Comprehensive privacy notice

Cooku, a trade name operated by Victor Leonardo Garza Martínez, an individual acting as a sole proprietor, with an address for notices at Ciudad de México, C.P. 03400, México ("Cooku", "we") provides an online platform for restaurants and hospitality businesses to manage orders, digital menus, reservations, events, cash, inventory, invoicing and communication with their customers, available at usecooku.com and its subdomains.

This document explains which personal data we process, why, who we share it with and how you can exercise your rights. It is issued under the Federal Law on Protection of Personal Data Held by Private Parties published in the Official Gazette of the Federation on March 20, 2025, and the provisions derived from it. For any privacy matter, write to hola@usecooku.com.

Cooku is not yet incorporated as a company. If a company is formed in the future to operate it, that company will assume all the rights and obligations described in this document, including the role of controller of personal data. We will inform you in advance by email or within the platform, and you will not need to give your consent again for the same purposes.

Cooku processes personal data in two different roles, and it matters which one applies to you:

• Cooku as controller: when you create a business account, use the Cooku dashboard as an owner or team member, leave your contact details on our website, or browse our marketing pages. In these cases Cooku decides how and why your data is used, and this policy applies directly.
• Cooku as processor (on behalf of a restaurant): when you place an order, make a reservation, buy a ticket or request an invoice at a restaurant that uses Cooku. In these cases the restaurant is responsible for your data: it decides what data to ask for and why, and Cooku only processes it following the restaurant's instructions to provide its service. The restaurant must inform you through its own privacy notice.

If you are a restaurant customer and want to see, correct or delete your data, the fastest route is to ask the restaurant directly. You can also write to us and we will forward your request.

Cooku is not responsible for processing that each restaurant carries out on its own outside the platform, nor for the content of its privacy notices.

We only ask for the data each feature needs. Depending on how you use Cooku:

• Business owners and staff: first and last name, email, phone, password (always stored with one-way encryption; nobody at Cooku can see it), optional profile photo, role and permissions within the business, and a history of actions in the system (for example, who opened a cash session or confirmed an order).
• Business data: trade name, legal name, RUC or RFC, tax and branch addresses, phone, email, logos, social media and subscription billing details.
• Restaurant customers (diners): name, phone, email, delivery address with approximate map location, table or room, party size, order or reservation notes, visit and spending history, loyalty points, birthday (day and month only), dietary preferences and allergies if the diner or the restaurant records them, and the choice about receiving advertising.
• Electronic invoicing: when you request an invoice: name or company name, tax ID (RUC, cédula or RFC) and the email to send it to.
• People interested in Cooku: name, WhatsApp, email, business name and number of branches you leave in our forms, along with the campaign or page you came from.
• Technical data: approximate country based on your IP address (to show you the right version of the site), browser and device type, pages visited and performance metrics.
• Delivery platform orders: if the restaurant connects Uber Eats, Rappi, PedidosYa or DiDi Food, we receive the customer's name, delivery address and a masked phone number from them to prepare and dispatch the order.

Allergies and dietary restrictions may reveal health information, which the law treats as sensitive. They are recorded only so the restaurant can prepare your food safely, are never used for advertising or shared with third parties outside the service, and recording them is the restaurant's responsibility, which must obtain your express consent. Please do not write other health information in free-text order or reservation notes.

Cooku does not store your full card number or its security code. Payments are processed by specialized providers that comply with the Payment Card Industry Data Security Standard (PCI DSS). For some payment methods, card details travel encrypted through our servers solely to be sent to the processor at that moment, and they are not stored. We only keep the card brand, its last digits and the transaction references.

Purposes necessary to provide the service (primary):

• Create and manage business and team member accounts, and verify identity at sign-in.
• Receive, prepare, charge and deliver orders; manage reservations, event tickets and guest lists.
• Issue invoices and tax receipts through providers authorized by the tax authority.
• Send service messages by email or WhatsApp: confirmations, order or reservation status changes, invoices, password recovery, invitations and account notices.
• Charge the Cooku subscription and provide technical support.
• Protect the platform: prevent fraud and unauthorized access, and keep audit logs.
• Comply with legal and tax obligations and requests from competent authorities.

Purposes not necessary for the service (secondary):

• Send you commercial information, news and promotions about Cooku, if you are a business or left us your contact details.
• Measure the effectiveness of our campaigns and website.
• If you are a restaurant customer and agreed to receive advertising, allow that restaurant to send you its promotions. That decision belongs to the restaurant and you can reverse it with the unsubscribe link in each email.

Secondary purposes are not necessary to provide the service. If you do not want us to use your data for them, write to hola@usecooku.com at any time with the subject "Refusal of secondary purposes", or use the unsubscribe link in our emails. Your refusal will never be a reason to deny you the service.

We may also produce aggregated or anonymized information (for example, average sales by type of business) that does not identify any person or any specific restaurant, to improve the product and compile statistics.

We process your data based on: (a) our contractual relationship with you or with the restaurant you buy from; (b) your consent, where the law requires it, for example to receive advertising; (c) compliance with legal obligations, such as tax duties; and (d) our legitimate interest in keeping the platform secure and preventing fraud, provided your rights do not override it.

By creating an account, sending us your data or continuing to use Cooku after this document has been made available to you, you consent to the processing described for the primary purposes. For advertising we ask for separate consent, which is never pre-selected the first time.

Cooku uses the WhatsApp Business platform of Meta Platforms, Inc. so restaurants and Cooku can send service messages, such as an order or reservation confirmation. To do so we share with Meta your phone number and the message content (for example, your name, the order number and the restaurant name).

• We only message numbers that the user, or the restaurant with your authorization, registered for that purpose.
• We do not sell your number or use it to send you third-party messages.
• If the message came from the Cooku WhatsApp number, reply STOP (or BAJA) and you will stop receiving WhatsApp updates from that number, from any restaurant that uses it. If you change your mind, reply START (or ALTA).
• You can also ask at any time to stop receiving WhatsApp messages by writing to the restaurant or to hola@usecooku.com, or block the number in WhatsApp. If you opt out and left an email address, updates about your orders and reservations may still reach you by email.
• We do not use Facebook Login and do not access your profile, contacts or personal messages on Facebook, Instagram or WhatsApp.

If you write to the Cooku WhatsApp number, we receive your message through Meta, but we do not store what you wrote. We only record whether you opted out or back in, which restaurant the update belongs to, and a fingerprint of your number (not the number itself) so we do not reply twice. No person reads that number: we reply automatically with the restaurant's contact details.

On our marketing pages we use the Meta pixel to measure the effectiveness of our ads (for example, how many people visit a page or leave us their details). The pixel does not receive your name, phone or email. In addition, each restaurant can enable its own Meta or Google identifiers on its public pages; in that case the restaurant is responsible for that processing and confirms in Cooku that it discloses it in its privacy notice. These tools are never loaded on order confirmation, invoice, reservation or unsubscribe pages.

Meta processes the information it receives under its own privacy policy, available at https://www.facebook.com/privacy/policy and, for WhatsApp, at https://www.whatsapp.com/legal/privacy-policy.

We do not sell or rent personal data. We share it only with providers that help us deliver the service, act on our instructions and must protect it with measures equivalent to ours. The main categories and providers are (the up-to-date list is at https://usecooku.com/pa-en/seguridad):

• Hosting and infrastructure: Railway (servers and database) and Vercel (website and cookieless usage and performance metrics).
• Email: Resend, for transactional emails and, where you agreed, campaigns.
• Messaging: Meta (WhatsApp Business), for service messages.
• Payments: Stripe, Powertranz, Tilopay, PagueloFácil and Yappy, depending on the method the restaurant chooses. They receive the data needed to charge and prevent fraud.
• Electronic invoicing: authorized e-invoicing providers (for example, Alanube in Panama), which transmit the invoice to the tax authority.
• Images: Cloudinary, for logos, product photos and receipts uploaded by businesses.
• Business tools: services the restaurant chooses to connect, such as kitchen ticket printing (PrintNode), automatic menu translation (DeepL or Google Translate) and AI reading of supplier invoices (Google Gemini or Anthropic). We do not send diner data to the latter.
• Delivery platforms: Uber Eats, Rappi, PedidosYa and DiDi Food, if the restaurant connects them, to sync its menu and receive orders.
• Advertising measurement: Meta (pixel) on our marketing pages.

In addition, diner data is shared with the restaurant they interact with, which is its controller. We may also disclose data when required by law, a court order or a competent authority; to defend the rights of Cooku, its users or third parties; or, as permitted by law, in the event of a merger, acquisition or sale of Cooku assets, in which case the acquirer will be bound by this policy.

Several of our providers host information outside your country, mainly in the United States. When this happens, we choose providers with recognized security standards whose contractual terms offer a level of protection equivalent to that required by applicable law. By using Cooku, you are informed that your data may be processed in those countries for that purpose.

We use few cookies and some browser local storage:

• Necessary: the "cooku_market" cookie remembers your country (one year); local storage keeps your dashboard session, your cart and, if you choose, your contact details so you don't retype them on your next order. You can clear them with the "Not me" option or from your browser.
• Preferences: light or dark theme and point-of-sale settings.
• Measurement: the "cooku_utm" cookie remembers for 90 days the campaign you came from. Vercel metrics do not use cookies.
• Advertising: the Meta pixel "_fbp" cookie on our marketing pages, and Meta or Google cookies a restaurant enables on its own pages.
• Your choice: the "cooku_cookie_consent" cookie remembers for one year whether you accepted all cookies or only the necessary ones.

On our marketing pages we show a notice where you can choose "Accept" or "Necessary only"; if you choose "Necessary only", we stop using Cooku's measurement and advertising cookies and delete the "cooku_utm" cookie. You can change your choice at any time with the "Cookie preferences" link at the bottom of our home page, or block and delete cookies in your browser. If you block the necessary ones, some features (such as the cart or sign-in) may stop working.

We keep data while the business account is active or while it is needed for the purposes described. Afterwards we delete or anonymize it, except what we must keep by law:

• Invoices, payments and accounting records: for the period required by tax and commercial laws (generally five years).
• Personal data received from delivery platforms: automatically deleted after 30 days; only the order needed for the restaurant's operation remains.
• WhatsApp opt-outs: your number and the date you opted out, while Cooku sends WhatsApp updates, solely so we do not message you again.
• Messages you write to the Cooku WhatsApp number: the record of each one (without the text) is deleted after 30 days.
• Backups: periodically overwritten according to their rotation cycle.
• Data of prospects who did not become customers: until you ask us to delete it or it is no longer useful to contact you.

We apply reasonable administrative, technical and physical measures: encrypted connections (HTTPS), passwords stored with one-way encryption, integration credentials encrypted at rest, strict separation of each business's information, role-based permissions and audit logs of access by the Cooku team.

No system is completely infallible. If a security breach significantly affecting your rights occurs, we will inform you, and the authorities where applicable, within the time and terms set by law. Each business is responsible for keeping its team's passwords secure and removing access for people who no longer work with it.

As the owner of your data you have the right to:

• Access: know which personal data we hold about you and how it is processed.
• Rectification: correct your data if it is inaccurate or incomplete.
• Cancellation: ask us to delete your data when it is not required for the purposes described and no legal duty requires us to keep it.
• Objection: object to the use of your data for specific purposes.
• Withdrawal of consent: withdraw the consent you granted us, without retroactive effect.
• Limitation of use or disclosure: ask us to stop using your data for advertising or commercial prospecting.

To exercise them, write to hola@usecooku.com from the email linked to your account or order, stating which right you wish to exercise. We may ask for additional information to confirm your identity, to protect your data from false requests. The process is free of charge.

Your request must include your name and a way to send you our reply, a document proving your identity (or that of your representative), and a clear description of the right you wish to exercise and the data concerned. We will reply within 20 business days at most from receipt of the complete request and, if applicable, carry it out within the following 15 business days, or within any shorter period set by the law in force.

If Cooku processes your data on behalf of a restaurant, we will forward your request so the restaurant can resolve it as controller, and we will support it so your request is handled.

You can ask us to delete your data at any time, including data we receive through Meta services such as WhatsApp:

• 1. Write to us: send an email to hola@usecooku.com with the subject "Delete my data", from the email linked to your account, order or reservation. If you only gave us your phone number, include it in the message.
• 2. Tell us who you are: include your name and, if you are a business, the business name. If you are a restaurant customer, tell us which restaurant.
• 3. We confirm and delete: we verify your identity, delete or anonymize your data and confirm in writing when the process is complete.

If you own a business, deleting your account also deletes your business data, branches and the customer information stored in Cooku. This cannot be undone, so we will ask you to confirm it. Download your invoices and any information you need first: as the issuer, the law requires you to keep your tax records, and your authorized e-invoicing provider keeps the originals.

Otherwise, we will keep only what the law requires to be retained (for example, invoices issued in your name, while the business that issued them keeps using Cooku), blocked and solely for that purpose, until the legal period expires. If you opted out of WhatsApp updates, we will also keep your number on the opt-out list, solely so we do not message you again; if you would rather we delete it, say so in your request.

Cooku is aimed at businesses and adults. We do not knowingly collect data from minors. If a minor places an order or reservation, they must do so with the authorization of a parent or guardian. If you believe we hold a minor's data without that authorization, write to us and we will delete it.

If you believe your right to personal data protection has been infringed, you may go to the Secretariat of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno), the competent authority in Mexico under current law. Please write to us first: we can almost always solve it directly and faster.

We may update this document due to changes in the law, our services or our providers. The current version will always be on this page with its update date. If the change is significant, we will also notify you by email or within the platform before it takes effect.

This English version is provided for convenience. In case of any discrepancy, the Spanish version published on this site for your country prevails.