Privacy Policy

1. Who we are and how to reach us

Tumbite is a service of Windoce LLC, a Florida company in the United States, which is responsible for your data.

For any privacy question or to exercise your rights, email us at support@tumbite.com. We answer in English and Spanish.

2. What we collect and how

Information you give us: name, email, mobile number, password (stored encrypted, never in plain text), language, and, if you choose, your birthday for your birthday gift. Restaurants: business name, address, phone, menu, prices, and photos. Drivers: your vehicle (type, make, model, year, color, and plate), your driver’s license (number, issuing state, and expiration), and your insurance (insurer, policy, and expiration).

Order information: what you order, the restaurant, the delivery address, notes for your driver, amounts, tip, and the ratings and comments you leave.

Identity verification (drivers and restaurant owners): a photo of your ID document (front and back) and a photo of your face, taken with your camera. If you own a restaurant, also a photo of the storefront with your phone’s location at that moment, to confirm it exists at the registered address. A person on our team compares the photos; we don’t create biometric templates of your face. The photos are stored privately, only the Tumbite team can see them, and they’re deleted when you delete your account.

Location: only with your permission. See section 4.

Payments: processed by Stripe. We never receive or store your full card number, security code, or bank details. Stripe only sends us a payment ID, the card brand, and its last four digits.

Technical information: your device token to send you notifications (if you allow them), and your IP address and the time of each sign-in, which we use to protect your account and prevent abuse.

Waitlist: if you sign up on tumbite.com, your name, email, city, and, if you share it, your phone number.

3. How we use your data

To take, prepare, deliver, and charge for your orders; pay restaurants and drivers; support you; send order status notifications and account emails (email confirmation, password reset, receipts); provide loyalty benefits (punch card, birthday gift, levels); prevent fraud and abuse; and comply with the law, including tax obligations.

We don’t use your data for third-party advertising, we don’t track you across other apps or websites, and we don’t sell or rent your personal data. If we ever want to use your data for something not described in this policy, we’ll ask for your permission first.

4. Location

Customer app: with your permission, we use your location while you use the app to show nearby restaurants and set your delivery spot. If you don’t allow it, you can type your address and the app works the same.

Driver app: location is required to receive and complete deliveries. It’s shared only while you’re online or on an active delivery, to offer you nearby orders and let the customer follow the order on a map. We keep only your latest position, not your route, and it’s cleared when you go offline or delete your account.

You can turn off location access at any time in your phone’s settings.

5. Who we share your data with

The restaurant and driver for each order, only what they need to prepare and deliver it: your name, what you ordered, the address, and delivery notes.

Service providers that help us operate, and only for that purpose: Stripe (payments and payouts to restaurants and drivers), YaDominios Cloud (servers, database, and email), Expo, Apple, and Google (push notifications), and Apple and Google map services. We require them by contract to protect your data at least as well as this policy does, and we don’t allow them to use it for their own purposes.

Authorities, when required by law, a court order, or to protect someone’s safety.

If the company is sold or merged, your data would pass to the new owner under this same policy, and we would notify you first.

6. How long we keep your data

While your account is open, we keep your account and order data to provide the service.

When you delete your account, we immediately delete your name, email, phone, birthday, password, sessions, device tokens, your identity verification photos and details, your vehicle, license, and insurance, the addresses, notes, and location of your orders, the text of your ratings, and your waitlist entry.

What we keep without your name: the amount, date, and restaurant of each order, for seven years, as required by tax and accounting laws and to resolve payment disputes or fraud. Those records no longer identify you.

Backups: we keep daily backups for 30 days. Deleted data disappears from them as they expire, at most 30 days later.

Stripe keeps your payment data under its own policy and financial regulations.

7. How to delete your account or withdraw consent

In the app: three-dot menu → “Delete my account”. On the web: tumbite.com/panel/settings → three dots next to the title → “Delete my account”.

Without the app: email support@tumbite.com from your account’s email address and we’ll delete it within 30 days. No need to reinstall anything. Full details at https://tumbite.com/delete-account.

To withdraw consent without deleting your account: turn off location or notification access in your phone’s settings, remove your birthday in Settings, or email us to stop using any piece of data.

8. Your rights

You can ask us for a copy of your data, or to correct, delete, or limit its use, by emailing support@tumbite.com. To protect your account, we’ll verify the request comes from your account’s email. We respond within 45 days. We won’t treat you differently for exercising your rights.

Residents of California and other states with privacy laws (such as Virginia, Colorado, Connecticut, Utah, and Texas) also have the rights those laws provide, including to know what data we hold and why, to request deletion and correction, and not to be discriminated against for asking. We don’t sell or share personal data for advertising, so there is nothing to opt out of. You or an authorized agent may submit a request.

If you live outside the United States, your data is processed on servers located in several countries with the same protections described here.

9. Security

All communication is encrypted (HTTPS). Passwords are stored with one-way hashing. We limit sign-in attempts to stop password guessing, and only staff who need it for their job can access data. No system is perfect: if a security incident affects you, we’ll notify you as the law requires.

10. Children

You must be at least 18 to create an account. Tumbite is not directed to children under 13 and we don’t knowingly collect their data. If you believe a child gave us their data, email support@tumbite.com and we’ll delete it.

11. Cookies and browser storage

We use a single cookie, needed to keep you signed in. Your browser also saves what you’re typing in a form so you don’t lose it if it closes; it’s cleared when you submit or sign out. We don’t use advertising or tracking cookies.

12. Changes to this policy

If we change it, we’ll post the new version here with its date. If the change is significant, we’ll notify you by email or in the app before it takes effect.