This Privacy Policy ("Policy") describes how Hakapoké ("we", "us", "our") collects, uses, shares and protects information when you use our mobile application, website and services (collectively, the "Service"). We comply with applicable data protection laws including the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and the Mexican Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP).

1. Data Controller

The data controller is Hakapoké. For privacy-related requests, contact our Data Protection Officer at privacy@hakapoke.com.

2. Information We Collect

• Account data: name, email, phone, profile photo — via our identity provider Clerk, Inc.
• Order data: items ordered, delivery address, scheduled time, special instructions.
• Payment data: processed by our payment provider; we never store full card numbers.
• Device & usage data: device model, OS, language, IP address, app interactions and crash logs.
• Location data: only with your permission, to find nearby branches and improve delivery accuracy.
• Marketing preferences: if you opt in to receive promotional communications.

3. Legal Bases (GDPR)

• Performance of a contract — to fulfill your orders.
• Legitimate interests — to operate, secure and improve the Service.
• Consent — for marketing, location and non-essential cookies.
• Legal obligation — to comply with tax, accounting and law-enforcement requirements.

4. How We Use Your Data

• process orders, payments and deliveries;
• manage your account, loyalty points and rewards;
• provide customer support;
• send transactional notifications (order status, receipts);
• improve product quality, prevent fraud and abuse;
• send marketing communications when you opt in.

5. Sharing of Data

We share data only with vetted service providers that act on our instructions, including:

• Clerk, Inc. — authentication and account management.
• Payment processors — secure payment handling.
• Hosting & analytics — Vercel, Vercel Analytics.
• Delivery partners — only the data required to deliver your order.

We do not sell your personal information.

6. International Transfers

Some of our processors are located outside your country. When data is transferred, we use Standard Contractual Clauses or equivalent safeguards to ensure an adequate level of protection.

7. Data Retention

We retain account data for as long as your account is active. Order and tax records are kept for the period required by applicable law (typically 5 years). When you delete your account, we erase or anonymize your data within 30 days, except where retention is legally required.

8. Your Rights

Depending on your jurisdiction, you have the right to:

• access, rectify or delete your personal data;
• object to or restrict processing;
• port your data to another service;
• withdraw consent at any time;
• lodge a complaint with your local supervisory authority.

For ARCO rights (Acceso, Rectificación, Cancelación, Oposición) under Mexican law, or any of the rights above, contact privacy@hakapoke.com. You can delete your account directly at Profile → Delete Account.

9. Security

We use HTTPS, encryption at rest, role-based access controls and regular audits. No method of transmission is 100% secure; we cannot guarantee absolute security.

10. Children

The Service is not directed to children under 13 (or the minimum age of digital consent in your jurisdiction). We do not knowingly collect their data; if you believe we have, contact us and we will delete it.

11. Cookies & Tracking

See our Cookie Policy for details on the cookies and similar technologies we use and how to control them.

12. Changes to this Policy

We may update this Policy from time to time. Material changes will be communicated through the Service or by email.

13. Contact

Hakapoké — privacy@hakapoke.com. If you are in the EU, you also have the right to contact your local Data Protection Authority.