Privacy Policy

Welcome to Costa Vida ("Costa Vida," "we," "us," or "our"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website costavida.digital (the "Site"), use our online ordering platform, engage with our digital services, or otherwise interact with us in connection with our food business operations.

Please read this Privacy Policy carefully. If you disagree with its terms, please discontinue use of our Site and services. By accessing or using costavida.digital, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy.

For any questions or concerns regarding this policy, you may contact us at any time using the information provided in the Contact Us section below.

1. Information We Collect

We collect several types of information from and about users of our Site and services. This information falls into the following categories:

1.1 Personal Information You Provide Directly

When you interact with Costa Vida — whether by creating an account, placing an online food order, signing up for our loyalty program, subscribing to our newsletter, contacting our customer support team, or completing a form on our Site — you may provide us with personal information that identifies you as an individual. This may include, but is not limited to:

• Full name
• Email address
• Phone number
• Mailing or delivery address (for delivery and billing purposes)
• Payment information (such as credit or debit card details, processed securely through third-party payment processors)
• Date of birth (where required for age verification or loyalty programs)
• Account username and password
• Dietary preferences and food order history
• Feedback, reviews, and communications you submit to us
• Survey responses and contest entries

1.2 Information Collected Automatically

When you visit costavida.digital, we automatically collect certain technical and usage information through cookies, web beacons, log files, pixel tags, and similar tracking technologies. This information may include:

• IP address
• Browser type and version
• Operating system
• Device type and identifiers (desktop, mobile, tablet)
• Referring URLs (the page you visited before arriving at our Site)
• Pages viewed and time spent on each page
• Links clicked within our Site
• Search queries entered on our Site
• Date and time of your visit
• Geographic location data (at a city or regional level, based on IP address)
• Session and interaction data

1.3 Cookie and Tracking Technology Data

We use cookies and similar tracking technologies to enhance your experience on our Site, remember your preferences, analyze usage patterns, and deliver targeted advertising. Cookies are small text files placed on your device when you visit a website. For detailed information about the specific cookies we use, their purposes, and how to manage your preferences, please refer to our Cookie Policy.

1.4 Device Information

We may collect information about the device you use to access our Site, including the hardware model, mobile network information, unique device identifiers, and mobile operating system. This information helps us optimize the presentation of our Site and troubleshoot technical issues.

1.5 Information From Third Parties

We may receive information about you from third parties, including:

• Social media platforms (if you connect your account or interact with our pages)
• Third-party delivery partners (such as DoorDash, Uber Eats, or Grubhub) when you order through their platforms
• Analytics and advertising partners
• Loyalty and rewards program partners
• Payment processors and fraud prevention services

2. How We Use Your Information

Costa Vida uses the information we collect for a variety of legitimate business purposes. Specifically, we use your information to:

2.1 Provide and Manage Our Services

• Process and fulfill your food orders, including delivery and pickup coordination
• Create and manage your account on our platform
• Administer our loyalty and rewards programs
• Process payments and prevent fraudulent transactions
• Send order confirmations, receipts, and status updates
• Respond to your inquiries, complaints, and customer service requests

2.2 Improve and Personalize Your Experience

• Analyze usage patterns to improve our Site's functionality, menu offerings, and user experience
• Personalize content, recommendations, and promotions based on your order history and preferences
• Conduct research and development to enhance our food products and digital services
• Perform internal quality assurance and testing

2.3 Marketing and Communications

• Send you promotional emails, newsletters, special offers, and information about new menu items — with your consent where required by law
• Deliver targeted advertising on our Site and third-party platforms based on your interests and browsing behavior
• Conduct surveys and solicit feedback to improve our services
• Notify you about contests, sweepstakes, and promotional events

You may opt out of receiving marketing communications from us at any time by clicking the "unsubscribe" link in any email we send, or by contacting us directly at [email protected].

2.4 Legal and Compliance Purposes

• Comply with applicable federal, state, and local laws and regulations
• Enforce our Terms of Service and other agreements
• Protect our legal rights and defend against legal claims
• Investigate and prevent fraud, security breaches, and other harmful or illegal activity
• Respond to lawful requests from government authorities and law enforcement agencies

2.5 Analytics and Business Intelligence

• Understand customer demographics and behavioral trends
• Measure the effectiveness of our marketing campaigns
• Generate aggregated, anonymized statistical reports
• Support strategic business planning and decision-making

3. How We Share Your Information

Costa Vida does not sell your personal information to third parties for their own direct marketing purposes. However, we may share your information with certain trusted parties under the following circumstances:

3.1 Service Providers and Business Partners

We work with carefully selected third-party service providers who assist us in operating our business and delivering our services. These providers are granted access to your personal information only to the extent necessary to perform their functions, and they are contractually obligated to protect your information and use it solely for the purposes we specify. These service providers include:

• Payment processors (e.g., Stripe, Square, or similar platforms) for secure transaction processing
• Third-party delivery platforms (e.g., DoorDash, Uber Eats, Grubhub) for order fulfillment
• Cloud hosting and infrastructure providers
• Email marketing and communication platforms
• Customer relationship management (CRM) software providers
• Analytics providers (e.g., Google Analytics)
• Advertising and retargeting networks
• Fraud detection and cybersecurity services
• Loyalty program technology providers

3.2 Legal Requirements and Law Enforcement

We may disclose your personal information if we believe in good faith that such disclosure is necessary to:

• Comply with a legal obligation, court order, subpoena, or governmental request
• Enforce our Terms of Service or other contractual rights
• Protect the safety, rights, or property of Costa Vida, our customers, or the public
• Investigate and prevent fraud, security threats, or illegal activity

3.3 Business Transfers

In the event that Costa Vida undergoes a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of its assets, your personal information may be transferred as part of that transaction. We will notify you via prominent notice on our website or by email prior to your information being transferred and becoming subject to a different privacy policy.

3.4 With Your Consent

We may share your information with third parties in other cases where we have your explicit consent to do so.

3.5 Aggregated and Anonymized Data

We may share aggregated, de-identified, or anonymized data — which cannot reasonably be used to identify you — with business partners, advertisers, investors, and other third parties for marketing, research, and analytical purposes.

4. Data Security

The security of your personal information is a top priority at Costa Vida. We implement a variety of industry-standard technical, administrative, and physical security measures designed to protect your data from unauthorized access, disclosure, alteration, and destruction. These measures include:

• SSL/TLS encryption to protect data transmitted between your browser and our servers
• Encrypted storage of sensitive personal and payment information
• Access controls that restrict access to personal data to authorized personnel only, based on a need-to-know basis
• Regular security audits and vulnerability assessments
• Multi-factor authentication for internal systems and administrative access
• Firewalls and intrusion detection systems
• Employee training on data protection and privacy best practices
• PCI DSS compliance for all payment card data handling

While we take all reasonable steps to protect your personal information, no method of transmission over the Internet or method of electronic storage is 100% secure. Therefore, although we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security. In the event of a data breach that affects your rights and freedoms, we will notify you and applicable regulatory authorities as required by applicable law.

5. Your Privacy Rights

Depending on your state of residence, you may have specific rights with respect to your personal information. We are committed to honoring these rights in accordance with applicable law, including the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), and other applicable U.S. state privacy laws.

5.1 Right to Know and Access

You have the right to request that we disclose to you the categories and specific pieces of personal information we have collected about you, the sources from which we collected it, the purposes for which we use it, and the categories of third parties with whom we share it.

5.2 Right to Correction

You have the right to request that we correct inaccurate personal information we maintain about you, subject to certain exceptions.

5.3 Right to Deletion

You have the right to request that we delete personal information we have collected from you, subject to certain exceptions (such as where retention is required to complete a transaction, comply with a legal obligation, or for other legitimate purposes permitted by law).

5.4 Right to Opt Out of Sale or Sharing

Under the CCPA/CPRA, California residents have the right to opt out of the sale or sharing of their personal information for cross-context behavioral advertising purposes. If applicable, you may exercise this right by clicking the "Do Not Sell or Share My Personal Information" link on our Site or by contacting us directly.

5.5 Right to Data Portability

You have the right to receive a copy of your personal information in a structured, commonly used, and machine-readable format, where technically feasible, so that you may transfer it to another service provider.

5.6 Right to Limit Use of Sensitive Personal Information

Under the CPRA, California residents have the right to limit our use of sensitive personal information (such as financial data, precise geolocation, and certain health-related data) to only those purposes explicitly permitted by law.

5.7 Right to Non-Discrimination

We will not discriminate against you for exercising any of your privacy rights. This means we will not deny you goods or services, charge you different prices, or provide you with a lesser quality of service because you exercised your rights under applicable privacy law.

5.8 How to Exercise Your Rights

To exercise any of the rights described above, please submit a verifiable request to us using one of the following methods:

• Email: [email protected]
• Website: costavida.digital

We will acknowledge receipt of your request within 10 business days and respond substantively within 45 days of receipt. If we require more time (up to an additional 45 days), we will inform you of the reason and extension period in writing.

We may need to verify your identity before processing your request. This verification process may involve requesting information that matches the records we have on file. We will not process a request if we are unable to verify your identity.

You may also designate an authorized agent to submit requests on your behalf. The authorized agent must provide written proof of their authorization, and we may require you to verify your identity directly with us.

6. Cookies and Tracking Technologies

Costa Vida uses cookies, web beacons, pixel tags, local storage objects, and other similar technologies to enhance your browsing experience, remember your preferences, analyze Site performance, and deliver personalized content and advertising.

The types of cookies we use include:

You can manage your cookie preferences through your browser settings or our cookie preference center. However, disabling certain cookies may affect the functionality of our Site. For complete information on our cookie practices, please review our full Cookie Policy.

7. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. The specific retention periods we apply are as follows:

When personal information is no longer needed for its original purpose and no legal retention obligation applies, we will securely delete or anonymize it in accordance with our internal data disposal procedures.

8. Children's Privacy

Our Site and services are intended for use by individuals who are 18 years of age or older. We do not knowingly collect, use, or disclose personal information from children under the age of 13, or between the ages of 13 and 17 without appropriate parental consent, in accordance with the Children's Online Privacy Protection Act (COPPA).

If you are under 18 years of age, please do not use our Site or submit any personal information to us. If you are a parent or guardian and believe that your child under the age of 13 has provided us with personal information without your consent, please contact us immediately at [email protected] so that we can take appropriate action to locate and delete that information from our records.

If we discover that we have inadvertently collected personal information from a child under 13, we will promptly delete such information from our systems.

9. International Data Transfers

Costa Vida is based in the United States, and our services are primarily directed at users located within the United States. Your personal information is collected, processed, and stored on servers located in the United States.

If you are accessing our Site from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country or jurisdiction. The United States may not provide the same level of data protection as your home country.

By using our Site and services, you acknowledge and consent to the transfer of your information to the United States and its processing in accordance with this Privacy Policy. We take appropriate steps to ensure that any international transfers of personal data are conducted in compliance with applicable laws and that adequate safeguards are in place to protect your information.

10. Additional Rights for California Residents

If you are a California resident, you are entitled to specific rights and disclosures under the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act of 2020 (CPRA), and other applicable California privacy laws, including the California Shine the Light Law (California Civil Code § 1798.83).

10.1 Categories of Personal Information Collected

In the preceding 12 months, Costa Vida has collected the following categories of personal information from California consumers:

• Identifiers (name, email address, IP address, account name)
• Customer records information (phone number, address, payment information)
• Commercial information (purchase history, preferences)
• Internet or other electronic network activity information (browsing history on our Site, interaction data)
• Geolocation data (approximate location based on IP address or delivery address)
• Inferences drawn from personal information (to build a profile about your preferences)

10.2 California Privacy Rights Requests

California residents may submit requests to exercise their CCPA/CPRA rights as described in Section 5 of this Privacy Policy. We will not charge a fee for processing your request unless it is excessive, repetitive, or manifestly unfounded. We may provide information in response to your request up to twice within a 12-month period.

10.3 Shine the Light Disclosure

Under California Civil Code § 1798.83, California residents may request information about any disclosure of their personal information to third parties for those third parties' direct marketing purposes during the preceding calendar year. To make such a request, please contact us at [email protected].

11. Third-Party Websites and Links

Our Site may contain links to third-party websites, applications, or services that are not owned or controlled by Costa Vida, including links to our delivery partners, social media pages, and payment processors. This Privacy Policy applies solely to information collected by Costa Vida through costavida.digital and our direct services.

We have no control over, and assume no responsibility for, the content, privacy practices, or policies of any third-party websites or services. We encourage you to review the privacy policies of every website and application you visit before providing any personal information.

12. Do Not Track Signals

Some web browsers include a "Do Not Track" (DNT) feature that signals to websites that you do not want your online activities tracked. Currently, there is no universally accepted standard for how companies should respond to DNT signals. As a result, our Site does not currently respond to DNT browser signals. We continue to monitor developments in this area and will update our practices if a standard is established.

California residents may also exercise their right to opt out of the sharing of personal information for cross-context behavioral advertising purposes, as described in Section 5.4 above.

13. FTC Compliance and Consumer Protection

Costa Vida's privacy and data practices are designed to comply with the Federal Trade Commission Act (FTC Act), which prohibits unfair or deceptive practices in commerce, including with respect to privacy and data security. We are committed to transparent data practices, providing clear and accurate representations about how we collect and use consumer information, and maintaining reasonable data security measures consistent with FTC guidance.

If you believe that our data practices are unfair, deceptive, or otherwise in violation of applicable consumer protection laws, you have the right to file a complaint with the Federal Trade Commission (FTC) at www.ftc.gov or by calling 1-877-FTC-HELP (1-877-382-4357).

14. How to File a Privacy Complaint

If you have a complaint about how we handle your personal information, we encourage you to contact us first so that we can attempt to resolve your concern directly.

14.1 Contact Costa Vida

Please reach out to us using the contact information provided in Section 15. We will investigate your complaint and respond within a reasonable timeframe, typically within 30 days.

14.2 File a Complaint With a Regulatory Authority

If you are not satisfied with our response, or if you believe we are processing your personal information in a manner inconsistent with applicable law, you may file a complaint with the appropriate data protection or consumer protection authority:

15. Changes to This Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes to this policy, we will:

• Update the "Last Updated" date at the top of this page
• Post the revised policy on costavida.digital
• Send an email notification to registered users (where required by law or where the changes are material)
• Display a prominent notice on our Site for a reasonable period following the update

Your continued use of our Site and services after the effective date of any updated Privacy Policy constitutes your acceptance of the revised policy. We encourage you to review this page periodically to stay informed about how we protect your information.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy, your personal information, or our data practices, please do not hesitate to contact us:

We are dedicated to resolving any privacy-related concerns you may have in a timely, fair, and transparent manner. Our team will acknowledge receipt of your inquiry within 5 business days and work diligently to provide a complete response as soon as practicable.