your one-click CCPA Opt-Out. Your preference is saved in localStorage (tg_cookie_consent), accessible first-party domain tracking cookies (such as _ga, _gid, _gat, _fbp, _ttp, _gcl_au) and session telemetry IDs (tg_session_id) are immediately purged, and if third-party tags were previously loaded in your current tab, the page reloads cleanly so no revoked scripts remain active in memory.
• Automatic Global Privacy Control (GPC) Enforcement: When your browser or privacy extension broadcasts navigator.globalPrivacyControl === true, our Site automatically honors the signal as a valid CCPA Opt-Out of Sale/Sharing, blocks marketing and advertising tags, sets Google Consent Mode v2 advertising storage to denied, and displays a visible "Opt-out request honored" status indicator in our Cookie Banner, Preference Center, and /privacy-choices/ page.

H. Third-Party Service Providers & External Ordering Portals

We disclose or allow connection to only the following verified third-party providers in connection with our Site:

• 1. Vercel Inc. (Infrastructure & Serverless Hosting — Service Provider): Hosts the static website and executes our /api/contact and /api/track serverless endpoints. Receives HTTP requests, IP addresses, and request payloads solely to deliver and secure the Site (Vercel Privacy Policy).
• 2. Supabase, Inc. (Cloud Database — Service Provider): Stores guest inquiries and CCPA privacy requests submitted via /api/contact (public.customer_feedback table) and—only when Analytics consent is granted—aggregate anonymous first-party page metrics via /api/track (public.activity_logs table) on behalf of Tacos Gavilan (Supabase Privacy Policy).
• 3. Google Maps Platform & Google Fonts (Google LLC — Map & Typography Delivery): Our homepage and location pages load web fonts from fonts.googleapis.com / fonts.gstatic.com and interactive store map tiles from Google Maps Platform. Your browser connects to Google servers (sharing your IP address and browser headers) to render fonts and maps (Google Privacy Policy).
• 4. Google Tag Manager & Google Analytics (GTM-WW2N58Z, Google LLC — Consent-Gated Analytics/Marketing): Blocked by default prior to user consent. Only if you explicitly opt in on our Cookie Banner or Preference Center does the Site load gtm.js to measure site usage or campaign events.
• 5. Meta Pixel (2180512185415859, Meta Platforms, Inc.) & TikTok Pixel (C72F1PTP2K6V4FLP2V5G, TikTok Inc.) — Consent-Gated Advertising Pixels on Homepage: Configured on our homepage (index.html) and strictly blocked by default. Neither script is downloaded or executed unless you explicitly opt in to Marketing Cookies and Global Privacy Control (GPC) is not active. When enabled by your consent, they receive pageview and button interaction events along with advertising identifiers (Meta Privacy Policy · TikTok Privacy Policy).
• 6. Online Ordering via order.online (Operated by DoorDash, Inc.) & Toast POS (Toast, Inc.): When you click "Order Online," you leave tacosgavilan.com and enter order.online, an independent ordering platform operated by DoorDash, Inc. DoorDash processes your checkout, payment card, and delivery coordination under its own Privacy Policy and Terms, and transmits order preparation details to our restaurant's Toast POS system (Toast Privacy Statement).
• 7. Email & SMS Marketing Disclosure: This website (tacosgavilan.com) does not currently operate an automated marketing newsletter or SMS marketing subscription program. Submissions through our Contact Form are used solely for transactional guest support and privacy request fulfillment—never to auto-enroll you in marketing lists.

I. Data Security Safeguards

We use reasonable administrative, technical, and organizational safeguards appropriate to the information processed. Specifically, on this Site we implement HTTPS/TLS encryption in transit, server-side HTML and script tag stripping on contact form inputs, strict field length and payload size limits, HTTP Origin/Referer validation, honeypot anti-spam filtering, and IP-based rate limiting on our /api/contact endpoint. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

J. Data Breach Investigation & Notification

In the event of a suspected or confirmed security incident affecting personal information maintained by Tacos Gavilan, we will promptly investigate the incident, take reasonable steps to mitigate potential harm and restore system integrity, and notify affected individuals and applicable regulatory authorities (including under California Civil Code § 1798.82) as required by applicable law.

K. Children's Privacy & Policy Updates

Our Site is not directed to children under the age of 16, and we do not knowingly collect, sell, or share personal information from children under 16. If you are a parent or guardian and believe your child has provided personal information to us via our Contact Form, please contact us at info@tacosgavilan.com and we will promptly delete such information. We may update this Privacy Policy from time to time and will post the updated version and "Last Updated" date on this page.