Privacy policy

Effective September 10, 2026

PUESTO LLC (“PUESTO,” “we,” or “us”) helps people explore starting a business in the United States. This policy explains how information is handled on our website and in your communications with us.

Information you provide

The application asks for your full name, email address, US phone number, business name and registration status, what you want to sell, your experience or training, a written description of your desired unit style, and your desired city. It also records acceptance of the Terms and Conditions, including the terms version and acceptance time.

Unsubmitted answers stay in your browser. When applications are available and you click Generate unit, your answers are sent to PUESTO to save your application, create or associate an account with your email, and begin preparing your unit design. We send confirmation and account-recovery emails as needed. The initial form does not accept image uploads. In your signed-in workspace, you can upload logos and artwork, edit your unit, and save design revisions.

If you email us, we receive your email address, the contents of your message, and any attachments. Please only provide information needed for your inquiry. Do not include government identification, bank details, health records, or other sensitive personal information in the questionnaire or reference images.

How information is used

The website uses your local answers to display and save your draft, remember selections, and let you edit your answers. We use correspondence we receive to respond to inquiries, discuss a possible project, provide requested assistance, keep related business records, and address security, legal, or fraud concerns.

Submitted applications and generated files are stored on PUESTO’s infrastructure on Amazon Web Services in the United States. We use self-hosted Supabase for account identity and database storage. To generate and refine your unit, we send the business name, business description, written style preferences and any reference images you choose to use to OpenAI for planning and image generation. Some generation pipelines use fal.ai as the image-generation provider. Uploaded logos used directly are stored and applied to the design; choosing AI refinement can send selected artwork to the configured AI service. We do not add your contact name, email, phone number or chosen city to that generation prompt; please avoid including personal or sensitive information in the business and style descriptions. Transactional email providers receive the recipient address and account email contents needed to deliver confirmation and recovery messages. Hosting providers, including Vercel when it serves the frontend, handle the technical requests needed to deliver the website.

Website and map requests

When your browser requests a page or file, the server handling the request receives technical information such as your IP address, request time, requested URL, and browser information. Hosting providers may keep access and security logs to deliver and protect the website.

City-name search runs against a directory downloaded to your browser. Opening the street map connects to OpenFreeMap for map resources. This provider receives the network information needed to answer the request and may infer the area you are viewing. We do not include application answers or contact details in map requests. Selecting a city does not request your device’s precise GPS location.

These third-party services handle their own technical information under their policies. Links to other websites do not make those websites part of PUESTO.

Cookies and browser storage

We currently do not set advertising or analytics cookies. We use browser storage for the features you request:

• Draft and selections: application answers, terms acceptance, progress, the selected city, and the last displayed design are saved in browser session storage. This normally lasts for the tab’s session; browser session-restore features may retain it longer.
• Account session: an essential, protected session cookie keeps you signed in for up to 30 days. Signing out revokes it. A separate browser-session token lets the submitting tab check the progress of that application; it does not grant access to account details or generated files.
• Earlier drafts: previous versions may have saved neighborhood selections and uploaded logos or reference images locally. The current form does not upload images or delete those earlier files. Closing a tab does not immediately delete files stored in the browser’s database; you can remove them by clearing this website’s site data.

You can remove locally stored information using your browser’s controls to clear this website’s site data. This also removes saved progress. PUESTO cannot retrieve or remotely delete information that exists only in your browser.

Advertising and marketing

We may advertise PUESTO through platforms such as Google, Facebook, and Instagram, including to people outside the US interested in opening a US business. Those platforms handle activity on their own services under their own privacy policies: Google and Meta.

If you choose to submit a PUESTO lead form within an advertising platform, we receive the details you submit and information identifying the form or campaign. We use that information to respond to your request and discuss PUESTO’s services. The form should link to this policy and explain any additional use before you submit.

The current website does not load Google Analytics, Google Ads tracking, Meta Pixel, or a conversions API. If we introduce analytics, conversion measurement, or personalized advertising tools, we will update this notice and provide the required choices before activating them. We do not currently sell personal information or share it for cross-context behavioral advertising, and we do not use your local draft or images for advertising.

Providing a phone number or email in the questionnaire does not enroll you in marketing emails, automated calls, or marketing texts. If marketing messages are introduced, we will provide the notices and consent choices required for that channel and a way to stop them.

We do not currently track visitors across websites for advertising. “Do Not Track” and Global Privacy Control signals therefore do not change the current site’s behavior: that advertising collection is already off.

When information may be shared

Information you actually send to PUESTO may be handled by service providers that support our email, hosting, security, and business administration, to the extent needed for those purposes. We may disclose information when legally required, to protect rights or safety, or in connection with a business reorganization subject to appropriate protections. We do not transmit unsubmitted browser-only drafts or earlier locally stored images to those providers. Generated customer files are private and require account access. If you request a service that requires sharing project information with a contractor or another partner, we will explain that sharing before it happens.

Retention and security

Local storage follows the behavior described above. Submitted applications, account records and generated designs and saved revisions are retained to let you return to your project and to support the requested business relationship; you can request access, correction or deletion through the contact below. Expired sessions and temporary delivery credentials are removed through our maintenance process. Backups may retain deleted data until they are rotated and are used for recovery, not active account access. We keep correspondence and related records for as long as needed to respond, manage the relationship, resolve disputes, and satisfy applicable legal or recordkeeping requirements. Retention depends on the nature of the record and our obligations; it is not indefinite simply because you contacted us.

No website, device, or communication method can guarantee complete security. Protect access to the browser you use, especially on a shared device. Contact us if you believe information related to PUESTO has been exposed.

Your privacy choices

You can edit answers before submitting your draft. After submission, contact us to correct or delete the saved record. To request access to, correction of, or deletion of information PUESTO holds, email hi@puesto.ai. Depending on the law that applies to you, you may also have rights to obtain a copy, restrict or object to certain processing, withdraw consent, or opt out of particular uses.

We may need to verify that a request relates to your information, and legal exceptions may apply. We will respond within the time required by applicable law and explain any denial. You may reply to request a review of that decision and may complain to your relevant privacy regulator. We will not discriminate against you for exercising applicable privacy rights.

Visitors outside the United States

Our business offering concerns locations in the United States. If you contact PUESTO from Mexico or another country, information you send to us may be processed in the United States and in countries where our service providers operate, whose laws may differ from yours. Applicable local privacy rights still apply; visiting the website is not a waiver of those rights or consent to optional advertising tracking.

Children

PUESTO’s business application is intended for adults aged 18 or older. We do not knowingly collect personal information from children under 13. If you believe a child has sent us personal information, contact us so we can address it.

Policy changes

We will post changes on this page and update the effective date. For material changes, we will provide a prominent website notice or contact affected users where appropriate, and obtain consent where required before using information for a new purpose.

Contact PUESTO

For privacy questions or requests, email hi@puesto.ai, or write to: