Skip to content
Ruta

Legal

Privacy policy

Last updated: 09/22/2026

1. INTRODUCTION AND SCOPE

This Privacy Policy (the "Policy") describes how Casa Mahecha LLC ("RUTA," "the Company," "we," "us") collects, uses, shares, and protects the personal information of people who use the RUTA mobile application and website (collectively, the "Service"). This Policy is incorporated by reference into our Terms and Conditions of Use and should be read together with them. By using the Service, you acknowledge the practices described in this Policy.

This Policy applies to end Users and to Businesses that create a business profile on RUTA. Where data practices differ between the two account types, this is noted expressly.

2. INFORMATION WE COLLECT

2.1 Information you provide directly

  • Account data: first and last name, email address, phone number, password (stored encrypted), profile photo.
  • Business profile data: business name, category, description, address, hours, photos, business-verification documents (where applicable).
  • User-generated content: reviews, ratings, comments, photos, and videos you post.
  • Messages: communications you send through in-app messaging between Users and Businesses.
  • Payment information: card or bank account details you provide to our third-party payment processor to complete an In-App Transaction (RUTA does not directly store your full card number).
  • Communications with us: when you contact us for support, by email, or through forms.

2.2 Information we collect automatically

  • Location/GPS data: with your permission, we collect your precise or approximate location to show nearby businesses. You may disable location access in your device settings at any time, though this may limit certain features.
  • Usage and device data: IP address, device type, operating system, advertising identifier, language, pages viewed, features used, and date/time of access.
  • Cookies and similar technologies: we use cookies, SDKs, and local storage to keep you logged in, remember your preferences, and analyze use of the Service (see Section 6).
  • Crash and diagnostic logs: technical information that helps us identify and fix errors.

2.3 Information we receive from third parties

  • From our payment processor, confirmation of a transaction's status (not full card details).
  • If you register or log in through a third-party provider (for example, Google or Apple), we receive the basic profile information you authorize to be shared.
  • From analytics and fraud-prevention providers, signals related to use of the Service.

3. HOW WE USE YOUR INFORMATION

We use the information we collect for the following purposes:

  • Providing, operating, and maintaining the Service, including showing you relevant businesses near you.
  • Creating and managing your account and verifying your identity where applicable.
  • Processing In-App Transactions, including payments, bookings, and billing.
  • Enabling communication between Users and Businesses through in-app messaging.
  • Publishing and displaying User Content (reviews, photos, ratings) under the license granted in the Terms and Conditions.
  • Personalizing your experience and showing you relevant search results.
  • Sending operational communications (confirmations, security notices, changes to these terms) and, with your consent, marketing communications.
  • Detecting, investigating, and preventing fraud, abuse, unlawful activity, and violations of our Terms.
  • Complying with legal, accounting, and regulatory obligations.
  • Analyzing Service usage in aggregate or de-identified form to improve our products.

4. HOW WE SHARE YOUR INFORMATION

We do not sell your personal information in exchange for monetary consideration. We share personal information only in the following circumstances:

4.1 With listed Businesses

When you contact, message, leave a review for, or complete an In-App Transaction with a Business, we share with that Business the information necessary to complete that interaction (for example, your name, contact information, and request details). The Business becomes an independent controller of that information under its own policies.

4.2 With service providers (processors)

We share information with third parties that perform services on our behalf, under contractual confidentiality and limited-use obligations, including: payment processing (e.g., Stripe), cloud hosting (e.g., AWS, Google Cloud, or Firebase), analytics (e.g., Google Analytics/Firebase Analytics), email and SMS delivery (e.g., Twilio, SendGrid), customer support, and fraud prevention.

4.3 For legal and safety reasons

We may disclose information when reasonably necessary to: comply with the law, a court order, or legal process; protect the safety of our users, employees, or the public; detect and prevent fraud or unlawful activity; or enforce our Terms and Conditions.

4.4 Business transfers

In connection with a merger, acquisition, reorganization, bankruptcy, or sale of all or part of our assets, personal information may be transferred as part of that transaction, subject to the commitments of this Policy.

4.5 With your consent

We may share your information with additional third parties when you expressly authorize us to do so.

5. YOUR PRIVACY RIGHTS

5.1 General rights

Depending on where you live, you may have the right to: (a) confirm whether we process your personal information and access it; (b) request correction of inaccurate information; (c) request deletion of your personal information; (d) obtain a portable copy of your information; (e) opt out of the "sale" or "sharing" of your personal information and of "targeted advertising"; (f) opt out of automated decision-making with legal or similarly significant effects; and (g) not be discriminated against for exercising these rights.

5.2 Applicable U.S. state laws

These rights derive from laws such as the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), the Colorado Privacy Act (CPA), the Connecticut Data Privacy Act (CTDPA), the Virginia Consumer Data Protection Act (VCDPA), the Texas Data Privacy and Security Act (TDPSA), the Oregon Consumer Privacy Act (OCPA), and similar laws in effect in other U.S. states as of the date of this Policy. The exact scope of your rights depends on your state of residence.

5.3 How to exercise your rights

You may exercise your rights: (a) through the privacy settings within the app; or (b) by sending a request to info@tueresruta.com. We will verify your identity before processing your request. We will respond within the timeframes required by applicable law (generally 45 days, with a possible 45-day extension). You may designate an authorized agent to submit a request on your behalf, subject to verification.

5.4 Global Privacy Control (GPC)

Where required by applicable law, we will honor Global Privacy Control (GPC) browser signals as a valid opt-out request for the sale/sharing of personal information for the browser sending the signal.

6. COOKIES AND TRACKING TECHNOLOGIES

We use cookies, mobile device identifiers (such as the advertising identifier), web beacons, and local storage to: keep you logged in; remember your language preferences; measure the Service's performance and usage; and, where applicable, personalize marketing communications. You can manage cookies and tracking permissions through your browser or device settings. Disabling certain cookies may affect the Service's functionality.

7. DATA RETENTION

We retain your personal information for as long as reasonably necessary to fulfill the purposes described in this Policy, including keeping your account active, complying with legal, accounting, and audit obligations, and resolving disputes. Once no longer necessary, we will securely delete or de-identify your information, unless a longer retention period is required by law.

8. DATA SECURITY

We implement reasonable technical, administrative, and physical security measures, including encryption of data in transit (TLS/SSL), role-based access controls, secure authentication, and system monitoring, designed to protect your personal information against unauthorized access, alteration, disclosure, or destruction. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. CHILDREN'S PRIVACY

The Service is intended solely for individuals 18 years of age or older. We do not knowingly collect personal information from individuals under 18, consistent with the Children's Online Privacy Protection Act (COPPA). If you believe a minor has provided us with personal information, please contact us at info@tueresruta.com so we can promptly delete it.

10. INTERNATIONAL DATA TRANSFERS

Your information may be stored and processed on servers located in the United States or in other countries where our service providers operate. By using the Service, you acknowledge that your information may be transferred to jurisdictions with data protection laws that differ from those of your country of residence. We implement reasonable contractual safeguards with our providers to protect your information in connection with such transfers.

11. THIRD-PARTY LINKS AND SERVICES

The Service may contain links to third-party websites or services (including listed Businesses' own sites) that maintain their own, independent privacy policies. We are not responsible for the privacy practices of such third parties, and we encourage you to review their policies before providing them with personal information.

12. PUSH NOTIFICATIONS AND MARKETING COMMUNICATIONS

With your authorization, we may send you push notifications, emails, or text messages (SMS) for operational or marketing purposes. You may disable push notifications through your device settings and opt out of marketing communications at any time by following the opt-out link included in each communication or through your account settings, consistent with the Telephone Consumer Protection Act (TCPA) and the CAN-SPAM Act.

13. CHANGES TO THIS POLICY

We may update this Policy from time to time to reflect changes in our practices or in applicable law. We will notify you of material changes through an in-app notice or by email at least 15 days before they take effect, unless a different period is required by law. The "Last updated" date at the top of this document indicates the current version.

14. LANGUAGE OF THIS DOCUMENT

This Policy is provided in English and Spanish as a courtesy to our bilingual community. In the event of any discrepancy or conflict in interpretation between the two versions, the English version will control for legal purposes, unless applicable law provides otherwise.

15. CONTACT US

If you have questions, concerns, or wish to exercise your privacy rights, contact us at: