Privacy Policy

1. Information We Collect

We collect information you provide directly to us, including your name, email address, phone number, delivery addresses, and the exact delivery pin you confirm for a delivery order. With your permission, we may also use your device location to help you find nearby restaurants. Additionally, we store your order history and device identifiers to provide and improve our services.

On this website specifically:

• Guest checkout. You can order without an account. The contact details, delivery address and instructions you enter, together with your cart, are saved in your browser’s local storage on your device so a refresh does not lose your order. Cart items are cleared after 7 days. Your browser also keeps a short list of your recent guest order references and the phone number or email used for them, so you can open their tracking pages again. You can remove all of this by clearing this site’s data in your browser. See the Cookies Policy for every item stored.
• Orders and payments. When you place an order, the details you enter are sent to our servers to create the order, and card details go directly to our payment processor — Stripe or Shift4, depending on the location (see Section 3).
• Technical information. Like any website, our servers and hosting provider receive your IP address, browser type and the pages you request. Our error and performance monitoring is described in Section 3.

2. How We Use Your Information

We use the information we collect to process your orders and payments, send you notifications about your orders and promotions (with your consent), improve and personalize your experience, and administer the Santa Fe Burrito Grill loyalty rewards program.

We also use technical and diagnostic information to keep the app and website secure, find and fix errors, and keep pages fast.

3. Information Sharing

We do not sell your personal data. We share specific information with the following service providers solely to operate the app and website:

• Stripe and Shift4 (payment processors): we are moving online card payments from Stripe to Shift4 one location at a time, so while the move is under way each location takes payments through one of them. When you check out, your card details go securely to that location’s processor — on Shift4 locations through Shift4’s own card fields on our pages, which also run your bank’s card verification (3-D Secure) and receive device and browser information Shift4 uses to prevent fraud — and we receive a payment confirmation with the card type and last four digits. If you save a card at a Shift4 location, Shift4 keeps it for that location only and we keep a reference to it. We never store your full card number or security code.
• Uber Direct: for delivery orders we share the delivery recipient’s name, phone number, address, selected delivery-pin coordinates, instructions, and order information needed to quote and complete the delivery.
• Supabase: provides authentication, database, file storage, and server functions used to operate accounts and orders.
• OpenAI: processes messages you choose to send through support chat so the in-app assistant can respond. For signed-in customers, the assistant also receives up to six recent orders (order reference, status, fulfillment type, date, item and modifier names, total, and refund status), plus current menu, price, location, and store-hours data. It does not receive card numbers, security codes, delivery addresses, customer phone numbers, or payment credentials. Do not send payment card details in support messages.
• Resend: delivers transactional messages such as order receipts and confirmations to the email address you provide.
• Crash and error reports (app and website): when crash reporting is turned on, the app and this website send a diagnostic report to our own monitoring service on our Supabase backend if they crash or hit an error: what went wrong in the code, the app or website version, the device model, operating system or browser, the selected restaurant and the last screens or pages used. Reports never include your name, email, phone number, address, payment details or anything you type into a form, and a random identifier of the app installation or of your visit is kept only in a one-way (hashed) form. We use the open-source Sentry software libraries to send them, but nothing is sent to Sentry. No performance traces are collected, and the reports are not used for advertising.
• Website error and performance monitoring: this website reports page errors, failed checkout steps and page-speed measurements (for about one in four page loads) to our own monitoring service, which runs on our Supabase backend. Reports carry the page route, the website version and a random identifier for your visit. Before a report leaves your device, addresses, tokens and other identifiers are removed; we do not send your name, email, phone number, delivery address, payment details or anything you type into a form.
• Expo and Apple / Google push services: deliver order and opted-in marketing notifications to the app. A token tied to the app installation is stored on our servers.
• Vercel: hosts this website and the authenticated restaurant admin portal used by authorized staff to operate orders, support, menus, and reports. On this website it also measures how fast pages load and counts page views (Vercel Speed Insights and Web Analytics) without cookies and without building a profile of you; addresses that carry a personal link or code are never sent.
• Device mapping services: we use your device’s location permission to show nearby restaurants and, on Android, to enable the system geocoder that positions and confirms a delivery pin. The delivery-pin flow uses the address you enter and the pin you select, not your current device location. We request location only while in use, do not continuously track you, and do not store a device-location history. The confirmed delivery address and exact pin coordinates may be processed by mapping services and are retained in delivery quote and order records and sent to Uber Direct when you place a delivery order.
• OpenStreetMap (website): to place the delivery pin on this website, the delivery address you enter (or the position of the pin you move) is sent to the OpenStreetMap Nominatim geocoding service. If a location search on this website matches none of our restaurants by name, town or ZIP code, the search text is sent to the same service to find the place you meant. Maps on this website load map tiles from OpenStreetMap, and the locations map may instead use Google Maps. These services receive your IP address and the request, as with any website you visit.
• Analytics and advertising (website, only if enabled): this website does not currently use analytics or advertising tools. If we enable Google Analytics, Google Tag Manager or the Meta Pixel, they will load only after you agree in our cookie banner, and only for the categories you allow. They would receive pages viewed and events such as “added to cart” or “order placed” with order totals and item, order and location identifiers — never your name, email, phone number or address.

None of these providers are authorized to use your data for their own marketing.

4. Data Retention

We retain account information while your account is active and for only as long as reasonably necessary to provide the service, resolve disputes, prevent fraud, and meet legal, tax, and accounting obligations. When you delete your account:

• Profile information (name, email, phone, addresses) is removed from the active customer account when deletion succeeds.
• Saved payment methods are deleted from our payment processor, where supported, as part of the deletion process. If processor cleanup cannot be confirmed, our operations team receives an alert for manual reconciliation.
• Transaction and order records, including delivery address and selected delivery-pin coordinates where applicable, may be retained after the customer account is removed when needed for fulfillment, tax, accounting, chargeback, fraud prevention, or other legal obligations. Retained records are detached from the active account where the data model permits.
• Support conversations and operational logs are retained as needed to resolve requests, protect the service, and document restaurant operations.
• Crash and error reports are kept for 30 days and then deleted; counts per app or website version, without personal data, are kept for up to 13 months.
• Information stored in your browser by this website stays on your device until it expires as described in the Cookies Policy or you clear this site’s data.

To request earlier deletion of specific data categories, contact onlineorder@santafeburritogrill.com.

5. Your Rights

You have the right to access, correct, or delete your personal data at any time. California residents have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected and the right to opt out of the sale of personal information.

California residents also have the right to request deletion of their personal information. To exercise this right, you may either:

• Delete your account directly through the app: navigate to Profile > Delete Account.
• Email us at onlineorder@santafeburritogrill.com with the subject “California Privacy — Deletion Request.”

We will respond to your request within 45 days as required by California law. Note that some information may be retained as required by law (e.g., financial records for tax compliance, see Section 4 above).

On this website you can also clear the information stored in your browser at any time, and, if analytics or advertising tools are ever enabled, change your choice with the “Cookie preferences” link (see Section 6).

6. Cookies & Tracking

We do not use advertising networks or sell information for cross-site advertising. This website uses cookies and browser storage to keep you signed in, remember your selected location, language and cart, complete payments securely and keep the site reliable. The Cookies Policy lists each one.

This website does not currently use analytics or advertising cookies. If we enable them in the future (for example Google Analytics, Google Tag Manager or the Meta Pixel), they will be off until you allow them in our cookie banner, where required by law, and you will be able to change that choice at any time through “Cookie preferences.” Crash diagnostics, when configured, run without advertising tracking. The app does not request App Tracking Transparency permission because it does not track users across other companies’ apps or websites.

7. Location Information

• App: as described in Section 3, the app uses your device location only while in use, to show nearby restaurants and to support the delivery pin on Android.
• Website: your browser asks for your location only when you choose “Use my location” in the location picker or on the Locations page. The position is used in your browser to sort our restaurants by distance; it is not sent to our servers or stored.
• Delivery orders: the delivery address and the pin you confirm are stored with your order and shared with Uber Direct to complete the delivery.

8. Text Messages

We do not send marketing text messages (SMS). We use your phone number to identify your order (for example, to look up a guest order) and, for delivery orders, share the delivery recipient’s number with Uber Direct as described in Section 3.

9. Children’s Privacy

Santa Fe Burrito Grill’s services are intended for users 13 years of age and older. We do not knowingly collect, store, or process personal information from children under 13. If you are a parent or guardian and believe your child under 13 has provided us with personal information, please contact us at onlineorder@santafeburritogrill.com. We will promptly delete such information from our records. If we learn that an account belongs to a child under 13, we will take steps to remove the child’s personal data.

10. Contact Us

If you have questions or concerns about this Privacy Policy, please contact us:
Email: info@santafeburritogrill.com
Phone: (781) 629-3282

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes via the app and this page. Your continued use of the app or website after the effective date of the updated policy constitutes your acceptance of the changes.