Privacy Policy

This Privacy Policy describes how Costa Vida ("we," "us," or "our") collects, uses, discloses, and protects the personal information of individuals ("you" or "user") who visit our website at vidacostas.rest, place orders, interact with our digital services, or otherwise engage with our food business. We are committed to protecting your privacy and handling your personal data with transparency, integrity, and respect.

Please read this Privacy Policy carefully. By accessing or using our website and services, you acknowledge that you have read, understood, and agree to the practices described in this document. If you do not agree with any part of this Privacy Policy, please discontinue use of our services immediately.

This Privacy Policy applies to all users located in the United States. Our practices are governed by applicable U.S. federal and state privacy laws, including but not limited to the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), the Federal Trade Commission (FTC) Act regarding unfair or deceptive practices, and other relevant state consumer protection statutes.

1. About Us

Costa Vida is a food-oriented business operating through the website vidacostas.rest. We offer food-related products and services to customers across the United States. For any questions, concerns, or requests related to this Privacy Policy or your personal information, you may contact us using the details below:

2. Information We Collect

We collect various categories of information from and about our users, both directly and automatically, in order to provide and improve our services, fulfill orders, and maintain a secure and functional platform. The types of information we collect include the following:

2.1 Personal Identification Information

When you create an account, place an order, sign up for our newsletter, contact us, or otherwise interact with our services, we may collect personally identifiable information, including but not limited to:

• Full name
• Email address
• Phone number
• Mailing address and delivery address
• Date of birth (when required to verify age eligibility)
• Payment and billing information (credit or debit card numbers, billing addresses) — processed securely through third-party payment processors
• Username and password for registered accounts
• Dietary preferences and food-related preferences you voluntarily provide
• Profile photos or avatars if uploaded

2.2 Usage Data and Behavioral Information

We automatically collect certain information when you visit and interact with our website, including:

• Pages visited, links clicked, and content viewed
• Search queries submitted on our website
• Time and duration of your visits
• Items added to cart, wishlisted, or purchased
• Order history and frequency of purchases
• Interaction with promotional materials, banners, or email campaigns
• Referral sources (how you arrived at our website)

2.3 Device and Technical Information

When you access our website, our servers and analytics tools automatically log certain technical data, including:

• IP address and approximate geographic location
• Browser type and version
• Operating system and platform
• Device type (desktop, tablet, mobile phone)
• Screen resolution
• Unique device identifiers
• Network provider information
• Time zone settings

2.4 Cookie and Tracking Data

We use cookies, web beacons, pixel tags, local storage, and similar tracking technologies to collect data about your browsing behavior on our website. This includes session identifiers, preference settings, and analytics data. For more detailed information, please refer to Section 8 of this Privacy Policy, which covers our cookie practices.

2.5 Communications Data

If you contact us by email, through a contact form, via live chat, or by telephone, we may retain records of that communication, including your name, contact details, the content of your message, and any attachments or information you provide to us. We use this data to respond to your inquiries and improve our customer service quality.

2.6 Information from Third Parties

We may receive information about you from third-party sources, including:

• Social media platforms (if you log in using a social media account or interact with our social media pages)
• Delivery and logistics partners who process your food orders
• Marketing and advertising partners who help us reach potential customers
• Analytics providers who aggregate data about website traffic and user behavior
• Review and rating platforms where users publicly post feedback about our services

3. How We Use Your Information

We use the personal information we collect for the following purposes, always in accordance with applicable law and, where required, with your consent:

3.1 Service Provision and Order Fulfillment

• To process and fulfill your food orders, including coordinating delivery or pickup arrangements
• To manage your account and provide access to account-specific features
• To communicate with you about your orders, including confirmations, updates, and delivery notifications
• To process payments and prevent fraudulent transactions
• To provide customer support and respond to your inquiries or complaints

3.2 Marketing and Promotional Communications

• To send you promotional emails, newsletters, and special offers about our menu items and services, where you have given your consent or where permitted by law
• To personalize your experience on our website by displaying relevant menu recommendations and promotions based on your preferences and order history
• To run loyalty programs and rewards initiatives for repeat customers
• To conduct contests, sweepstakes, or promotional campaigns

3.3 Analytics and Service Improvement

• To analyze usage trends, website performance, and user behavior to improve our website's design, content, and functionality
• To understand customer preferences and develop new menu offerings or service features
• To measure the effectiveness of our advertising and marketing campaigns
• To conduct internal research and surveys to enhance the quality of our food and services

3.4 Legal and Compliance Purposes

• To comply with applicable laws, regulations, and legal obligations under U.S. federal and state law
• To enforce our Terms of Service and other applicable agreements
• To detect, prevent, and address fraudulent activity, security incidents, and other prohibited conduct
• To protect the rights, property, and safety of Costa Vida, our customers, and the general public

4. Sharing Your Information with Third Parties

We do not sell your personal information to third parties for monetary compensation. However, we may share your information in the following circumstances:

4.1 Service Providers and Business Partners

We engage trusted third-party service providers who assist us in operating our business and delivering our services. These providers are contractually obligated to protect your information and may only use it for the specific purposes for which it was shared. Categories of service providers include:

• Payment Processors: To securely process credit, debit, and digital wallet transactions
• Delivery and Logistics Providers: To fulfill food delivery orders to your specified address
• Email and Communication Platforms: To send order confirmations, marketing emails, and customer service correspondence
• Cloud Hosting and Data Storage Providers: To host our website and store operational data
• Analytics Providers: Such as Google Analytics, to help us understand website traffic and user behavior
• Advertising Networks: To serve targeted advertisements based on your interests and browsing behavior
• Customer Support Tools: To manage support tickets and communication history

4.2 Legal Requirements and Law Enforcement

We may disclose your personal information if we are required to do so by law, court order, subpoena, or other governmental authority. We may also disclose information when we believe in good faith that disclosure is necessary to:

• Comply with applicable law or legal process
• Protect the rights and safety of Costa Vida, our users, or the public
• Investigate, prevent, or take action regarding illegal activities, fraud, or security threats
• Cooperate with regulatory investigations by the Federal Trade Commission (FTC) or other relevant authorities

4.3 Business Transfers

In the event of a merger, acquisition, reorganization, sale of assets, or bankruptcy, your personal information may be transferred as part of the business transaction. We will notify you via email or a prominent notice on our website if such a transfer occurs, and we will inform you of any changes to this Privacy Policy that may result.

4.4 Aggregated and Anonymized Data

We may share aggregated or anonymized information — data that cannot reasonably identify you as an individual — with third parties for research, marketing, analytics, and business purposes. This type of data sharing does not constitute a disclosure of personal information.

5. Data Security

We take the security of your personal information seriously and implement a variety of technical, administrative, and physical safeguards designed to protect your data against unauthorized access, disclosure, alteration, and destruction. Our security measures include:

• Encryption: We use Secure Socket Layer (SSL) / Transport Layer Security (TLS) encryption to protect data transmitted between your browser and our servers.
• Access Controls: Access to personal data is restricted to employees, contractors, and service providers who have a legitimate business need to access it. All such parties are bound by confidentiality obligations.
• Secure Payment Processing: Payment card information is processed by PCI-DSS compliant payment processors. We do not store full credit card numbers on our servers.
• Regular Security Audits: We conduct periodic reviews and assessments of our information security practices and systems.
• Incident Response: We maintain procedures to identify, contain, and respond to data security incidents in a timely manner, including notifying affected users as required by applicable law.

6. Your Rights and Choices

Depending on your state of residence within the United States, you may have specific legal rights regarding your personal information. We are committed to honoring these rights in accordance with applicable law.

6.1 Rights Under the California Consumer Privacy Act (CCPA/CPRA)

If you are a resident of California, you have the following rights under the CCPA as amended by the CPRA:

• Right to Know: You have the right to request information about the categories and specific pieces of personal information we have collected about you, the sources from which it was collected, the purposes for which it was used, and the categories of third parties with whom it was shared.
• Right to Delete: You have the right to request deletion of personal information we have collected from you, subject to certain exceptions permitted by law.
• Right to Correct: You have the right to request correction of inaccurate personal information we maintain about you.
• Right to Opt-Out of Sale or Sharing: You have the right to opt out of the sale or sharing of your personal information for cross-context behavioral advertising purposes.
• Right to Limit Use of Sensitive Personal Information: You have the right to limit our use of sensitive personal information to purposes strictly necessary to provide the requested service.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights. We will not deny you services, charge different prices, or provide a different level of quality as a result of your exercising these rights.

6.2 General User Rights (All U.S. Residents)

• Right to Access: You may request access to the personal information we hold about you by contacting us at [email protected].
• Right to Correction: If any information we hold about you is inaccurate or incomplete, you may request that we correct it.
• Right to Deletion: You may request that we delete your personal information, subject to our legal obligations to retain certain records.
• Right to Data Portability: Where technically feasible, you may request a copy of your personal information in a structured, commonly used, machine-readable format.
• Right to Withdraw Consent: Where we process your personal information on the basis of your consent, you may withdraw that consent at any time without affecting the lawfulness of processing conducted prior to withdrawal.
• Right to Opt-Out of Marketing: You may opt out of receiving promotional communications from us at any time.

6.3 How to Exercise Your Rights

To exercise any of your rights, please submit a request to us using one of the following methods:

• Email: [email protected]
• Website: vidacostas.rest

We will respond to your request within 45 days. In the case of complex or numerous requests, we may extend this period by an additional 45 days, in which case we will notify you of the extension and the reason for it. We may need to verify your identity before processing your request to ensure that your personal information is not disclosed to unauthorized parties.

You may also designate an authorized agent to make a rights request on your behalf. In such cases, we may require written authorization or a power of attorney and may verify the identity of both the authorized agent and the individual whose rights are being exercised.

7. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes for which it was collected, comply with our legal obligations, resolve disputes, and enforce our agreements. The specific retention periods depend on the type of data and the purpose for which it is processed:

When personal information is no longer needed for the purpose for which it was collected and no legal obligation requires its continued retention, we will securely delete or anonymize it.

8. Cookie Policy

Our website uses cookies and similar tracking technologies to enhance your browsing experience, understand how users interact with our platform, and provide relevant advertising. This section provides a summary of our cookie practices.

8.1 What Are Cookies?

Cookies are small text files that are stored on your device (computer, tablet, or mobile phone) when you visit a website. They enable the website to recognize your device and remember certain information about your preferences or past actions.

8.2 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the operation of our website, including enabling you to log in, add items to your cart, and complete a purchase. These cookies cannot be disabled.
• Performance and Analytics Cookies: These cookies collect anonymous information about how visitors use our website, such as which pages are most visited and whether users encounter error messages. We use tools like Google Analytics for this purpose.
• Functionality Cookies: These cookies allow our website to remember choices you make (such as your preferred language or food preferences) and provide enhanced, personalized features.
• Targeting and Advertising Cookies: These cookies track your browsing activity to deliver advertisements that are relevant to your interests. They may be set by our advertising partners.

8.3 Managing Cookies

You can control and manage cookies through your browser settings. Most browsers allow you to refuse or delete cookies. However, please be aware that disabling certain cookies may affect the functionality of our website and your ability to access certain services. You may also opt out of interest-based advertising by visiting the Network Advertising Initiative (NAI) opt-out page at networkadvertising.org/choices.

9. Children's Privacy

Our website and services are intended for use by individuals who are 18 years of age or older. We do not knowingly collect, solicit, or process personal information from children under the age of 13, as protected under the Children's Online Privacy Protection Act (COPPA). We also strongly encourage parental supervision for individuals between the ages of 13 and 17.

If you are a parent or legal guardian and you believe that your child under the age of 13 has provided us with personal information without your consent, please contact us immediately at [email protected]. Upon verification, we will take prompt steps to delete such information from our records.

By using our website, you represent and warrant that you are at least 18 years of age. If you are between the ages of 13 and 17, you may only use our website under the supervision and with the express consent of a parent or legal guardian.

10. International Data Transfers

Costa Vida is based in the United States and primarily serves customers located within the United States. However, some of our third-party service providers may be located in or operate from other countries. As a result, your personal information may be transferred to and processed in countries outside of the United States.

When we transfer personal information internationally, we take appropriate steps to ensure that your information receives an adequate level of protection, including:

• Selecting service providers that maintain robust data protection standards
• Implementing contractual safeguards, such as Standard Contractual Clauses (SCCs), where applicable
• Confirming that any international data recipients comply with privacy standards equivalent to those applicable in the United States

By using our services, you acknowledge and consent to the transfer of your personal information to countries outside of your country of residence, which may have different data protection rules than those in your jurisdiction.

11. Third-Party Links and Services

Our website may contain links to third-party websites, social media platforms, delivery applications, and other external services that are not owned or controlled by Costa Vida. This Privacy Policy applies solely to information collected by our website and services. We are not responsible for the privacy practices of third-party websites or services.

We encourage you to review the privacy policies of any third-party sites you visit through links on our website. Clicking on a third-party link does not imply our endorsement of that website or its privacy practices.

12. Your Choices Regarding Marketing Communications

We offer several ways for you to control how your personal information is used for marketing purposes:

• Email Opt-Out: Click the "Unsubscribe" link at the bottom of any marketing email we send you. Please allow up to 10 business days for your request to take effect.
• Account Preferences: Log in to your account on vidacostas.rest and adjust your communication preferences in your account settings.
• Direct Contact: Email us at [email protected] with the subject line "Marketing Opt-Out" to request removal from our marketing lists.

Please note that even if you opt out of marketing communications, we may still send you transactional or administrative emails related to your account or orders, as these are necessary for the provision of our services.

13. Do Not Track Signals

Some browsers offer a "Do Not Track" (DNT) feature that signals to websites that a user does not want their online activity tracked. Currently, there is no universally accepted standard for how websites should respond to DNT signals. As a result, our website does not currently alter its data collection or use practices in response to DNT signals from your browser. However, we will continue to monitor developments in this area and update our practices if a standardized approach emerges.

14. How to File a Complaint with a Data Protection Authority

If you believe that our processing of your personal information violates applicable privacy law, you have the right to file a complaint with the relevant data protection or consumer protection authority.

14.1 Federal Trade Commission (FTC)

In the United States, the Federal Trade Commission (FTC) is the primary federal agency responsible for enforcing consumer privacy rights and data protection standards under the FTC Act. If you have concerns about our privacy practices that you believe constitute unfair or deceptive acts or practices, you may file a complaint with the FTC:

• Website: ftc.gov/complaint
• Phone: 1-877-382-4357 (1-877-FTC-HELP)
• Address: Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580

14.2 California Attorney General (California Residents)

California residents who believe their rights under the CCPA/CPRA have been violated may file a complaint with the California Privacy Protection Agency (CPPA) or the California Attorney General's Office:

• California Privacy Protection Agency: cppa.ca.gov
• California Attorney General: oag.ca.gov/privacy/ccpa

14.3 State Attorneys General (Other States)

Residents of other U.S. states with applicable state privacy laws (such as Virginia, Colorado, Connecticut, Texas, or other states with enacted comprehensive privacy legislation) may contact their respective state Attorney General's office to report privacy concerns or violations.

15. Changes to This Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time to reflect changes in our practices, legal requirements, or the services we offer. When we make material changes, we will:

• Post the updated Privacy Policy on our website at vidacostas.rest with a revised "Last Updated" date
• Send you an email notification if the changes are significant and you have provided us with your email address
• Display a prominent notice on our website homepage for a reasonable period following the update

Your continued use of our website and services after the effective date of the revised Privacy Policy constitutes your acceptance of the updated terms. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

16. Contact Us

If you have any questions, comments, concerns, or requests regarding this Privacy Policy or our data handling practices, please do not hesitate to contact our privacy team. We are committed to addressing your inquiries in a timely and professional manner.

We aim to respond to all privacy-related inquiries within 45 business days of receipt. For complex requests or those involving large volumes of data, we may require additional time but will keep you informed throughout the process.

This Privacy Policy was last updated on March 29, 2026, and is effective as of that date. All previous versions of this Privacy Policy are superseded by this document.