Privacy Policy – Abastos

Effective date: 21 August 2026

This Privacy Policy applies to the Abastos mobile application (Android package app.abastos), the website https://abastos.app, and related services operated by Abastos.App (“Abastos”, “we”, “us”).

Abastos is a multi-vendor marketplace for ordering products and services from local stores, including delivery and related features such as chat, wallet/loyalty, and vehicle rental where enabled.

By using Abastos, you agree to this Privacy Policy. If you do not agree, please do not use the app.

1. Who is responsible

Controller: Abastos.App, operating in Mexico.

Contact: through the in-app Help & Support section, or at https://admin.abastos.app/contact-us.

2. Information we collect

We collect information that you provide, information created when you use the app, and information from third-party services you choose to connect.

Account and profile

• Name, phone number, email address, password or login token
• Profile photo, if you upload one
• Saved delivery addresses
• Account identifiers and authentication tokens

Orders and transactions

• Order contents, special instructions, delivery notes
• Prescription or other images you upload when required (for example pharmacy orders)
• Payment method selected, order status, refunds, tips, and loyalty/wallet activity
• Chat messages and images sent to stores or delivery personnel

Location

With your permission, we collect precise or approximate location to:

• Detect your delivery zone and nearby stores
• Set and save delivery addresses
• Show maps and estimate delivery
• Share delivery location with assigned stores and delivery personnel while an order is active

You can deny or later revoke location permission in your device settings. Some features will not work without location.

Device, notifications, and diagnostics

• Device type, operating system, language, and app version
• Firebase Cloud Messaging token for push notifications
• Crash and performance logs via Firebase Crashlytics
• IP address and basic usage logs on our servers

Microphone and voice search

If you use voice search, the app may access the microphone only while that feature is active, to convert speech to text. We do not use the microphone in the background for advertising.

Camera, photos, and files

If you allow it, we access the camera or photo library so you can upload a profile picture, prescription, chat image, or registration documents (for example vendor or delivery-person applications).

Social login

If you sign in with Google (or another enabled provider), we receive the identifier, name, and email that the provider shares with us. Facebook login is available in the product but may be disabled in your configuration.

Payments

Card payments are processed by Stripe. Abastos does not store your full card number. Stripe receives the payment details needed to complete the charge, plus order and customer identifiers required to match the payment.

3. How we use information

• Create and manage your account
• Process, deliver, and support orders
• Show relevant stores, products, and delivery zones
• Process payments, refunds, loyalty points, and referrals
• Send order, account, and service notifications
• Provide in-app chat between customers, stores, and delivery personnel
• Prevent fraud, abuse, and security incidents
• Improve app stability and performance
• Comply with legal obligations

We do not sell your personal information.

4. Who we share information with

We share only what is needed to operate the service:

• Stores / vendors — order details, delivery address, and contact information needed to fulfill the order
• Delivery personnel — pickup/drop-off details and location needed to complete delivery
• Stripe — payment processing
• Google Maps / Google Play services — maps, geocoding, and location features
• Firebase (Google) — authentication (when enabled), push notifications, crash reporting
• Google Sign-In — if you choose that login method
• Hosting and infrastructure providers that store our application and database
• Authorities when required by law

These parties may process data in Mexico or other countries where they operate. We require them to protect the data according to their contracts and applicable law.

5. Data safety summary (Google Play)

Abastos may collect or share:

• Name, email, phone number
• Approximate and precise location
• Photos and user-generated content
• Purchase history and payment-related identifiers (processed by Stripe)
• Device identifiers and crash logs
• Messages you send in chat

This information is used for app functionality, account management, analytics/diagnostics, and customer support — not for selling data to data brokers.

6. Retention

We keep account and order information while your account is active and for as long as needed to provide the service, resolve disputes, prevent fraud, and meet tax or legal requirements. After you delete your account, we delete or anonymize personal data that is no longer required, except records we must keep by law.

7. Account deletion

You can delete your Abastos account from the app: Profile → Delete account. You may also request deletion through Help & Support.

When we receive a valid deletion request, we delete the account and associated personal data that is not legally required to be retained (for example completed order records needed for accounting).

8. Your choices and rights

Depending on Mexican data-protection law (including ARCO rights) and other applicable laws, you may request access, rectification, cancellation, or opposition regarding your personal data, and you may withdraw consent where processing is based on consent.

You can also:

• Update profile and addresses in the app
• Turn off location, microphone, camera, or notifications in device settings
• Sign out or delete your account

To exercise these rights, contact us through Help & Support or https://admin.abastos.app/contact-us.

9. Children

Abastos is intended for users who can form a valid contract under applicable law. We do not knowingly collect personal data from children. If you believe a child has provided personal data, contact us and we will delete it.

10. Security

We use HTTPS, access controls, and standard cloud security practices. No method of transmission or storage is 100% secure. Please keep your password confidential.

11. International transfers

Some providers (Google, Stripe, Firebase) may process data outside Mexico. By using Abastos, you understand that your information may be transferred to those countries for the purposes described in this policy.

12. Changes

We may update this Privacy Policy. The updated version will be posted at https://admin.abastos.app/privacy-policy and in the app under Privacy Policy. Continued use after the effective date means you accept the updated policy.

13. Contact

Abastos.App
Website: https://abastos.app
Privacy Policy: https://admin.abastos.app/privacy-policy
Contact: https://admin.abastos.app/contact-us