1. Introduction
GustaLocal respects user privacy and is committed to protecting personal data in accordance with the General Data Protection Regulation (GDPR - EU Regulation 2016/679) and applicable local regulations.
2. Data Controller
The Data Controller is GustaLocal. Email: support@gustalocal.com
3. Data Collected
From businesses:
- Owner/representative name
- Email and phone number
- Business information (name, address)
- Payment data (managed by Stripe or Mercado Pago)
- Product and menu information
From end customers (via businesses):
- Name, phone, delivery address
- Email (if provided)
- Order history
- Preferences and feedback
4. Purposes of Processing
- Providing and managing platform services
- Processing orders and payments
- Service-related communications
- Improving the platform and user experience
- Fulfilling legal and tax obligations
- Preventing fraud and abuse
5. Legal Basis
- Execution of the service contract
- Explicit user consent
- Legal obligations (e.g. invoice retention)
- Legitimate interest (e.g. fraud prevention)
6. Third-Party Providers and Sub-processors
To deliver the service, GustaLocal uses the following third-party providers, who may process personal data solely for the specified purposes:
- Stripe (stripe.com) — payments and subscription management
- Twilio (twilio.com) — WhatsApp notifications
- Brevo (brevo.com) — transactional emails and communications
- Supabase (supabase.com) — database and authentication
- Mapbox (mapbox.com) — maps and geolocation
- Google Maps — geolocation and geocoding (where used)
- Mercado Pago (mercadopago.com) — payments for Brazil
GustaLocal never sells personal data to third parties. All providers are bound by data processing agreements compliant with GDPR or equivalent regulations.
7. Data Retention
- Account data: for the duration of the subscription + 10 years (tax obligations)
- Order data: 10 years (tax and accounting obligations)
- Analytical data: aggregated and anonymised form
8. User Rights (GDPR)
- Access: request a copy of your data
- Rectification: correct inaccurate data
- Erasure: request deletion (right to be forgotten)
- Restriction: limit processing in certain circumstances
- Portability: receive data in a structured format
- Objection: object to processing for legitimate reasons
To exercise these rights: support@gustalocal.com
9. Data Security
- Data encryption in transit (HTTPS/TLS)
- Access control and secure authentication
- Regular backups and redundancy
- Suspicious activity monitoring
10. Cookies and Similar Technologies
We use technical cookies necessary for platform operation. For more information see our Cookie Policy.
11. Changes to the Privacy Policy
GustaLocal may update this Privacy Policy periodically. Users will be notified by email of material changes.