Privacy Policy
Last Updated: August 31, 2026
1. Introduction and Scope
Two Step Holdings, LLC, doing business as Two Step Taqueria ("Two Step," "we," "us," or "our"), respects your privacy. This Privacy Policy describes the personal information we collect, how we collect and use it, when we disclose it, and the choices and rights you may have.
This Privacy Policy applies when you:
visit our website at twosteptaqueria.com (the "Site");
use the Two Step Taqueria mobile application (the "App");
place an order or submit a catering inquiry;
create or use a guest account;
participate in Two Step Rewards, promotions or offers;
join our email or text-message lists;
communicate with us by email, text, phone, social media or forms available through our Site or App; or
otherwise interact with us where this Privacy Policy is posted or referenced.
The Site and App are collectively referred to as the "Services."
2. Information We Collect
"Personal information" means information that identifies you or could reasonably be associated with you. Depending on how you interact with Two Step, we may collect the following:
Contact and profile information. Your name, email address, telephone number, postal or delivery address, birthday if you choose to provide it, and other information associated with your guest profile.
Account information. Information used to establish and maintain a guest account, such as login credentials, account identifiers and account preferences.
Order and catering information. Your order history, items ordered, transaction amounts, pickup or delivery details, catering requests and information, and special instructions you provide.
Dietary and dining preferences. Dietary preferences, allergen information or dietary restrictions that you choose to provide. Some of this information may be treated as sensitive personal information under applicable law.
Rewards and promotional information. Information relating to your participation in Two Step Rewards, offers, promotions, gift cards and similar programs, including rewards balances and redemptions where applicable.
Payment information. Payments are processed by third-party payment processors. Two Step does not store your full payment card number. We may receive limited transaction information, such as card type, the last four digits of a payment card and confirmation of payment, as necessary to fulfill and support transactions.
Communications. Information contained in messages you send us, your communication preferences and information about your interactions with communications we send.
Device and usage information. Information about the device, browser or operating system you use to access the Services, IP address, dates and times of visits, referring and exit pages, pages viewed, searches, navigation patterns and other interactions with the Services.
Our technology providers may also use session-replay or similar technologies that record interactions such as clicks, scrolling and form navigation to help diagnose technical issues and improve the Services.
General location information. General geographic information, such as city or region, that may be inferred from your IP address.
Preferences and inferences. Preferences or inferences developed from your orders and activity, such as menu preferences or visit patterns, which may be used to personalize our Services and communications.
3. How We Collect Information
We collect personal information:
Directly from you, such as when you place an order, create an account, submit a catering request, join our rewards program, sign up for email or text communications, participate in a promotion, complete a form or contact us.
Automatically, through cookies, pixels and similar technologies when you use our Site or App.
From service providers and platforms we use, such as our website and ordering technology provider, point-of-sale system, payment processors, delivery providers, marketing providers and analytics services.
4. How We Use Personal Information
We use personal information to:
provide and operate the Services;
process, fulfill and communicate with you about orders;
respond to catering inquiries and fulfill catering orders;
create and maintain guest accounts;
administer rewards, offers, promotions and gift cards;
provide customer service and respond to questions or requests;
send transactional communications, such as order confirmations and delivery updates;
send marketing and promotional communications when permitted;
personalize the Services, communications and offers;
analyze use of our Site, App and other services;
improve our menu, technology, marketing and guest experience;
measure the effectiveness of advertising and communications;
prevent fraud, unauthorized transactions and misuse;
protect the security of our Services, guests and business;
comply with legal, tax, accounting and regulatory requirements; and
enforce our terms, policies and agreements.
We may also use information for another purpose disclosed to you at the time of collection or with your consent where required.
5. Email and Text Messages
Marketing Emails
If you sign up for marketing emails, we may send you information about Two Step menu items, offers, events, promotions and news.
You can unsubscribe at any time using the unsubscribe link included in our marketing emails. We may still send transactional communications relating to orders or other requests you initiate.
Marketing Text Messages
If you opt in to receive marketing text messages from Two Step, we may send recurring promotional messages using automated technology.
Consent to receive marketing text messages is not a condition of purchase. Message frequency varies. Message and data rates may apply. Reply STOP to unsubscribe or HELP for assistance.
Transactional Text Messages
We may separately send informational text messages relating to transactions or requests you initiate, such as order confirmations, pickup notifications, order-status updates or delivery information.
Mobile Information and Consent
Mobile information will not be sold or shared with unaffiliated third parties for their own marketing or promotional purposes.
Text-message originator opt-in data and consent will not be shared with third parties for their own marketing or promotional purposes. Service providers that assist us in delivering messages may process this information on our behalf solely as necessary to provide those services.
We maintain records of phone numbers and opt-in and opt-out requests as reasonably necessary to operate our messaging programs and honor customer preferences.
6. How We Disclose Personal Information
We may disclose personal information to the following categories of recipients:
Popmenu. Our Site, App, menus, ordering tools and other technology features may be powered by Popmenu. When you use or submit information through Popmenu-powered Services, Popmenu processes personal information on our behalf to provide those services.
Popmenu may also collect and use certain information independently for purposes described in its own privacy policy, including operating, evaluating and improving its services, developing new services and analyzing restaurant-industry trends. Popmenu's independent privacy practices are governed by its own privacy policy.
Payment processors. Payment information is collected and processed by third-party payment providers when you make a purchase.
Delivery providers. If you choose delivery, information necessary to complete the delivery, such as your name, phone number, delivery address and order details, may be provided to the applicable delivery provider.
Service providers. We may disclose information to vendors that provide services such as website hosting, point-of-sale technology, communications, analytics, marketing, advertising, customer support and business operations.
Legal and safety purposes. We may disclose information when we reasonably believe it is necessary to comply with applicable law, regulation, legal process or governmental request; enforce our terms or policies; prevent fraud or misuse; or protect the rights, property or safety of Two Step, our guests, employees or others.
Business transactions. Information may be transferred in connection with a merger, financing, acquisition, reorganization, sale of assets or similar business transaction.
Text-message opt-in data and consent are excluded from disclosures to third parties for their own marketing or promotional purposes as described in Section 5.
7. Cookies, Analytics and Advertising Technologies
The Services use cookies and similar technologies to operate, remember preferences, understand how the Services are used and measure performance.
These technologies may include:
Essential and functional technologies, which support Site and App functionality, maintain sessions and remember preferences.
Analytics technologies, which help us and our service providers understand use and performance of the Services. Popmenu's platform may use services such as Google Analytics, Snowplow and FullStory, including session-replay technology used to understand interactions with the Services, diagnose issues and improve functionality.
Advertising and measurement technologies, such as pixels and similar tools, which may be used to measure marketing effectiveness and provide or measure advertising.
Depending on applicable state law, some uses of advertising technologies may be considered "targeted advertising," "sharing" or a "sale" of personal information even when personal information is not exchanged for money.
Most browsers allow you to erase or block cookies or notify you when a cookie is being set. Some Services may not function properly if certain cookies are disabled.
Where required by law and where applicable to our practices, you may have additional rights to opt out of certain targeted advertising, sale or sharing activities.
8. The Two Step Taqueria Mobile App
This Privacy Policy applies to the Two Step Taqueria App, including versions made available through the Apple App Store and Google Play.
The App is powered in part by the Popmenu platform and may use the same ordering, account, analytics and other technologies described elsewhere in this Privacy Policy.
Device Permissions
The App may request permission to access device functions necessary to provide particular features, such as notifications.
You can grant or revoke permissions through your mobile device settings. Some App functionality may be limited if you decline or revoke a permission needed for that feature.
App Usage and Analytics
When you use the App, information may be collected about your device and use of the App, including device model and identifiers, operating system information, user settings, App interactions and technical performance.
The App may also transmit crash reports and similar diagnostic information to help identify technical problems and improve performance.
Analytics services used in connection with the App may include Google Analytics, Snowplow and FullStory. FullStory or similar technology may record interactions with portions of the in-App experience as described in Section 7.
Account Deletion
If you create an account through the App, you may initiate deletion of your account from within the App using the account-deletion feature provided in your profile or account settings.
You may also submit an account and associated data deletion request through the account-deletion resource provided on the Two Step Taqueria website.
When an account is deleted, personal information associated with the account will be deleted or deidentified except for information we or our service providers are permitted or required to retain for legitimate purposes such as legal, tax, accounting, security, fraud-prevention or transaction-record requirements.
9. Third-Party Platforms and Services
You may interact with Two Step through third-party services, including delivery marketplaces, social media platforms, payment services and the Apple App Store or Google Play.
Third parties maintain their own privacy policies and practices. This Privacy Policy does not govern information that you provide directly to a third party or information a third party independently collects or processes.
We encourage you to review the privacy policies of third-party services you use.
10. Data Retention
We retain personal information for as long as reasonably necessary for the purposes described in this Privacy Policy unless a longer retention period is required or permitted by law.
Factors used to determine retention periods may include:
the duration of our relationship with you;
whether your guest account remains active;
whether you remain subscribed to communications;
whether information is needed to provide or support the Services;
business, transaction and customer-service recordkeeping needs;
fraud-prevention and security requirements; and
legal, tax, accounting and audit obligations.
When personal information is no longer reasonably needed, we may delete, deidentify or aggregate it in accordance with applicable law.
11. Your Choices and Privacy Rights
You can unsubscribe from marketing emails using the link included in those messages and unsubscribe from marketing text messages by replying STOP.
You can manage certain App permissions and notifications through your mobile device settings.
Depending on where you live and subject to applicable law, you may also have rights regarding your personal information, including the right to:
confirm whether we process your personal information;
access personal information we maintain about you;
correct inaccurate personal information;
request deletion of personal information;
obtain a portable copy of certain personal information;
opt out of certain targeted advertising, sale, sharing or profiling activities;
withdraw consent for certain processing where applicable; and
exercise your rights without receiving discriminatory treatment.
To submit a privacy request, email howdy@twosteptaqueria.com and describe the right you would like to exercise.
We may need to verify your identity before completing certain requests. We will respond within the period required by applicable law.
Where applicable law provides a right to appeal a decision regarding your privacy request, you may appeal by replying to our decision and stating that you would like to appeal.
12. Children's Privacy
The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13.
If we learn that we have collected personal information from a child under 13, we will take reasonable steps to delete it.
If you believe a child under 13 has provided us with personal information, please contact us at howdy@twosteptaqueria.com.
13. Security
We and our service providers use reasonable administrative, physical and technical safeguards designed to protect personal information from unauthorized access, disclosure, alteration or destruction.
No method of electronic transmission or storage can be guaranteed to be completely secure, however, and we cannot guarantee absolute security.
Please protect your account credentials and notify us if you believe your account has been accessed or used without authorization.
14. Changes to This Privacy Policy
We may update this Privacy Policy periodically to reflect changes in our Services, technology, business practices or applicable law.
When we update the policy, we will post the revised version on this page and update the "Last Updated" date above. If required by applicable law, we will provide additional notice of material changes.
15. Account & Data Requests
If you have a Two Step Taqueria account and would like to delete your account and associated personal information, you may submit a request by emailing tstglks@twosteptaqueria.com.
Please use the subject line Account Deletion Request and include the email address and/or phone number associated with your Two Step Taqueria account so we can identify your account and process your request.
When your account is deleted, personal information associated with the account will be deleted or deidentified, except for information that Two Step Taqueria or our service providers may need to retain for legitimate purposes such as transaction records, legal or tax requirements, fraud prevention, security, or other purposes permitted by law.
You may also initiate account deletion from within the Two Step Taqueria mobile app through the account deletion option in your profile or account settings.
You may use the same email address to submit other privacy-related requests, including requests to access, correct, or delete personal information.
16. Contact Us
If you have questions about this Privacy Policy, our privacy practices or your personal information, please contact:
Two Step Holdings, LLC
d/b/a Two Step Taqueria
Austin, Texas
tstglks@twosteptaqueria.com
twosteptaqueria.com