Privacy Notice

1. Responsible Party and Scope

The operator of Dozo is responsible for personal data collected directly through the Dozo websites, applications, administrative dashboards, support channels, and commercial relationship. Questions may be sent to [email protected]. When a restaurant uploads or collects information about its customers, employees, or suppliers through Dozo, that restaurant remains responsible for its own notices, legal basis, instructions, and use of that information.

2. Personal Data We Collect

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

• Identity Data: includes first name, last name, username or similar identifier.
• Contact Data: includes billing address, email address and telephone numbers.
• Commercial and Transaction Data: includes subscription, invoice, tax, payment-status, purchased-service, support, and account-administration details. Complete card data is generally handled by the payment provider rather than stored by Dozo.
• Technical and Usage Data: includes IP address, login events, device and terminal identifiers, browser, operating system, application version, diagnostic logs, feature usage, approximate location inferred from IP, and security events.
• Restaurant Operations Data: includes menus, branches, orders, receipts, staff assignments, device configurations, and similar business records entered into the Service.
• Customer-provided Personal Data: may include information about the customer's diners, employees, drivers, suppliers, or other persons when the customer chooses to enter that information into the Service.

3. Purposes and Legal Bases

We process personal data only as reasonably necessary for the following primary purposes and other purposes permitted by law:

• Provide, authenticate, operate, support, secure, troubleshoot, and improve the Service; manage subscriptions, billing, devices, and customer requests; and communicate service notices.
• Perform our contract, follow documented customer instructions, protect legitimate business and security interests, prevent fraud and abuse, establish or defend legal claims, and comply with legal, tax, accounting, and regulatory obligations.
• Send optional product news or offers where permitted. Recipients may opt out of marketing communications without affecting operational or legally required messages.

4. Cookies, Logs, and Similar Technologies

We use session cookies, local storage, device identifiers, and logs needed for authentication, security, preferences, diagnostics, and core functionality. Where legally required, optional analytics or marketing technologies will be subject to the choices presented to the user.

5. Customer-controlled Data and Instructions

Business customers determine what restaurant operational and third-party personal data they enter into Dozo and are responsible for having authority to collect and instruct us to process it. Dozo processes that data to provide the Service, protect it, comply with law, and follow valid documented instructions. Customers must not upload sensitive personal data unless necessary, lawful, and specifically supported by the Service.

6. Service Providers and Transfers

We may disclose data to hosting, infrastructure, communications, analytics, support, professional-adviser, security, and payment providers that need it to perform services for Dozo; to a successor in a merger, financing, reorganization, or sale; or to authorities and other persons when legally required or reasonably necessary to protect rights, safety, and the Service. We do not sell personal data. These providers process data under their own terms of service, including their confidentiality and security obligations.

7. Retention, Export, and Deletion

We retain data while an account is active and afterward only as reasonably necessary for service continuity, backups, dispute resolution, fraud prevention, security, and legal, tax, accounting, or contractual obligations. When an account is cancelled it is deactivated; to have its data deleted, the account owner can request it by emailing [email protected]. Deletion from active systems may not immediately remove encrypted backups, which are isolated and expire according to backup cycles. Data may be anonymized instead of deleted where lawful.

8. Security and Incidents

We use reasonable administrative, technical, and organizational safeguards appropriate to the nature of the data. No internet transmission, device, or storage system is completely secure, and Dozo cannot guarantee absolute security. Customers are responsible for protecting credentials, limiting staff access, maintaining supported devices and networks, and notifying Dozo promptly of suspected unauthorized access. We will address qualifying incidents and provide notices as required by applicable law.

9. ARCO Rights and Privacy Choices

A person may request access, rectification, cancellation, or opposition regarding personal data for which Dozo is responsible, revoke consent where applicable, or limit use or disclosure by emailing [email protected]. The request should identify the person, describe the requested right and affected data, provide a contact method, and include documentation reasonably necessary to verify identity or authority. We will respond within applicable legal periods. Some requests may be limited where retention or processing is required by law, contract, security, or the rights of others. For restaurant-controlled data, requests should first be directed to the relevant restaurant.

10. International Processing

Data may be processed in Mexico or other countries where Dozo or its providers operate. Where required, we use contractual or other appropriate safeguards and require recipients to respect this Notice and applicable data-protection obligations.

11. Minors and Sensitive Data

The Service is intended for businesses and authorized adult users, not for independent use by minors. Dozo does not intentionally request sensitive personal data for ordinary account creation. Customers are responsible for obtaining any consent and implementing any safeguards required before entering minors' or sensitive data into the Service.

12. Changes and Contact

We may update this Notice to reflect legal, operational, or service changes. Material changes will be communicated through the Service, the account email, or another legally permitted method before they take effect when required. The current version will remain available on this page. Privacy questions and rights requests may be sent to [email protected].