Privacy Policy

This Privacy Policy describes how Costa Vida ("we," "us," or "our") collects, uses, discloses, and protects your personal information when you visit our website at foodcostavida.rest, use our online ordering services, participate in our loyalty programs, or otherwise interact with us. Please read this policy carefully. By accessing or using our services, you acknowledge that you have read, understood, and agree to the practices described herein.

We are committed to protecting your privacy and handling your personal information in an open and transparent manner. This Privacy Policy applies to all users of our website and services located in the United States, and we comply with applicable federal and state privacy laws, including the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), the Federal Trade Commission Act (FTC Act), and other applicable state and federal regulations.

1. About Us

Costa Vida is a food service company operating in the United States. We provide fresh Mexican-inspired food, online ordering, catering services, and loyalty rewards programs to our customers. For all privacy-related matters, you may contact us using the information provided below:

2. Information We Collect

We collect various types of personal information about you in the course of your interactions with us. The categories of information we collect are described below.

2.1 Personal Identification Information

When you create an account, place an order, sign up for our loyalty program, contact customer service, or otherwise interact with us, we may collect personal identification information including but not limited to:

• Full name
• Email address
• Mailing or delivery address
• Phone number
• Date of birth (for age verification and birthday rewards)
• Username and password for account access
• Profile photo or avatar (if voluntarily provided)

2.2 Payment and Financial Information

When you make a purchase through our website or in-store systems, we collect payment information necessary to process your transaction. This may include:

• Credit or debit card numbers (processed securely through our payment processors)
• Billing address
• Transaction history and purchase records
• Gift card numbers and balances

We do not store full credit card numbers on our servers. Payment card data is processed through PCI DSS-compliant third-party payment processors.

2.3 Usage and Behavioral Data

When you visit our website or use our mobile application, we automatically collect information about how you interact with our services, including:

• Pages visited and content viewed
• Time and date of your visit
• Duration of your session
• Links and buttons clicked
• Search terms entered on our website
• Items added to or removed from your cart
• Order history and food preferences
• Frequency of visits and ordering patterns

2.4 Device and Technical Information

We collect technical information about the devices and software you use to access our services, including:

• IP address
• Browser type and version
• Operating system and device type
• Device identifiers (such as mobile advertising IDs)
• Screen resolution and language settings
• Referring URLs and exit pages
• Internet service provider

2.5 Location Information

With your consent, we may collect precise or approximate location data to help you find the nearest Costa Vida location, facilitate delivery services, or provide location-relevant offers. You may disable location tracking through your device settings, though this may limit certain features of our services.

2.6 Communications and Customer Service Data

When you contact us for customer service or communicate with us through any channel, we may collect:

• Contents of emails, chat messages, or other communications
• Records of telephone calls (which may be recorded for quality assurance purposes, with prior notice)
• Feedback and survey responses
• Reviews and ratings submitted through our platforms

2.7 Information from Third Parties

We may receive personal information about you from third-party sources, such as:

• Social media platforms if you log in or connect your social media account with our services
• Third-party loyalty or rewards program partners
• Marketing and analytics partners
• Delivery service providers
• Publicly available sources

2.8 Cookies and Tracking Technologies

We use cookies, web beacons, pixels, and similar tracking technologies to collect information about your browsing activity on our website. For detailed information about the cookies we use, please see Section 8 of this Privacy Policy and our dedicated Cookie Policy available on our website.

3. How We Use Your Information

We use the personal information we collect for a variety of legitimate business purposes. The primary uses of your information are described below.

3.1 Providing and Managing Our Services

We use your information to:

• Process and fulfill your food orders (online, in-app, or in-store)
• Create and manage your customer account
• Administer our loyalty and rewards programs
• Process payments and issue refunds
• Facilitate delivery services and coordinate with delivery partners
• Send order confirmations, receipts, and status updates
• Provide customer support and respond to your inquiries
• Manage catering bookings and special orders

3.2 Personalization and Enhanced Experience

We use your information to personalize your experience with us, including:

• Remembering your food preferences and dietary restrictions
• Offering personalized menu recommendations
• Saving your favorite orders for quick reordering
• Tailoring the content and offers displayed to you on our website and app
• Delivering birthday rewards and anniversary offers

3.3 Marketing and Promotional Communications

With your consent where required by law, we may use your information to:

• Send promotional emails, newsletters, and special offers
• Deliver targeted advertising through our website, app, and third-party platforms
• Notify you about new menu items, seasonal promotions, and limited-time offers
• Invite you to participate in surveys, contests, or sweepstakes
• Conduct SMS/text message marketing campaigns (with your express consent)

You may opt out of marketing communications at any time by clicking the "unsubscribe" link in any marketing email, replying "STOP" to any SMS, or contacting us at [email protected].

3.4 Analytics and Service Improvement

We use your data to analyze trends, understand how our services are used, and improve our offerings. This includes:

• Conducting internal research and analytics
• Monitoring website performance and identifying technical issues
• Evaluating the effectiveness of our marketing campaigns
• Developing new products, features, and menu items
• Measuring customer satisfaction and loyalty

3.5 Legal Compliance and Safety

We may use your information as necessary to:

• Comply with applicable laws, regulations, and legal processes
• Detect, prevent, and investigate fraud, abuse, or security incidents
• Enforce our Terms of Service and other agreements
• Protect the rights, property, and safety of Costa Vida, our customers, and others
• Respond to lawful requests from law enforcement authorities

4. Sharing Your Information with Third Parties

We do not sell your personal information to third parties in the traditional sense. However, we do share your information with certain third parties as described below.

4.1 Service Providers and Vendors

We work with trusted third-party service providers who assist us in operating our business. These providers are contractually obligated to use your information only for the purposes we specify and in accordance with this Privacy Policy. Categories of service providers include:

• Payment processors: to securely handle payment card transactions
• Delivery partners: third-party delivery platforms and logistics companies to fulfill your orders
• Cloud hosting and IT providers: to store and manage our data infrastructure
• Email and SMS marketing platforms: to send communications on our behalf
• Analytics providers: such as Google Analytics, to help us understand website usage
• Customer support tools: to manage customer service interactions
• Loyalty program administrators: to operate rewards programs
• Advertising networks: to deliver targeted advertisements

4.2 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your personal information may be transferred to the acquiring entity or successor. We will notify you of any such change and any material changes to how your information will be handled, and you will have the opportunity to exercise your privacy rights.

4.3 Legal Requirements and Law Enforcement

We may disclose your personal information to government authorities, law enforcement agencies, or other third parties when we believe disclosure is necessary to:

• Comply with applicable law, regulation, or legal process
• Respond to a valid subpoena, court order, or government request
• Protect the rights, property, or safety of Costa Vida, our customers, or others
• Investigate or prevent fraud, security breaches, or illegal activity

4.4 Affiliates and Corporate Family

We may share your information with our corporate affiliates and related entities for purposes consistent with this Privacy Policy, including for shared services, marketing, and business operations.

4.5 With Your Consent

We may share your information with third parties for any other purpose with your prior consent or at your direction.

5. Data Security

We take the security of your personal information seriously and implement a range of technical, administrative, and physical security measures to protect your data from unauthorized access, disclosure, alteration, loss, or destruction.

5.1 Security Measures We Employ

• Encryption: We use industry-standard SSL/TLS encryption to protect data transmitted between your browser and our servers. Sensitive data, including payment information, is encrypted at rest and in transit.
• Access Controls: Access to personal information is restricted to authorized personnel who require it to perform their job functions. We use role-based access controls and multi-factor authentication for sensitive systems.
• Payment Security: Our payment processing systems are compliant with the Payment Card Industry Data Security Standard (PCI DSS).
• Regular Security Assessments: We conduct regular vulnerability assessments, penetration testing, and security audits to identify and address potential risks.
• Incident Response: We maintain a documented incident response plan to address data breaches or security incidents promptly and in accordance with applicable notification laws.
• Employee Training: All employees who handle personal information receive training on data privacy and security best practices.

5.2 Limitations

Despite our best efforts, no method of data transmission over the internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security. In the event of a data breach that affects your rights and interests, we will notify you as required by applicable law.

You are also responsible for maintaining the security of your account credentials. Please use a strong, unique password and do not share your login information with others. If you suspect unauthorized access to your account, please contact us immediately at [email protected].

6. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

6.1 Retention Periods by Data Category

When personal information is no longer necessary for the purposes for which it was collected, we will securely delete or anonymize it in accordance with our data retention policies and applicable law.

7. Your Privacy Rights

Depending on your state of residence, you may have specific rights regarding your personal information. We are committed to honoring these rights and making it easy for you to exercise them.

7.1 Rights Available to All U.S. Residents

Regardless of your state of residence, you have the right to:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request that we correct inaccurate or incomplete personal information.
• Opt-Out of Marketing: Opt out of receiving marketing communications from us at any time.
• File a Complaint: Lodge a complaint with us or with the relevant supervisory authority if you believe your privacy rights have been violated.

7.2 California Residents – CCPA/CPRA Rights

If you are a resident of California, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), including:

• Right to Know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which the information was collected, the business or commercial purpose for collecting or selling the information, and the categories of third parties with whom we share the information.
• Right to Delete: You have the right to request deletion of your personal information that we have collected, subject to certain exceptions.
• Right to Correct: You have the right to request that we correct inaccurate personal information we maintain about you.
• Right to Opt-Out of Sale/Sharing: You have the right to opt out of the sale or sharing of your personal information for cross-context behavioral advertising purposes.
• Right to Limit Use of Sensitive Personal Information: You have the right to limit our use and disclosure of sensitive personal information (such as precise geolocation, financial account information, and health data) to only what is necessary to provide the services you requested.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights. This means we will not deny you goods or services, charge you different prices, provide a different level of service quality, or suggest that you will receive different treatment because you exercised your privacy rights.
• Right to Data Portability: You have the right to receive a copy of your personal information in a portable, readily usable format.

To submit a verifiable consumer request or exercise any of your California privacy rights, please contact us at:

• Email: [email protected]
• Website: foodcostavida.rest

We will respond to your verifiable consumer request within 45 days of receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing. We will verify your identity before processing your request by asking you to provide certain information consistent with what we already have on file for you.

You may also designate an authorized agent to submit requests on your behalf. We will require proof of the agent's authorization and may verify your identity directly.

7.3 Rights Under Other State Laws

Residents of other states, including but not limited to Virginia (CDPA), Colorado (CPA), Connecticut (CTDPA), and Texas (TDPSA), may also have specific privacy rights. We aim to honor applicable privacy rights for residents of all states. Please contact us at [email protected] to exercise your rights.

7.4 How to Submit a Privacy Request

To exercise any of your privacy rights, please submit your request by:

• Emailing us at [email protected] with the subject line "Privacy Rights Request"
• Visiting our website at foodcostavida.rest

Please include your full name, email address associated with your account, your state of residence, and a description of your specific request. We may need to verify your identity before processing your request.

8. Cookie Policy

Our website uses cookies and similar tracking technologies to enhance your browsing experience, analyze site traffic, and deliver personalized content and advertising.

8.1 Types of Cookies We Use

• Essential/Strictly Necessary Cookies: These cookies are required for the website to function properly. They enable core functionalities such as security, shopping cart management, and account authentication. These cookies cannot be disabled.
• Performance and Analytics Cookies: These cookies collect information about how visitors use our website, such as which pages are visited most often. This data helps us improve website performance and user experience. (e.g., Google Analytics)
• Functional Cookies: These cookies allow the website to remember choices you make (such as language preferences, saved order details, or location) and provide enhanced, more personalized features.
• Targeting and Advertising Cookies: These cookies are used to deliver advertisements relevant to your interests. They also limit the number of times you see an ad and help us measure the effectiveness of our advertising campaigns.

8.2 Managing Your Cookie Preferences

You can manage or disable cookies through your browser settings. Most browsers allow you to block or delete cookies. Please note that disabling certain cookies may affect the functionality of our website. For detailed information about the specific cookies we use and how to manage them, please review our full Cookie Policy available on our website.

You may also opt out of certain interest-based advertising by visiting:

• Network Advertising Initiative Opt-Out
• Digital Advertising Alliance Opt-Out

9. Children's Privacy

Our website, services, and loyalty programs are intended for use by individuals who are at least 18 years of age. We do not knowingly collect, use, or disclose personal information from children under the age of 13 without verifiable parental consent, as required by the Children's Online Privacy Protection Act (COPPA).

If you are between the ages of 13 and 17, please do not use our website or services without the involvement and consent of a parent or legal guardian. If you are a parent or guardian and believe your child under the age of 13 has provided us with personal information without your consent, please contact us immediately at [email protected] and we will take prompt steps to delete such information from our records.

We do not intentionally market our online services directly to minors. Our promotional programs, loyalty sign-ups, and account creation features are designed for adult consumers.

10. International Data Transfers

Costa Vida is headquartered and operates primarily in the United States. All personal information we collect is processed and stored in the United States. If you are accessing our services from outside the United States, please be aware that your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country of residence.

By using our services from outside the United States, you consent to the transfer of your personal information to the United States. We take appropriate safeguards to ensure that any international transfers of personal information are conducted in compliance with applicable law and that your information receives adequate protection.

We do not specifically target users in jurisdictions outside the United States, and our services are designed for a United States audience. If you have questions about international data transfers, please contact us at [email protected].

11. Third-Party Links and Services

Our website may contain links to third-party websites, apps, or services, including social media platforms, delivery apps, and third-party payment portals. These third-party services have their own privacy policies, and we are not responsible for their privacy practices or content. We encourage you to review the privacy policies of any third-party services you access through our website before providing them with your personal information.

The inclusion of a link on our website does not constitute our endorsement of the third party's privacy practices or security measures.

12. Social Media and User-Generated Content

Our website and app may offer features that allow you to connect your social media accounts (such as Facebook, Instagram, or Google) to our services. When you use these features, we may receive information from the social media platform in accordance with its privacy settings and your authorization. We encourage you to review the privacy settings of your social media accounts.

If you submit reviews, photos, or other user-generated content through our platforms or tag us on social media, please be aware that such content may be publicly visible. Do not include sensitive personal information in any public submissions.

13. Do Not Track Signals

Some web browsers transmit "Do Not Track" (DNT) signals to websites. At this time, there is no universally accepted standard for how websites should respond to DNT signals. Currently, our website does not alter its data collection or use practices in response to DNT signals from your browser.

California residents should refer to Section 7.2 for information about your rights to opt out of the sale or sharing of personal information.

14. Your Choices and Opt-Out Options

We provide you with several ways to control how your personal information is collected and used:

• Email Marketing: Click the "unsubscribe" link in any marketing email, or contact us at [email protected].
• SMS/Text Marketing: Reply "STOP" to any marketing text message to opt out.
• Push Notifications: Disable push notifications through your device settings or app notification settings.
• Location Services: Disable location tracking through your device settings or browser permissions.
• Cookies: Manage cookie preferences through your browser settings or our cookie management tool on the website.
• Account Closure: Contact us at [email protected] to request closure of your account.
• Targeted Advertising: Opt out of interest-based advertising through the advertising network opt-out tools referenced in Section 8.2.

Please note that even if you opt out of marketing communications, we may still send you transactional or service-related communications necessary for the performance of our contract with you (such as order confirmations and receipts).

15. How to File a Complaint

If you have concerns about how we handle your personal information and believe we have not adequately addressed your concerns, you have the right to file a complaint with the appropriate authority.

15.1 Contact Us First

We encourage you to contact us first so that we can attempt to resolve your concern directly:

• Email: [email protected]
• Subject Line: "Privacy Complaint"

We will acknowledge your complaint within 10 business days and aim to resolve it within 30 days.

15.2 Federal Trade Commission (FTC)

The Federal Trade Commission Act (FTC Act) protects consumers against unfair or deceptive practices, including violations of stated privacy policies. If you believe your privacy rights under federal law have been violated, you may file a complaint with the FTC:

• Website: ftc.gov/complaint
• Phone: 1-877-382-4357
• Address: Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580

15.3 California Residents

California residents may file complaints with the California Privacy Protection Agency (CPPA) or the California Attorney General's Office:

• California Privacy Protection Agency: cppa.ca.gov
• California Attorney General: oag.ca.gov/privacy/ccpa

15.4 State Attorneys General

Residents of other states may file privacy-related complaints with their respective State Attorney General's office. We encourage you to contact your state's consumer protection agency for further guidance.

16. Changes to This Privacy Policy

We reserve the right to update, modify, or replace this Privacy Policy at any time to reflect changes in our practices, technologies, legal requirements, or for any other reason. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Post a prominent notice on our website and/or app
• Where required by law, notify you directly via email or other appropriate means

Your continued use of our website or services after any changes become effective constitutes your acceptance of the revised Privacy Policy. If you do not agree with any changes, you should discontinue your use of our services and may request deletion of your account and personal information.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

17. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please do not hesitate to contact us. We are committed to addressing your privacy concerns in a timely and transparent manner.

This Privacy Policy was last updated on June 4, 2026, and is effective as of that date. This policy applies to the website foodcostavida.rest and all associated services offered by Costa Vida in the United States.