Privacy Policy

Effective Date: July 16, 2026

Your privacy is important to Porto’s Bakery, Inc. and its affiliates (“Porto’s,” “we” or “us”). To help inform you, we provide this privacy policy (“Privacy Policy”) explaining our information practices and the choices you can make about the information collected by us through our website www.portosbakery.com, and the other sites (collectively, the “Sites”), mobile applications and/or other services (collectively and together with the Sites, the “Services”) owned, operated or offered by or on behalf of Porto’s.

By using the Services, you expressly consent to our collection, use, disclosure, and retention of your personal information as described in this Privacy Policy.

The Services are not directed at or intended for users outside the U.S., and any information that we collect about users will be treated in accordance with Porto’s Privacy Policy and consistent with applicable U.S. laws.

1. Notification Regarding Updates

From time to time, we may update this Privacy Policy, and the updated Privacy Policy applies to you after the effective date stated in the revised Privacy Policy. We will notify you about material changes by placing a notice on the Services or as otherwise required under applicable law. We encourage you to periodically check back and review this Privacy Policy so that you will be informed about what information we collect, how we use it, and to whom we disclose it.

2. The Information We Collect

(a) Purchasing Products

When you choose to purchase products, you may be required to provide us certain personal information. For example, when you purchase products, you may provide us your name, physical address, email address, telephone number (including mobile number), fax number, and city or state of residence. When you purchase products from us, we may also collect your payment information, billing address, date and time of a transaction, products purchased, the purchase prices, and other order or purchase related information.

(b) Information to Respond to Your Requests

You may give us personal information such as your name, email address, and any personal information you include in comments or in an attachment that you submit to us, if applicable, so we can respond to your requests, for example, when you send us questions or sign up for newsletters, event notifications and other communications.

(c) Technical Usage Information

When you visit or use our Services, we and our third-party service providers and/or business partners may collect personal information automatically sent to us by your computer, mobile, or other access device that tells us how you are using the Services, such as your computer and connection information using software tools to measure and collect session information, including your IP address, browser name and operating system, information about your internet service provider, page response times, download errors, time spent on certain pages and page interaction information (collectively referred to as “Usage Information”). We may use tracking technologies to collect Usage Information, including cookies, web beacons, clear gifs, embedded scripts, e-tags, and unique device IDs.

(d) Social Media Information

We may offer sign-in services that allow you to use third-party login credentials to access the Sites. We also may offer Services that allow you to share information with third-party social media websites such as Facebook, Instagram and X (formerly known as Twitter). When you link your account or engage with our Sites through third-party social media sites, you understand that you grant us ongoing access to certain information stored on those social media sites. The information we have access to from the third-party social media websites varies by website and is controlled by your privacy settings on that website and by your consent. By associating an account managed by a third party and authorizing us to have access to this information, you agree that we may collect, use, and store information from these websites in accordance with this Privacy Policy.

(e) Employment Information

The Porto’s Careers section of the Sites gives you the opportunity to apply for jobs with us. In doing so, you may provide personal information such as your contact information, career data (e.g., work experience, education and certifications) and other application-related information.

(f) Information from Other Sources

We may on occasion collect and combine personal information from our affiliates, our third-party service providers and partners, public databases, and other entities where permitted under applicable law. We may also collect in-store security video footage for security purposes.

3. How We Use the Information

(a) Operate, Manage, and Improve Our Services

We use the information collected to operate, manage, and improve our Services, including to (i) process your orders; (ii) administer our promotions and other offers; (iii) develop, maintain, improve, support and customize the Services and messages to you; (iv) target marketing efforts and conduct research and analysis; (v) respond to your customer service requests; and (vi) conduct any other activity relating to the operation, management, or improvement of the Services.

(b) Analyze Information

We use information about our users to analyze the Services and user behavior and prepare reports, including in connection with developing new products or Services, learning about our users, conducting research, and evaluating user engagement with the Services.

If we process any deidentified information, we will maintain such information in a deidentified form and will not reidentify such information, except in accordance with the requirements of applicable law.

(c) Prevent Fraud and Comply with Applicable Law or Policies

We use information to prevent, detect, and investigate fraud, security breaches, and potentially prohibited or illegal activities, and enforce our Terms and Conditions. We also use information to comply with, establish, assert, exercise, defend against, or enforce any legal claims, legal rights, legal obligations, legal process, government requests, or internal investigations.

(d) Communicate with You

We use your information to (i) contact you regarding your orders; (ii) contact you about products, Services, events, promotions, or other offers; (iii) respond to your inquiries and comments; (iv) comply with your stated communication preferences; and (v) provide other Services requested by you, as described at the time we collect the information from you, or to contact you for other purposes authorized by law.

(e) Serve Targeted Advertising

Like many companies, we do not monetize personal information but use personal information to serve personalized content and advertising to you, including by disclosing your personal information to our marketing and advertising partners. This use may be deemed as processing of personal information for “targeted advertising”, “sharing” of personal information for “cross-context behavioral advertising”, or a “sale” of personal information for valuable consideration under certain state-level privacy laws in the United States. Please see the “Additional Notice for Residents of Certain U.S. States” to learn more.

(f) Other Uses and Retention of Personal Information

We may use the information for marketing, recruiting and hiring, and investment analysis, to make decisions about our business, and as otherwise notified to you or with your consent in accordance with applicable law.

We retain information as long as it is reasonably necessary and relevant for carrying out the purposes described in this Privacy Policy. Additionally, we may retain some information so that we can comply with applicable law, prevent fraud, assist with investigations, resolve disputes, analyze or troubleshoot programs, enforce our Terms and Conditions, or take other actions, as permitted by applicable law.

4. Information Disclosure

We may disclose personal information with the following entities:

(a) Porto’s Corporate Family

We may disclose the information we collect about you with Porto’s corporate family and their and our affiliates and subsidiaries, including (i) to provide joint content and our Services (e.g., registration, transactions, analytics and customer support); (ii) to help detect and prevent potentially illegal acts, violations of our policies, fraud and/or data security breaches; (iii) to guide decisions about our or a third party’s business, assets, operations, rights, products, sites, applications, services, tools, and communications; and (iv) for processing and storage of information.

(b) Service Providers

We may disclose your information to service providers under contract who help with our business operations (such as, but not limited to, developing, maintaining, improving and supporting our Services, analytics, fraud investigations, bill collection, promotions and marketing, and operations).

Please note, when you watch videos on the Services, you agree that we may disclose your video viewing to or obtain information about your video viewing from analytics service providers, advertising partners, and social media platforms.

(c) Legal and Law Enforcement

We may disclose your information to law enforcement, governmental agencies, or authorized third parties in response to a verified request relating to a criminal investigation or alleged illegal activity or any other activity that may expose us, you, or any other Porto’s user to legal liability. In such events, we will only disclose information that we deem relevant and reasonably necessary to the investigation or inquiry.

(d) Change of Control

We may disclose your information to other business entities, should we plan to merge with or be acquired by that business entity, or in connection with reorganization or sale of assets, or in the event of bankruptcy or other change of control events.

(e) Other Parties

We may disclose information with other entities for additional purposes in accordance with applicable law. For example, we may disclose information as may be necessary to detect security incidents and fraudulent or illegal actions or to protect the safety, property, or other rights of us or any other individual or entity. We may also disclose information to our business partners and other third parties upon your request or at your direction.

The above excludes text messaging originator opt-in data and consent; this information will not be shared with third parties.

Cookies and Similar Tracking Technologies

When you use the Services, we and our third-party service providers and/or business partners may use tracking technologies to enhance your online experience or customize our offerings, and for other purposes described in the “How We Use the Information” section of this Privacy Policy.

A few additional important things you should know about our use of tracking technologies (e.g. cookies):

  • We offer certain features that are available only through the use of tracking technologies.

  • We use both session and persistent tracking technologies. You may be able to decline tracking technologies if your browser permits, although doing so may interfere with your use of the Services. Refer to the help section of your browser, browser extensions, or installed applications for instructions on blocking, deleting, or disabling tracking technologies such as cookies.

  • We do not currently take actions to respond to “Do Not Track” signals from browsers because a uniform technological standard has not yet been developed.

  • We and our third-party service providers may monitor visits to our Services and sessions of users; this monitoring may log the details of your visits to our Online Services and information generated in the course of using our Services, such as clicks, page visits, text entered, how long you spent on a page, and other details of your visits to or actions on our Services. We use these technologies to collect and retain usage data for the purposes described in this Privacy Policy, including for marketing and security purposes and to improve your experience with our Services. We may also share any of the data collected by these technologies with third parties for our business purposes.

6. Your Privacy Choices About Our Marketing Practices

If you do not wish to receive marketing communications from us, you can indicate your communications preference within the direct communication from us, i.e., by clicking on the unsubscribe link within the email and following the instructions to complete the unsubscribe process. You may also contact us via email at privacy@portosbakery.com, and we will assist you. You may not opt out of administrative emails (for example, emails about your transactions or policy changes).

7. Third Parties

Our Services may contain links to other third-party websites, including social media platforms and the sites of our partners. This Privacy Policy does not address, and we are not responsible for, the privacy practices or the content of these third-party sites. Your use of such third-party sites will be governed by the applicable privacy policies and terms of those sites and not by this Privacy Policy.

8. Security

We have put in place physical, electronic, and managerial procedures designed to safeguard and help protect the security of your personal information against loss, misuse, unauthorized access, disclosure, or alteration. Although we take measures to safeguard against unauthorized disclosures of information, we cannot assure you that the personal information we collect will never be disclosed in a manner that is inconsistent with this Privacy Policy. It is your responsibility to make sure that your personal information is accurate. If you believe that your login credentials have been compromised, please make sure to contact us via the contact information in the “Contact Us” section of this Privacy Policy.

9. Children’s Privacy

The Services are not intended for children under the age of 18. We do not knowingly collect personal information via our Services from users in this age group.

10. Transfer of Personal Information Outside Your Jurisdiction

Please be aware that your personal information will be transferred to, stored or processed by us or our service providers in the United States, where our servers are located and our central database is operated, or other jurisdictions where our service providers are located for the purposes set out in this Privacy Policy (including but not limited to transaction processing and fraud prevention), which may be different in the jurisdiction in which you are located.

11. Contact Us

If your questions or concerns about this Privacy Policy or how we use your personal information are not answered online, you may email us at privacy@portosbakery.com, or write to us at Porto’s Bakery, Attn: Privacy Questions, 6100 South Malt Ave, Commerce, California 90040.

12. Shopify

Some of our Services are operated by Shopify to help protect, grow, and improve our Services as well as the businesses of other Shopify merchants (“Shopify Services”). When you are using Shopify Services, Shopify will collect your personal information for various purposes, including to provide Shopify Services, which will be subject to Shopify’s Consumer Privacy Policy. Depending on your residence, you may have certain privacy rights applicable to your personal information collected and processed for Shopify Services; please select Shopify’s “Manage your data” page to learn more. When you use Shopify Services, you are directing us to disclose your personal information to Shopify as needed to provide Shopify Services, and we will provide separate notice to let you know that you are doing so.

13. Additional Notice for Residents of Certain U.S. States

If you are a resident of a state that has enacted a comprehensive privacy law that applies to us, including California, this “Additional Notice for Residents of Certain U.S. States” section applies to our processing of your personal information, and the provisions of this section prevail over any conflicting provisions in other sections of this Privacy Policy. We sell and share, and in the past 12 months have sold and shared, personal information with our marketing and advertising partners for cross-context behavioral advertising. However, we do not sell or share, and in the past 12 months have not sold or shared, personal information of individuals we know to be under 16 years of age.

Collection of Personal Information

We have collected the following categories of personal information within the last 12 months:

  • Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, or other similar identifiers.

  • “Personal information”, as described in California Civil Code Section 1798.80(e), such as a real name, postal address, telephone number, or financial information.

  • Characteristics of protected classifications under California or federal law, such as gender, disability, or veteran status.

  • Commercial information, such as products or services purchased, obtained, or considered; or other purchasing or consuming histories or tendencies.

  • Internet or other electronic network activity information, such as browsing history, search history, or information regarding your interaction with our Services.

  • Geolocation data.

  • Audio, electronic, visual, thermal, olfactory, or similar information, such as in-store security video footage recorded in accordance with applicable law.

  • Professional or employment-related information, such as work experience, professional certifications, and other similar information included in your employment application.

  • Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act.

  • Inferences drawn from other personal information.

  • Sensitive personal information, such as account log-in or financial account information in combination with security or access code or precise geolocation. We do not use or disclose sensitive personal information for purposes that, under California law, require us to support the right to limit the use or disclosure of sensitive personal information.

Please see the “The Information We Collect” section and “Cookies and Similar Tracking Technologies” section of this Privacy Policy to learn more about the types of personal information we collect. We retain each category of personal information as described in the “Other Uses and Retention of Personal Information” section of this Privacy Policy.

Use of Personal Information

We use each of the above categories of personal information for the purposes described in the “How We Use the Information” section of this Privacy Policy, including the following business purposes:

  • Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.

  • Helping to ensure security and integrity to the extent the use of your personal information is reasonably necessary and proportionate for these purposes.

  • Debugging to identify and repair errors in our systems.

  • Short-term, transient use, including contextual non-personalized advertising shown as part of your current interaction with us.

  • Providing services on our behalf or on behalf of another, including maintaining or servicing accounts, providing customer service, fulfilling transactions, verifying identity information, processing payments, and other services.

  • Conducting internal research to develop and demonstrate technology.

  • Conducting activity to verify, enhance, and maintain the quality or safety of our Services.

We do not process your personal information for profiling in furtherance of “decisions that produce legal or similarly significant effects”, as such term is defined under applicable law.

Disclosure of Personal Information

Within the last 12 months, we have disclosed each of the above categories of personal information for our business purposes to the categories of third parties as further described in the “Information Disclosure” section of the Privacy Policy.

Your Privacy Rights

You may have certain rights related to your personal information, including the following.

  • Right to Know. The right to know what personal information we have collected about you, including the categories of personal information collected; the categories of sources from which we collected your personal information; the business or commercial purpose for collecting, selling, or sharing your personal information; the categories or list of third parties to whom we disclose your personal information; and the specific pieces of personal information we have collected about you (including, if applicable, in a portable and readily usable format).

  • Right to Delete. The right to delete personal information that we have collected about you.

  • Right to Correct. The right to correct inaccurate personal information that we maintain about you.

  • Right to Opt Out. The right to opt out of the sale or sharing of your personal information.

  • Right to Nondiscrimination. The right not to receive discriminatory treatment by us for the exercise of your privacy rights under applicable law.

You may request to exercise these rights by:

As required or permitted under applicable law, we will take steps to verify your identity before acting on your request to exercise your rights. We may require you to provide your first name, last name, email address, phone number, or other data elements to verify your identity in response to exercising requests of the above types. We may limit our response to your exercise of the above rights as permitted under applicable law. When you submit a request to exercise your rights described above, we will use the information you provide to process your request and to maintain a record of your request and our response, as permitted under applicable law.

Under applicable law, you may designate an authorized agent to make a request on your behalf. You may make such a designation by providing the agent with written permission to act on your behalf. We will require the agent to provide proof of that written permission. To the extent permitted by law, we may require you to verify your own identity in response to a request, even if you choose to use an agent. If you are an authorized agent submitting a request on behalf of a California resident, please send us an email at privacy@portosbakery.com.

If your rights request is denied, you may lodge an appeal with us. The response to your rights request will inform you of any appeal rights you may have and how you may exercise them.

Notice of Financial Incentives

We may offer financial incentive programs from time to time. This Notice of Financial Incentives is required by applicable law and applies to Porto’s Bake at Home rewards program, The Baking Club (the “Program”). Please review this Notice of Financial Incentives carefully before you opt in to the Program and learn how your information is processed when you participate in the Program. We reserve the right to add financial incentives to this Notice of Financial Incentives and to terminate the Program at any time at our sole discretion.

(a) Summary of the Incentives

Your account receives points or discount coupons through qualifying purchases. Points are accumulated to get rewards that may be redeemed for discounts on future purchases. You may be granted additional rewards when you participate in events and promotional activities or for being a member, such as for your birthday.

(b) Material Terms

Users can view the Program detail at https://store.portosbakery.com/pages/rewards?srsltid=AfmBOorERK0ISAY_6_n0YOjtA0XdbAj7qFaTa6c2PQzdZRvkH2VyK6GS. The categories of personal information collected include:

  • Identifiers.

  • “Personal information”, as described in California Civil Code Section 1798.80(e).

  • Commercial Information.

  • Internet or other electronic network activity information.

  • Inferences.

We may collect additional information with your consent. We may disclose this personal information with third parties listed in the “Information Disclosure” section of the Privacy Policy. We do not disclose personal information collected in connection with the Program to data brokers. We may disclose substantially all categories of personal information above to our social media, advertising, and analytics partners. We may process and share this information for targeted advertising.

(c) How to Opt In to the Program

Register for an account online at https://store.portosbakery.com/account/register or on the Porto’s Bakery & Cafe App.

(d) Value of User Data

In our good faith calculation, we consider the value of user data collected through the Program as the equivalent of relevant expenses related to the collection and retention of user’s personal information as part of the Program. The financial incentive we offer to users through the Program is reasonably related to the value of the users’ data.

(e) Withdrawal from the Program

You have the right to withdraw from the Program at any time. Please note, withdrawing from the Program will result in the loss of earned points, unredeemed rewards, and eligibility to participate in events and promotions, and will also limit your ability to utilize the full suite of features available in the Program because we will no longer be able to associate you with any points, rewards, or other events or promotions. You may withdraw by closing your account via your profile.

Shine the Light

For the purpose of California’s “Shine the Light” law as codified in California Civil Code Section 1798.83-84, as of the effective date of this Privacy Policy, we do not share California residents’ personal information with third parties for their own direct marketing purposes.