Privacy Policy

01Who we are

Atilano's Mexican Food is a family-owned, takeout-only Mexican restaurant located at 12526 W Sunset Hwy, Airway Heights, WA 99001. In this policy, "we," "us," and "our" refer to Atilano's Mexican Food. "You" refers to anyone who visits this website, places an order, submits a form, or interacts with us in person or by phone.

This policy applies to personal information we collect through this website (atilanos-airwayheights.icu), through phone calls and in-person visits, and through any order, message, or catering request you submit.

02What we collect

We try to collect as little as possible — only what we need to take an order, respond to a message, or run the restaurant. Here is what we actually receive:

Information you give us

• Order information: your name, phone number, pickup time, and any notes you add to an order (for example, "extra salsa" or allergy information). This is captured when you place a takeout order through the site or by phone.
• Contact form information: your name, email, optional phone number, the topic you select, and the message you write.
• Catering requests: your name, email, optional phone number, event date, pickup time, guest count, and the details you provide.
• Newsletter: your email address, if you choose to sign up on the home page.

Information collected automatically

When you submit a form or place an order through this site, our server logs the following for security and fraud prevention:

• IP address — the numeric address your device uses to connect to the internet.
• User agent string — a standard identifier containing your browser and operating system information.
• Timestamp — the exact moment the request was received.

Information stored in your browser

This site uses your browser's local storage to keep your cart between page visits, remember whether you've dismissed the cookie notice, and display your order details on the confirmation page. This information stays on your device and is not transmitted to us except when you submit an order or form. See Section 5 for details.

03What we don't collect

This is important, and we want to be explicit about it:

• We do not use any third-party analytics — no Google Analytics, no Plausible, no Matomo, no similar service.
• We do not use any advertising trackers — no Facebook Pixel, no Google Ads conversion tags, no TikTok pixel, no retargeting scripts of any kind.
• We do not store payment card numbers — we don't accept card payments through this website. Card payments happen in person at the register, processed by a third-party terminal under the PCI-DSS standard. We never see or store your card number.
• We do not collect your location — no GPS, no IP-based geolocation, no proximity tracking.
• We do not buy or rent personal information from data brokers, and we do not sell personal information to anyone.

04How we use it

We use the information described above only for these purposes:

• To prepare and fulfill your order — we need your name and phone number to identify your order at the counter and to contact you if something is wrong.
• To respond to messages and catering requests — we use your email and phone to reply and to confirm details.
• To send newsletters — only if you signed up. Every newsletter includes an unsubscribe link, and you can also email [email protected] to be removed immediately.
• To prevent fraud and abuse — IP addresses, user agents, and timestamps help us identify automated submissions and prevent abuse of our order and contact forms.
• To comply with legal obligations — for example, responding to a valid subpoena, or retaining records required by Washington State tax law.

We do not use your information for profiling, automated decision-making, or targeted advertising.

05Cookies & local storage

This site does not use tracking cookies. It does use your browser's localStorage feature, which is similar to cookies but stores information only on your device and is not sent to our server unless you take an action (like submitting an order).

Key	What it does	Expires
atilanos_cart_v1	Stores the items in your cart — item IDs, names, prices, and quantities — so the cart survives page reloads.	Until you clear it or place an order
atilanos_cookie_consent	Remembers that you dismissed the cookie banner so it doesn't appear on every page.	Until you clear your browser data
last_order (session storage)	Holds your order details temporarily after checkout so the confirmation page can display them.	Until you close the browser tab

You can clear this information at any time through your browser settings — it's usually under "Clear browsing data" or "Storage" in the privacy section. Clearing it will empty your cart and reset the cookie banner. It does not affect any order you've already placed.

06Third-party services

This site uses a small number of third-party resources. We don't share your personal information with them, but their servers do see your IP address when you load a page, because that's how the internet works:

• Google Fonts (fonts.googleapis.com, fonts.gstatic.com) — serves the typefaces used on this site. Google may log the request but does not set cookies for the standard Fonts API.
• Font Awesome via Cloudflare CDN (cdnjs.cloudflare.com) — serves the icon font used on this site. Cloudflare does not set cookies for these requests.
• Google Maps (maps.google.com) — used on the Visit, Contact, and Home pages to embed a map of our location. When the map loads, Google may set its own cookies and collect data per Google's privacy policy. We do not control what Google does with that data. If you prefer, you can view our address on the page without loading the map by using the "Get directions" link, which opens Google Maps in a new tab.
• Our hosting provider — stores the files that make up this site. They process standard web server logs (IP address, user agent, request timestamp) for security and uptime monitoring.

None of these providers receive your name, phone number, email, or order details from us. They only see the standard HTTP request information described above.

07How long we keep it

We keep information for the minimum amount of time we need it:

• Orders: 24 months from the date of the order. After that, order records are deleted. This gives us enough time to answer questions like "did I order the California Burrito or the Carne Asada Burrito?" and to comply with our own bookkeeping needs.
• Contact form submissions: 12 months from the date received, then deleted.
• Catering requests: 24 months, because catering relationships often repeat annually.
• Newsletter subscribers: until you unsubscribe, plus 30 days to process the unsubscribe and remove you from our list.
• Security logs (IP, user agent, timestamp): 90 days, then deleted.

If you ask us to delete your information, we will do so within 30 days, unless we are legally required to retain it (for example, records tied to a specific tax filing period).

08How we protect it

We take reasonable steps to protect the information we hold:

• Order and contact records are stored on our server in a directory that blocks direct web access (a .htaccess rule denies access to the /data/ folder).
• All form submissions over this site are transmitted over HTTPS (TLS), so the data cannot be read in transit.
• We don't store payment card data — card processing happens on a separate terminal that we don't control and never see the details of.
• Access to order records is limited to family members and staff who need it to prepare food and respond to customer questions.

That said, no system is perfectly secure. We are a small restaurant, not a technology company, and we can't guarantee that unauthorized access will never happen. If we ever become aware of a data breach affecting your information, we will notify affected individuals as required by Washington State law (RCW 19.255.010).

09Your rights

If you live in Washington State, you have specific rights under the Washington My Health My Data Act and other applicable laws. More broadly, we believe you should be able to control information about yourself, regardless of where you live. Here is what you can ask us to do:

• Access: request a copy of the personal information we hold about you.
• Correction: ask us to fix information that's inaccurate or out of date.
• Deletion: ask us to delete the information we hold about you.
• Portability: ask us to provide your information in a readable format.
• Withdraw consent: unsubscribe from newsletters at any time.
• Non-discrimination: we will not treat you differently or refuse service because you exercised a privacy right.

To exercise any of these rights, email [email protected] with the subject line "Privacy Request." Include your name, the email or phone number you used with us, and what you'd like us to do. We will respond within 30 days. We may ask you to verify your identity before fulfilling the request — for example, by replying from the email address on file or calling the restaurant to confirm.

10Children

This website is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has submitted information to us, please email [email protected] and we will delete it promptly.

We do not have a separate children's menu or a loyalty program, and we do not use any features designed to appeal to children on this site.

11Changes to this policy

If we make material changes to this policy — for example, if we start using a new third-party service or change how long we keep information — we will update the "Last updated" date at the top of this page and post the revised policy here. If the change significantly affects how we handle information we already hold, we will notify newsletter subscribers by email.

We recommend checking this page occasionally if you care about how your information is handled. Non-material changes (fixing typos, clarifying language) may be made without notice.

12Contact

For any privacy-related questions, requests, or concerns:

• Email: [email protected] (preferred — creates a written record)
• Phone: (509) 315-8891 — call during open hours (6:30 AM – midnight)
• Mail: Atilano's Mexican Food, 12526 W Sunset Hwy, Airway Heights, WA 99001

If you are not satisfied with our response, you have the right to contact the Washington State Attorney General's Office, Consumer Protection Division, at atg.wa.gov.