Privacy Policy

In short

• We use your data to take, charge and deliver your orders, and to run your account and stamp card (Tarjeta de Sellos).
• Allergies are optional, used only to prepare your order and never shared with third parties.
• We don't sell your data. We share only what's needed with Uber for deliveries and, unless you opt out, hashed contact info with Meta and Google for advertising.
• You can opt out of advertising, withdraw consent or exercise your ARCO rights anytime at hola@tolo.cafe.
• You can delete your account in the app or at https://www.tolo.cafe/mx/eliminar.

1. Who we are

Rodrigo Esquivel Flores, an individual doing business as "TOLO" or "Tolo Café" ("TOLO", "we"), located at Blvr. José María Pino Suárez 800, Col. Cuauhtémoc, 50130 Toluca de Lerdo, State of Mexico, is responsible for your personal data under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP). Contact: hola@tolo.cafe.

2. What data we use

• Identification and contact: name, mobile phone, email, delivery or shipping address; date of birth and gender (both optional). For wholesale customers, your business contact details.
• Account and purchases: orders, preferences, digital wallet balance, stamps on your stamp card (Tarjeta de Sellos), and Apple Wallet or Google Wallet passes. Payments are processed by our providers; we don't store full card numbers.
• Tax details (only if you request an invoice): received by WhatsApp or other messaging apps: RFC (Mexican tax ID), name or business name, tax regime, tax postal code, CFDI use and email, or your Constancia de Situación Fiscal (tax status certificate).
• Technical and usage: device identifiers and system, app version, push tokens, IP address, usage and browsing data, and device data when you use our guest Wi-Fi. Your location, only if you allow it and only to show the nearest café and help you enter your delivery address.
• Communications: messages, photos and files you send us through in-app chat, SMS, WhatsApp, Instagram or Messenger, and your conversations with our automated assistant.
• ⚠️ Sensitive data – allergies: Adding your allergies or dietary restrictions is optional; by saving them in the app you give your express consent. We use them only to prepare your orders safely, share them with no third party, and you can delete them and withdraw consent anytime, in the app or at hola@tolo.cafe. We collect no other sensitive data.

3. Why we use it

Primary purposes (needed to serve you): create and manage your account and verify it with a one-time code; process orders, payments and top-ups; prepare, deliver and ship your orders, including those placed on third-party platforms; run your stamp card and digital passes; send confirmations, receipts and invoices (CFDI); answer your messages; give you Wi-Fi access; and meet legal and tax obligations.

Secondary purposes (optional): promotions, events and news; statistics and analysis to improve; personalizing the app; targeted advertising, including using your hashed email and phone to build or exclude audiences on Meta and Google; and market research.

4. Your choices

• Refuse secondary purposes, at any time: email hola@tolo.cafe with the subject "Negativa finalidades secundarias", or turn off promotional notifications in the app. Refusing doesn't affect our service.
• Withdraw consent: email hola@tolo.cafe. This doesn't affect processing already done or processing required by law or for primary purposes.
• Limit use or disclosure: ask us at hola@tolo.cafe to stop using your data for advertising and we'll add you to our internal opt-out list. In Mexico, you can also register your phone with Profeco's Registro Público para Evitar Publicidad (REPEP).

5. Who we share it with

Service providers (encargados). They process data on our behalf, under our instructions and bound by confidentiality.

Transfers. Third parties that use data for their own purposes:

• Uber (Uber Eats and Uber Direct) (US): only name, phone and delivery address, to complete the orders you request. No consent needed.
• Meta (Facebook/Instagram) and Google Ads (US): hashed email and phone for ad audiences; you can opt out (section 4). Messages you send us on Instagram or Messenger are processed on Meta's platform.
• Competent authorities: when required by law; no consent needed.

TOLO has a TikTok account; if you interact with it, TikTok handles your data under its own policy. We don't share customer lists with TikTok. Some recipients are outside Mexico, mainly in the US.

We don't sell personal information. Residents of the US and Canada may also request access, correction or deletion at hola@tolo.cafe.

6. Your ARCO rights

You can Access your data, Rectify it, Cancel it or Oppose its use. Email hola@tolo.cafe with: your name and a way to reply; the right and the data involved; an official ID (or, if acting for someone else, proof of representation); and anything that helps us locate your data.

We'll respond within 20 business days, through the channel you choose, and, if granted, we'll carry it out within the following 15 business days.

Delete your account: in the app or at https://www.tolo.cafe/mx/eliminar. We keep anonymized transaction records as Mexican tax law requires.

7. Cookies and trackers

We use cookies and similar technologies to keep you signed in, remember preferences, analyze usage and show personalized ads: PostHog, Google Analytics/Firebase, Google Ads, Meta and Mapbox. You can turn them off in your browser or device settings; some features may not work as well.

8. How long we keep it

While your account is active and the data is needed for these purposes. Then we block and delete it as the law provides; purchase and tax data are kept for the period Mexican tax law requires.

9. Children

Our services are not directed to minors, and we do not knowingly collect their data.

10. Changes and authority

If we update this policy, we'll post the current version at https://tolo.cafe and notify you in the app or by email.

If you believe your data protection rights have been violated, you may contact Mexico's Secretaría Anticorrupción y Buen Gobierno.

Last updated: November 4, 2026