Privacy Policy for Cilantro Taqueria Mobile App

Last Updated: 8/20/2026

This Privacy Policy describes how personal information is collected, used, and disclosed when you download and use the Cilantro Taqueria Mobile App (the “App”), and the choices and rights you have to protect your personal information collected via the App.

Cilantro Taqueria (“Merchant”) is responsible for the personal information collected when you use the App. The App uses technology provided by Toast, Inc. (“Toast”). To learn more about Toast’s privacy practices, please visit Toast’s Privacy Statement at https://pos.toasttab.com/privacy.

Personal Information Collected Via the App

The App collects the following categories of personal information.

Contact information. You may submit your name, email, phone number, and address to the App.

Definitions

* “Merchant” means La Ruta del Cilantro Taqueria Franchising, LLC and participating company-owned and franchised Cilantro Taqueria restaurants.

* “App” means the Cilantro Taqueria Mobile App.

* “Toast” means Toast, Inc., the technology provider supporting the App.

* “Personal Information” has the meaning given under applicable privacy laws.

• Franchise Locations. The App is used by both company-owned and franchised Cilantro Taqueria locations. La Ruta del Cilantro Taqueria Franchising, LLC owns and administers the customer database used by the App. Information you provide through the App, including your account information, order history, loyalty account, and rewards status, may be shared with company-owned and franchised Cilantro Taqueria locations to fulfill your orders, administer the loyalty program, provide customer support, improve our services, and maintain a consistent customer experience across all participating locations.

• Orders and order history. The App collects and retains the orders you place via the App, including the items you order, date and time of the order, order amounts, delivery locations, tips, order frequency, favorite restaurant locations or menu items, and any preferences or selections you submit with your order.

• Security. Merchant uses commercially reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, or destruction. However, no method of transmitting or storing electronic information is completely secure, and Merchant cannot guarantee absolute security.

• Payment information. You may input your payment card information, including your card number, security code, and expiration date, or provide other payment information (such as Apple Pay or Google Pay).

• Children’s Privacy. The App is not directed to or intended for children under the age of 13, and Merchant does not knowingly collect personal information from children under 13. If Merchant becomes aware that personal information has been collected from a child under 13 without appropriate parental consent, Merchant will take reasonable steps to delete such information.

• Precise location. If you choose to enable it, the App will collect your precise location information to provide you with certain location-enabled features, such as to display and alert you to restaurants nearby and provide live map views. You can disable precise location at any time through your device settings.

• Rewards Program and Gift Cards. If you participate in Toast Loyalty through the App, we collect information about your rewards account, including your points balance, reward redemptions, and purchase activity, which is necessary to administer the loyalty program. Loyalty rewards may be earned through qualifying purchases made both in the App and in participating restaurant locations. Because all participating Cilantro Taqueria locations share one loyalty program, your loyalty information may be available across company-owned and franchised locations.

The App also collects information regarding gift cards you purchase, receive, send, transfer, reload, or redeem, including balances and transaction history.

• Device and usage information.

• The App automatically logs information about you, your mobile device, and your interaction over time with the App. This includes: device information, such as your device type, browser type, IP address, device identifiers, language settings, carrier, and general location information; and usage information, such as screens you viewed, how long you spent on a page, browsing history, and access times, and page clicks, page scrolls, and page element interactions.

• Push notification interactions. If you have enabled push notifications from the App, the App also collects information about your interactions with those notifications, including whether a notification was delivered to your device and whether you tapped on it.

• The App automatically generates diagnostic reports when errors or crashes occur. These reports may include technical information such as device type, operating system version, App version, timestamps, device identifiers, and information about the error to help Merchant and its service providers diagnose problems, improve stability, and enhance performance. Crash reports are not intended to include the content of your orders or payment information.

How Your Personal Information is Used

Merchant may use your personal information for the following purposes:

• To provide the App and any features you use. This includes authenticating your access to the App; administering your account; allowing you to place orders and remember your preferences; processing transactions; and providing any features that you use within the App, such as location-enabled features and access to loyalty program benefits.

• To personalize your experience in the App and provide recommendations. This includes personalizing the items you see displayed in the App and recommending restaurant locations and menu items that may interest you based on your past orders and preferences. The App may also send you notifications of locations or items that may interest you. You can control notifications in your device or App settings. Recommendations may be based on previous purchases, loyalty activity, restaurant locations visited, ordering frequency, menu preferences, and similar customer behavior.

• Troubleshooting and App improvement. Your information may be used to analyze the performance of the App, identify and correct errors, and develop and improve App features and functionality. Your information may also be aggregated with other users’ information, or otherwise anonymized, to create statistics or for other lawful business purposes, including analytics, forecasting, and strategic planning.

• Artificial Intelligence and Automated Processing. Merchant may use artificial intelligence and automated systems to personalize menu recommendations, improve customer service, forecast customer demand, analyze ordering trends, recommend restaurant locations or menu items, improve operational efficiency, and enhance the overall customer experience. These tools assist Merchant personnel and do not make decisions that produce legal or similarly significant effects on users.

Merchant may also use personal information collected through the App for the following purposes:

• To analyze users’ selections and preferences in order to improve Merchant’s offerings, identify opportunities for growth, and conduct market research;

• Merchant may send marketing communications through email and push notifications regarding promotions, catering services, new menu items, restaurant openings, special events, and other offers that may be of interest. Users may opt out of marketing emails using the unsubscribe link contained in those emails. Users may disable push notifications through their device settings or within the App where available.

• To measure the effectiveness of push notifications and other marketing communications. If you have enabled push notifications, Merchant may analyze whether and when you interact with a push notification (such as by tapping on it) and whether you subsequently placed an order within a defined time period following that interaction. This analysis is used to provide Merchant with aggregate and individual-level reporting on the performance of its marketing communications and to help Merchant understand which communications resonate with its customers; and

• For compliance and protection, including to enforce any Applicable terms and conditions, comply with legal obligations, defend against legal claims or disputes, protect the security and integrity of the App, and identify and investigate fraudulent, harmful, unauthorized, unethical or illegal activity.

These uses outside the App are just examples and may not reflect all the ways Merchant uses personal information outside the App. To learn more, please contact Merchant directly.

How Your Information Is Shared

Personal information collected via the App may be shared as follows:

• Sharing with Toast. Any information you provide via the App, or that Merchant inputs to the App, may be hosted and stored by Toast on Merchant’s behalf.

• Service providers. The App relies on other service providers that are needed to administer and support the App and its features, including hosting services, communications, data and cyber security services, payment processing services, identity verification, fraud detection, investigation and prevention services, and customer relationship management systems. Service providers may include payment processors, cloud hosting providers, analytics providers (including Google Analytics and Firebase), customer relationship management providers, fraud prevention services, communications providers, crash reporting services (including Firebase Crashlytics), identity verification providers, and delivery service providers.

• Sharing initiated by Merchant. The App may share information with partners selected by Merchant, such as delivery services and loyalty programs offered by third parties. Merchant may also share information with advertising partners, including via pixels and similar technologies, to allow Merchant to advertise to you and others with similar interests on third-party websites and platforms.

• Analytics and Performance Technologies. The App uses Google Analytics, Google Firebase, Firebase Crashlytics, and similar technologies to understand how users interact with the App, improve performance, identify and diagnose errors, measure the effectiveness of features and marketing campaigns, monitor App stability, and enhance the overall user experience. These technologies may collect information such as device identifiers, operating system information, App version, usage patterns, crash reports, and diagnostic information.

• Authorities and others. Your personal information may be shared with law enforcement, government authorities, and private parties, where required by law or necessary or Appropriate to protect legal rights or the security or integrity of the App.

Your Privacy Choices

Within your App settings, you have the following choices regarding your personal information:

• Access and change your account information. You may access your personal information through your account on the App. You can also correct out-of-date or inaccurate account information.

• Delete your account. To delete your account, follow the instructions within the App settings page.

• Additional rights and choices. To disable third-party advertising pixels and similar technologies, visit the privacy page in your App settings. Merchant may offer additional choices and allow you to exercise any rights accorded to you under applicable laws. For more information, please contact Merchant directly.

Do Not Track. Some Internet browsers may be configured to send “Do Not Track” signals to the online services that you visit. The App does not respond to "Do Not Track" signals. To find out more about "Do Not Track," please visit http://www.allaboutdnt.com.

Changes to This Privacy Policy

This Privacy Policy may be modified at any time. You will be notified of any material changes to the Privacy Policy in accordance with applicable laws.

La Ruta del Cilantro Taquería Franchising, LLC

2394 Professor Ave UP

Cleveland, Ohio 44113

privacy@cilantrotaqueria.com

California Addendum

Merchant does not sell personal information as defined under the California Consumer Privacy Act. This California Addendum supplements the Privacy Policy for Cilantro Taqueria Mobile App and applies only to personal information collected via the App that relates to California residents and is regulated by the California Consumer Privacy Act (“CCPA”).

CCPA Categories of Personal Information

The App collects the following categories of personal information:

• Identifiers, such as name, email address, and IP address.

• Collected: Yes.

• Primary Purposes of Processing: To provide the App and any features you use. To personalize your experience in the App and provide recommendations. Troubleshooting and App improvement.

• Key Disclosures: Toast and other service providers.

• Can You Limit Sharing? No.

• Personal information categories listed in the California Customer Records Statute (e.g., name, contact details).

• Collected: Yes.

• Primary Purposes of Processing: To provide the App and any features you use. To personalize your experience in the App and provide recommendations. Troubleshooting and App improvement.

• Key Disclosures: Toast and other service providers.

• Can You Limit Sharing? No.

• Protected characteristics under California or federal law

• Collected: No.

• Primary Purposes of Processing: N/A

• Key Disclosures: N/A

• Can You Limit Sharing? N/A

• Commercial information, including but not limited to records of products or services purchased

• Collected: Yes.

• Primary Purposes of Processing: To provide the App and any features you use. To personalize your experience in the App and provide recommendations. Troubleshooting and App improvement.

• Key Disclosures: Toast and other service providers.

• Can You Limit Sharing? No.

• Professional or employment-related information

• Collected: No.

• Primary Purposes of Processing: N/A

• Key Disclosures: N/A

• Can You Limit Sharing? N/A

• Biometric information

• Collected: No.

• Primary Purposes of Processing: N/A

• Key Disclosures: N/A

• Can You Limit Sharing? N/A

• Internet or other electronic network activity information, including but not limited to browsing history and search history

• Collected: Yes.

• Primary Purposes of Processing: To provide the App and any features you use. To personalize your experience in the App and provide recommendations. Troubleshooting and App improvement.

• Key Disclosures: Toast and other service providers.

• Can You Limit Sharing? No.

• Geolocation data

• Collected: Yes.

• Primary Purposes of Processing: To provide the App and any features you use. To personalize your experience in the App and provide recommendations. Troubleshooting and App improvement.

• Key Disclosures: Toast and other service providers.

• Can You Limit Sharing? No.

• Audio, electronic, visual, thermal, olfactory, or similar information

• Collected: No.

• Primary Purposes of Processing: N/A

• Key Disclosures: N/A

• Can You Limit Sharing? N/A

• Education records

• Collected: No.

• Primary Purposes of Processing: N/A

• Key Disclosures: N/A

• Can You Limit Sharing? N/A

• Inferences drawn from information to create a profile about your behavior, preferences, etc.

• Collected: Yes.

• Primary Purposes of Processing: To provide the App and any features you use. To personalize your experience in the App and provide recommendations. Troubleshooting and App improvement. To measure the effectiveness of push notifications and other marketing communications, including by analyzing notification interactions and subsequent order activity.

• Key Disclosures: Toast and other service providers.

• Can You Limit Sharing? No.

Merchant may also use personal information collected through the App for the following purposes:

• To analyze users’ selections and preferences in order to improve Merchant’s offerings, identify opportunities for growth, and conduct market research;

• To send you marketing communications outside the App (including by email, text message or other channels) and to advertise to you and others with similar interests on third-party websites and platforms; and

• For compliance and protection, including to enforce any applicable terms and conditions, comply with legal obligations, defend against legal claims or disputes, protect the security and integrity of the App, and identify and investigate fraudulent, harmful, unauthorized, unethical or illegal activity.

These uses outside the App are just examples and may not reflect all the ways Merchant uses personal information outside the App. To learn more, please contact Merchant directly.

Additional Disclosures of Personal Information

Merchant may also share personal information with third parties as follows:

• Sharing initiated by Merchant. The App may share information with partners selected by Merchant, such as delivery services and loyalty programs offered by third parties. Merchant may also share personal information with acquirers and other relevant participants in business transactions (or negotiations for such transactions) involving a corporate divestiture, merger, consolidation, acquisition, reorganization, sale, or other disposition of all or any portion of the business.

• Authorities and others. Your personal information may be shared with law enforcement, government authorities, and private parties, where required by law or necessary or appropriate to protect legal rights or the security or integrity of the App.

Your Privacy Choices

The CCPA grants California residents the following rights:

• Information. You may have the right to obtain information about how your personal information is collected, used, and disclosed. This information is available within this Privacy Policy.

• Access, correction and deletion. You may also have the right to request access to your personal information, to correct personal information that is out of date or inaccurate, or to delete personal information that is no longer needed for a permitted purpose.

Please note that your ability to invoke the rights above are limited pursuant to the scope and limitations of the CCPA, including any available exceptions. For example, an access request can only be made twice within a 12-month period.

Sensitive Personal Information

The App may collect sensitive personal information as follows:

• Dietary and dining preferences. Your dietary and dining preferences may reveal sensitive personal information about you, such as your allergies, accessibility requirements, and religious beliefs. You can submit this information to the App to allow the Merchant to better serve your needs and preferences.

Right to Limit the Use of Sensitive Personal Information

The CCPA grants California residents the right to limit the use of sensitive personal information beyond certain permitted purposes. In general, your sensitive personal information is used only for the limited purposes of providing and personalizing the App for you.

Personal Information Retention

Accounts remain active until deleted by the user. Merchant retains personal information for as long as necessary to provide the App, comply with legal obligations, resolve disputes, maintain business records, administer the loyalty program, and enforce agreements. Certain information, including payment and transaction records, may be retained by Toast or other service providers in accordance with applicable laws and their own retention obligations, even after an account has been deleted.

US State Law Addendum

This US State Law Addendum supplements the Privacy Policy for Cilantro Taqueria Mobile App and applies only to personal information collected via the App that relates to Virginia, Colorado, Connecticut, Texas, Montana, Oregon, and Utah residents and is regulated by applicable consumer privacy laws in such states (“US State Privacy Laws”).

Additional Rights Under US State Privacy Laws

Where applicable, US State Privacy Laws grant consumers the following rights:

• Information. You may have the right to obtain information about how your personal information is collected, used, and disclosed. This information is available within this Privacy Policy.

Privacy requests, including requests to access, correct, or delete personal information where permitted by law, may be submitted by emailing privacy@cilantrotaqueria.com. Merchant may request information necessary to verify your identity before fulfilling your request.

Please note that your ability to invoke the rights above are limited pursuant to the scope and limitations of the US State Privacy Laws, including any available exceptions. If you are not satisfied with how your request was addressed, you may consult the “Contact Us” section of the Privacy Policy to appeal and submit a complaint.

Sensitive Personal Information

The App may collect and use sensitive personal information as follows:

• Precise location. If you choose to enable it, the App will collect your precise location information to provide you with certain location-enabled features, such as to display and alert you to restaurants nearby and provide live map views. You can withdraw your consent at any time by disabling precise location collection within your device settings.

• Dietary and dining preferences. If you choose to submit information about you dietary or dining preferences, you may reveal sensitive personal information about you, such as your allergies, accessibility requirements, and religious beliefs. By providing this information within the App, you consent to Merchant’s use of this information to better serve your needs and preferences. You can withdraw consent at any time by deleting such information within your profile in the App.

Please note that your withdrawal of consent will not affect use of your information before you withdrew your consent.

Personal Information Retention

Your personal information is retained for as long as is necessary to allow you to access and use the App and for a reasonable time thereafter for the purposes described in the Privacy Policy. Your personal information will be deleted or destroyed when its continued retention is no longer reasonable, necessary, and proportionate in accordance with applicable laws.

Privacy Policy for Cilantro Taqueria Mobile App

©2026 Raul, LLC. All rights reserved.