Privacy Policy

1. Introduction and audiences

Gastriva is a management platform for food and beverage businesses: operations, menu, orders, inventory, staff, payments, loyalty, deliveries, and analytics. By accessing or using the Platform, you agree to the practices in this Policy. If you do not agree, do not use the Platform.

This Policy applies to: (a) business customers that contract Gastriva services ("Clients"); (b) users authorized by those Clients, such as employees, managers, and admins ("Users"); and (c) end consumers who use restaurant sites and apps powered by Gastriva ("Consumers"), for example for orders, accounts, payments, notifications, and delivery.

2. Role of the restaurant and Gastriva

Operational data the Client enters on the Platform (menus, inventory, sales, staff records, and their own customer data) belongs to the Client. Gastriva acts as a technology provider and processes that information to deliver the contracted services.

If the Client enters third-party personal information (employees or consumers), the Client is responsible for having a lawful basis and necessary authorizations. The restaurant controls the commercial relationship with the consumer; Gastriva processes data on the Client’s behalf to operate accounts, orders, payments, notifications, delivery maps, and related features.

Gastriva may use data in aggregated and anonymized form that does not identify any Client, User, or individual, for product and industry analysis.

3. Information we collect

Depending on Platform use, we may collect:

• Account and registration: name, email, phone, business name, establishment address, role, and credentials (Gastriva ID).
• Billing and payment: payments via providers such as Stripe. We do not store full card numbers; we may receive last four digits, payment status, and billing history.
• Consumer orders and history: items, amounts, notes, fulfillment type (pickup/delivery), coupons, and rewards.
• Address and location: delivery address and, when the user allows, coordinates or geolocation to set a drop-off pin (e.g. Mapbox). In the Commerce app, driver GPS during active delivery runs.
• Notifications: device tokens (FCM / APNs) for order and operations alerts.
• Business operational data: menus, prices, inventory, schedules, shifts, and metrics.
• Technical information: IP, device, OS, browser, device identifiers, pages/features used, timestamps, and activity logs.
• Support: emails, messages, and assistance requests.
• Photos/camera: when required by the User or payment flows (e.g. menu uploads or card verification).

Gastriva does not intentionally collect sensitive categories such as health information, racial or ethnic origin, or religious beliefs.

4. How we use information

• Provide, operate, maintain, and improve the Platform.
• Create and manage Client, User, and Consumer accounts.
• Process orders, payments, invoices, and subscriptions.
• Enable pickup, delivery, maps, and delivery tracking when enabled.
• Send push notifications and service communications (billing, security, order status).
• Provide technical support.
• Send marketing only with consent or as permitted, with opt-out.
• Generate aggregated or anonymized statistics.
• Detect fraud, unauthorized access, and abuse.
• Comply with legal, accounting, and regulatory obligations.

5. Who we share information with

Gastriva does not sell personal information. We share information only in these cases:

Service providers: Stripe (payments), AWS or other cloud providers, Firebase/Google (push messaging), Apple and Google (app distribution), Mapbox (maps and geocoding when applicable), email and support tools. They must protect the information and use it only for contracted purposes.

Legal requirements: when required by law, court order, or authority, or to protect rights, property, or safety.

Corporate transactions: merger, acquisition, or asset sale, with continued protection or notice of material changes.

With consent: when the user expressly authorizes.

6. Cookies and similar technologies

We use cookies and similar technologies for sessions, preferences, usage measurement, and experience improvements. Essential cookies are required for operation. Analytics cookies may be managed in the browser; disabling them may affect the Platform.

We do not use third-party advertising cookies to sell or track profiles for third-party ads.

7. Security

We implement reasonable technical, administrative, and physical measures: encryption in transit (TLS), role-based access controls, authentication, and infrastructure monitoring.

No system is completely secure. In the event of a breach affecting personal information, we will notify affected parties and authorities as required by applicable law, including Puerto Rico Act No. 111-2005, as amended.

8. Data retention

We retain information as needed for the purposes in this Policy, service delivery, legal/tax obligations, disputes, and agreement enforcement.

After the service relationship ends, the Client or Consumer may request a data export within 30 days of termination. After that period, Gastriva may delete or anonymize the data, except where longer retention is legally required.

9. Account and data deletion

You may request deletion of your Gastriva account or certain personal data via our public forms. After identity verification, we process the request within a reasonable time.

After cancellation, we retain personal data for up to 30 days to allow an export if requested; then we delete or anonymize it, unless legally required to retain it longer.

10. Your rights

Subject to applicable law, you may:

• Access your personal information.
• Request correction of inaccurate data.
• Request deletion, subject to legal or contractual exceptions.
• Request a copy in a structured, commonly used format.
• Opt out of marketing at any time.

To exercise these rights, contact privacidad@gastriva.com. We may require identity verification.

11. Children

The Platform is intended for businesses and individuals 18 years or older. We do not knowingly collect information from minors. If we learn we have collected such information, we will delete it promptly.

12. Storage and transfers

Gastriva operates from Puerto Rico and uses cloud infrastructure with servers in the United States. By using the Platform, you acknowledge that your information may be stored and processed in the United States and its territories under applicable laws.

13. Third-party links and services

The Platform may link to or integrate with third parties. This Policy does not cover their practices. Review their policies before providing personal information.

14. Changes to this Policy

We may update this Policy periodically. Material changes will be notified on the Platform or by email with reasonable advance notice. The last-updated date appears at the top. Continued use after the effective date constitutes acceptance of the revised Policy.

15. Contact