Privacy Policy

1. Data we collect

• Account email, display name, login sessions, device security data, and account-linking records.
• Orders, subscriptions, refunds, disputes, point ledgers, quotes, generation jobs, and asset usage.
• Uploaded images, video, documents, prompts, generated results, and necessary technical logs.

2. Payment data

DodoPayments processes cards, taxes, invoices, payment recovery, and bank settlement. TacoTaco does not store full card numbers, but keeps a business copy of orders, payment states, fees, taxes, settlement, and reconciliation records.

3. How we use data

• Authenticate you, manage points and assets, execute generation, and complete payments and refunds.
• Prevent fraud, attacks, abuse, and cross-user access; diagnose failures; and meet legal duties.
• Send payment, point-expiry, storage, and asset-deletion notices and respond to support.

4. Providers and international processing

We use DodoPayments, private S3-compatible storage, Resend, upstream AI models, hosting, and analytics services. Necessary data may be processed outside your country under provider policies and contractual protections.

5. Cookies, sessions, and caching

Sign-in uses secure HttpOnly session cookies. Other necessary cookies may support security, preferences, and aggregated analytics. Private account and asset pages are excluded from public caching and search indexing.

6. Retention and deletion

Application-server temporary files are generally removed within 24 hours; production assets remain in private object storage. User-deleted assets enter 30-day recovery. Account deletion has a seven-day reversal period, then personal data and assets are deleted while required financial records are anonymized.

7. Your rights

In Account you can export orders, points, session information, asset records, and originals; change email; sign out every device; or request deletion. You may also exercise applicable access, correction, deletion, or restriction rights.

8. Private by default and contact

Uploads and generated results are private by default and are not used for training. Privacy questions: support@tacotaco.me.