1. Information we handle
Site and administrative information
We may process product, inventory, order, shipment, expense, sales, and account information entered by an authorized administrator or received from connected services.
ACO form information
Google Forms used for ACO groups may collect names, email addresses, telephone numbers, social handles, shipping and billing addresses, product selections, and payment-card information supplied by a form respondent. This information is sensitive and should be submitted only to a form owner you trust.
2. Google user data
When an authorized administrator connects a Google account, TacoBout requests access to Google Drive and Google Forms so it can provide the ACO features selected by that administrator. Depending on the requested scopes, TacoBout may:
- identify the connected Google account by its basic account identifier and email address;
- read the structure, title, description, questions, publishing state, and responses of selected Google Forms;
- create, copy, edit, publish, open or close, and delete Google Forms used for ACO groups; and
- access the related files in Google Drive as necessary to copy or delete those Forms.
TacoBout uses this Google user data only to operate the connected ACO workflow, display responses to the authorized administrator, generate requested profile exports, and manage the administrator’s Forms. TacoBout does not use Google user data for advertising.
3. How information is used
- Operate and secure the public catalog and protected administrative tools.
- Create and manage ACO groups and Google Forms.
- Display Form responses and produce administrator-requested exports for checkout tools.
- Track inventory, purchases, sales, deliveries, and related business records.
- Diagnose failures, prevent misuse, and maintain service reliability.
4. Storage and retention
Google OAuth access and refresh tokens are stored in encrypted form. TacoBout stores configuration identifiers needed to reconnect a group with its Google Form. Google Form responses are fetched from Google when an authorized administrator opens or exports a group; TacoBout does not save those response records in its own application database. Generated export files are returned on request rather than retained as a permanent response archive by TacoBout.
The Forms and their responses remain in the connected Google account under Google’s retention controls. When an administrator deletes an ACO group through TacoBout, TacoBout is designed to delete the associated Google Form and its responses. Disconnecting Google removes TacoBout’s stored Google tokens. The account owner can also revoke access through their Google Account security settings.
5. Sharing and disclosure
We do not sell Google user data or ACO response information. Information may be processed by service providers that host or support TacoBout, by Google as the provider of Forms, Drive, and OAuth, and by checkout services chosen by the authorized administrator when that administrator exports and imports a profile. We may disclose information when required by law, to protect rights or safety, or in connection with a business transfer.
6. Google API Services User Data Policy
TacoBout’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.
7. Security
We use access controls, encrypted secret storage, HTTPS, and other reasonable safeguards. No online system is completely secure. Authorized administrators are responsible for protecting their accounts and limiting access to ACO responses and exported profiles.
8. Your choices
A connected Google account owner may disconnect Google inside TacoBout, revoke TacoBout in Google Account permissions, delete individual ACO groups, or contact us about access or deletion. Form respondents should contact the person who provided the Form because that form owner controls the Google Form and its responses.
9. Children
TacoBout’s administrative and ACO services are not directed to children under 13, and we do not knowingly collect children’s personal information through those services.
10. Updates and contact
We may update this policy as the service changes. The current version and effective date will remain posted here. Questions or privacy requests may be sent to sergio.cluster4@gmail.com.