Privacy Policy

Last updated: September 30, 2026

This is an English translation provided for convenience. If there is any difference between the two versions, the Spanish version prevails.

1. Who we are

Don Pupusas is a service of ENLAZADEV, SOCIEDAD POR ACCIONES SIMPLIFICADA DE CAPITAL VARIABLE (EnlazaDev, S.A.S. de C.V.), a company incorporated in El Salvador, which is responsible for processing the personal data described in this policy.

The service lets a pupusería receive orders from its customers. Each business has its own link: the customer opens it, puts together an order, and the order reaches the business. This policy explains what data we process when that happens.

2. What data we collect

When you place an order with a business, we collect:

• Your name and phone number. The phone number is requested so the business can update you about your order —or find you, if it is a delivery—. It is not used to send you advertising.
• Your delivery address or location, only if you choose delivery. Sharing your location is optional: it is sent only if you tap the button and grant the permission on your phone, and you can remove it before confirming. If you prefer, you can simply type the address. If the business charges delivery by distance, we use your location at that moment to calculate the delivery cost and show it to you before you confirm; if you do not confirm the order, we do not store it.
• The content of your order (what you ordered, how many, and instructions such as "extra salsa") and the history of your orders with that business.
• If the business offers it and you choose to pay with bitcoin: the payment code we show you (a Lightning invoice), the amount in dollars and in satoshis, the exchange rate used, and the proof of payment. We do not receive or hold your money, nor any data about your wallet: the payment goes straight to the business's wallet, which is who receives it.

We do not request or store card details, passwords or wallet keys. You do not need to create an account.

3. What we use your data for

• Taking, preparing and delivering your order.
• Calculating the delivery cost, when the business charges it by distance.
• Updating you on its progress (received, being prepared, ready, on the way, delivered).
• Allowing the business or the delivery person to contact you if needed.
• Allowing the business to see its own sales history.
• If you pay with bitcoin, confirming that the payment arrived. The order reaches the business once the payment is confirmed; if it is not paid within 30 minutes, it is cancelled automatically.

4. Why we can process it

Because it is necessary to provide the service you requested when placing your order. We do not send advertising without your consent.

5. Who we share it with

• With the pupusería you order from: without it, they cannot prepare your order.
• With the delivery person, if it is a delivery (your name and the delivery address).

If you pay with bitcoin, our server requests the payment code from the business's wallet (for example, Blink) and periodically asks it whether it has been paid, until it is paid or expires; and it checks the bitcoin price on mempool.space. Your name, phone number and address are not included in those requests: only the order amount. You pay from your own wallet, which has its own terms.

Each business can only access its own orders. A business cannot see another business's data or customers. We do not sell your data.

6. Cookies and data on your phone

• If you choose a language (Spanish or English), we remember it in a cookie named lang for one year.
• When you confirm an order, we save the link to that order in your browser, so you can see it again even if you close the page.
• Businesses and their staff use a session cookie to keep their panel signed in.

We do not use advertising or analytics cookies, and we do not track your browsing on other sites.

7. How long we keep it

For as long as needed to operate the service. Even if you ask us to delete your data from active use, we may keep what the law of El Salvador requires —for example, sales records for accounting and tax purposes— for the period set by law. That information is used only for those purposes or at the request of the authorities, and is deleted when that period ends.

8. Security

Encrypted connections (HTTPS), restricted access, and each business's data kept separate from the others at the database level.

9. Your rights

You can ask to access, correct or delete your personal data. Write to us at soporte@donpupusas.com or see the data deletion page.

10. Minors

The service is not intended for minors. We do not knowingly collect data from minors.

11. Changes to this policy

If we update it, we publish the current version on this same page with its date.

12. Contact

Questions about your privacy? Write to us at soporte@donpupusas.com.