Privacy Policy

How we handle your information when you use the El Mexicano Grille rewards app.

Who we are

This rewards app is operated by Mexicano Grille Software LLC, a Texas limited liability company. We refer to ourselves as “we,” “us,” or “the operator” below.

What we collect

• Your phone number.We use it as your account identifier so you don't have to remember a password or email. You provide it when you sign up at /signup.
• Language preference (English or Spanish) and a marketing-opt-in flag, both of which you can change later.
• Transactions you claim from your receipt.When you scan the QR sign at a location and type your check number and total, we record the location, the amount, the time, and the points you earned. If you use the camera scan option, we also record the line items, server name, subtotal, tax, and tip we read off the receipt photo, so you can see a digital receipt in your history later. We never see card numbers. We ask you to enter the pre-tip total; if you include a tip in what you typed, we'll credit points on whatever you entered, but we have no way to separate tip from food.
• Redemptions. When you use points for a free item, we record which reward, when, where, and how many points you spent.
• Limited technical data. Your IP address and browser user-agent are visible to the vendors below as part of normal request handling and error reporting (Sentry, PostHog, Twilio metadata, Vercel logs, Supabase gateway logs, Google Maps when you load the locations page). Cookies set by the app are functional only (auth session, language preference, staff-device binding for the register).

We do not collect: your card number, your home address, your email (unless you send us one), your location beyond the pilot you scanned at, your social media identity, or anything from third-party trackers.

Who processes it for us

We rely on these vendors to run the app. Each gets only what it needs:

• Supabase — our database (hosted on AWS, US region). Stores your phone, transactions, redemptions, and language preference.
• Twilio — sends the one-time signup code and the earn/redeem confirmation texts. Twilio gets your phone number and the message body for each text we send.
• Vercel — hosts the website. Receives standard request logs (IP, user-agent, URL).
• Sentry — captures crashes so we can fix them. Records a masked replay of the page on errors (we configure it to hide all text and inputs by default so phone numbers and codes stay private). Receives the IP, user-agent, and request URL of the erroring session.
• PostHog — counts events like signups and redemptions so we can see which parts of the app are working. We never send your phone number in plaintext — we send a salted one-way hash so identical visits group together without exposing the number. PostHog also receives your IP and user-agent on each captured event as part of standard analytics traffic.
• Google Maps — renders the map on the locations page. When that page loads, Google receives the IP and page URL of your device. We do not request your GPS location.
• Google Cloud Vision— reads check number and total off receipt photos when you choose the camera option on the scan screen. The image bytes go straight to Vision's text-detection API and are discarded as soon as the parsed values come back. We don't save the photo, we don't store the OCR transcript, and we don't share the image with anyone else. If you'd rather not use OCR, the typed-entry option is right below it and works without any photo upload.
• Anthropic— when our standard pattern can't parse the line items off your receipt photo, we send only the text Google Cloud Vision already extracted to Anthropic's Claude API to parse it into structured fields (line items, server name, totals). We don't send the image, your phone number, your account, or any other context — just the receipt text. Anthropic does not use API inputs to train its models. If you'd rather not use OCR at all, the typed-entry option is right below it and works without any photo upload.

We do not sell your information. We do not share it with marketers.

SMS and TCPA

By providing your phone number at signup, you consent to receive transactional text messages from us: the one-time signup code, an earn confirmation when you scan a receipt, and a redemption confirmation when you spend points. Reply STOPto any of these to opt out of all texts. Standard message and data rates from your carrier may apply. We do not send marketing texts unless you check the marketing opt-in at signup; that's a separate consent and you can also opt out of marketing texts by replying STOP.

How long we keep it

We keep your account and history indefinitely while it's active so your point balance and redemption history are accurate. If you ask us to delete your account (see below), we remove your phone, language preference, and opt-in flag immediately. We retain transaction and redemption rows in anonymized form (the customer phone is replaced with NULL) for up to 7 years for accounting purposes.

Cross-location visibility

El Mexicano Grille is a family of restaurants run by separate Texas LLCs operating under the same brand. Your account, balance, and history are one record across every Mexicano Grille location participating in this app — so you can earn at one location and redeem at another. Each location sees its own activity with you; the platform operator (Mexicano Grille Software LLC) sees activity across the chain so the loyalty program works as one program rather than separate ones.

Your rights

• See what we have. Sign in at /me to see your balance, history, and language setting.
• Correct it.If a detail is wrong, email us (below) and we'll fix it.
• Delete it.Email us and we'll close your account.
• Stop the texts. Reply STOP to any text. (Stopping texts does not by itself delete your account.)

Children

The app is not intended for anyone under 13. If you're under 13, please don't sign up; if a child under 13 has signed up, contact us and we'll delete the account.

Texas note

We're a Texas operation. We respect Texas consumer rights, and if Texas (or federal) law gives you specific data rights — like the right to know what's collected about you or to ask us to delete it — you can exercise them by emailing the address below.

Changes

If we change this policy in a material way, we'll update the “last updated” date at the top and, where it makes sense, text affected customers.

Contact

Email juanleon1905@gmail.com with privacy or data questions. (We'll move this to a dedicated privacy@ address once the LLC and domain mailbox are set up.)

See also our Terms of Service.