Privacy Policy

1. Introduction and Scope

This Privacy Policy ("Policy") describes how cacao.tax, LLC ("cacao.tax," "we," "us," or "our"), a Texas limited liability company, collects, uses, stores, and discloses personal information obtained in connection with all services rendered by cacao.tax, whether provided in person at our service location or through the cacao.tax mobile application (the "App"). For purposes of this Policy, "Services" refers collectively to all service offerings of cacao.tax, as described in Section 2 below.

This Policy applies to all clients and users of cacao.tax's Services, including international travelers who engage cacao.tax in connection with Texas Sales and Use Tax export refund matters. cacao.tax's business operations, data storage, and data processing are based in the United States and are subject to United States law. If you engage the Services from outside the United States, your personal information will be transferred to, stored, and processed in the United States.

By engaging any of cacao.tax's Services, whether in person or through the App, you acknowledge that you have read and understood this Policy and consent to the information practices described herein. If you do not agree to this Policy, you must not use the App or engage the Services.

For questions about this Policy or your personal information, please contact: privacy@cacao.tax.

2. cacao.tax Services, Overview and Separation of Services

cacao.tax provides Texas Sales and Use Tax export refund services through two distinct and separately rendered channels. Each service is independent in nature, scope, and the manner in which it is performed. Engagement of one service does not constitute or imply engagement of any other.

2.1 In-Location Services, Performed Exclusively at the cacao.tax Service Location

The following services are rendered exclusively in person at the cacao.tax service location at 11801 Domain Dr, 3rd Floor, Austin, Texas 78758. These services require the simultaneous physical presence of both the client and a Texas-licensed customs broker or a duly authorized employee of a Texas-licensed customs broker. They cannot be performed remotely, electronically, or through the App under any circumstances.

In-location services include:

• Physical Merchandise and Documentation Verification: The in-person examination and verification of tangible personal property and all supporting purchase documentation to confirm that the merchandise is in new and unused condition and qualifies for export exemption from Texas Sales and Use Tax under applicable law.
• Issuance of the Texas Sales Tax Exemption Export Certificate: Following a successful physical verification of merchandise and documentation, the Texas-licensed customs broker or authorized customs broker employee prepares and executes Texas Form 00-363 (Texas Sales Tax Exemption Certificate for Export). Pursuant to applicable Texas law and regulation, the issuance of this certificate requires the physical, in-person co-presence of the client and the licensed customs broker or authorized employee at the time of verification. This requirement is mandatory under Texas law and regulation and admits of no exception. The certificate is the foundational legal instrument upon which all downstream refund claims are based.
• Execution of the Limited Power of Attorney and Assignment of Rights: The in-person execution by the client of the Limited Power of Attorney and Assignment of Rights, by which the client irrevocably assigns to cacao.tax , as full and complete owner, all rights, title, and interest in and to the applicable tax refund claims, vesting cacao.tax with the right to pursue, collect, and enforce those claims, including through litigation before any court or tribunal in Texas or the United States, with the full authority of an owner as if cacao.tax had stepped into the client's shoes as the original purchaser and rights-holder.
• Submission of Refund Claims: On the basis of the executed Sales Tax Exemption Export Certificate and the POA, cacao.tax pursues the collection of applicable Sales and Use Tax refunds from Texas retailers and/or the Texas Comptroller of Public Accounts, acting in its own name as assignee.

2.2 Mobile App Services, Ancillary Digital Services

The following services are provided through the cacao.tax mobile application and are ancillary and supplementary to the in-location services. App-based services do not substitute for, replicate, or satisfy any requirement of the in-location services described in Section 2.1.

App-based services include:

• SEED Request Service: An internal informational evaluation conducted by cacao.tax based on receipt documentation and client information submitted through the App. A SEED (Systematic Eligibility & Evaluation Determination) Request generates a non-binding assessment of the potential scope of a refund claim. It does not constitute document or merchandise verification, does not produce an export certificate, and does not confer any legal rights or refund entitlements.
• Refund Status Tracking: A digital interface through which clients who have completed the in-location process and received a Sales Tax Exemption Export Certificate may monitor the progress and status of their pending refund claims.
• Payment Receipt and Fund Management: A secure digital interface through which clients may access and transfer their allocated share of refund proceeds that have been collected by cacao.tax following the completion of in-location services and the execution of the Power of Attorney.

3. Personal Information We Collect

cacao.tax collects only the categories of personal information that are strictly necessary to provide the applicable Services. The categories of information collected vary depending on whether the information is obtained in connection with in-location services, App-based services, or both.

3.1 Information Collected in Connection with In-Location Services

Identity and Travel Documentation:

• Full legal name as it appears on the client's passport
• Passport number, country of issuance, and passport expiration date
• Photographs or certified copies of passport pages, where required for verification
• Country of residence and foreign home address
• Visa information or foreign voter registration picture identification, where applicable under Texas law
• Departure port or airport, flight or carrier information, and scheduled departure date and time

Purchase and Merchandise Information:

• Original purchase receipts, including merchant name, transaction date, itemized description of merchandise, quantities, and amounts paid in United States Dollars
• Description, quantity, and condition of the merchandise presented for verification
• Foreign country of destination to which the merchandise will be exported

Legal and Authorization Documentation:

• The executed Limited Power of Attorney and Assignment of Rights, including all information contained therein
• Client signature, date of execution, and related attestations

3.2 Information Collected in Connection with App-Based Services

Account and Contact Information:

• Full legal name
• Email address
• Phone number
• Mailing address
• Username and password created during account registration

Travel and Eligibility Information:

• Country or jurisdiction of residence
• Travel dates relevant to a SEED Request or refund eligibility evaluation
• Port of entry or departure information, where relevant to export eligibility

Purchase and Receipt Information:

• Photographs or digital files of purchase receipts submitted through the App, including merchant name, transaction date, items purchased, quantities, and amounts paid in United States Dollars
• Digital receipt data submitted through secure, delegated account integrations, where the client elects to use that feature (see Section 3.4)

Payment and Banking Information:

• Bank account number, routing number, or payment processor credentials provided by the client for the receipt of refund disbursements

Profile Information:

• Optional profile photograph, subject to the limited operational license described in the applicable Terms and Conditions

3.3 Information Collected Automatically Through the App

When you use the App, cacao.tax may collect certain technical information automatically for purposes of App functionality, security, and service improvement, including:

• Device identifiers, including device model and operating system version
• App usage data, including features accessed and session duration
• Log data, including error reports and crash diagnostics
• IP address, used for general geographic context and security and fraud-prevention purposes

3.4 Digital Receipt Account Integrations

The App includes an optional feature allowing clients to submit digital receipts obtained from retailers in connection with SEED Requests or refund tracking. To use this feature, clients may connect existing digital retail accounts to the App through secure, OAuth-based delegated authorization integrations or by uploading digital receipt files directly. Any third-party account connections are made through secure authorization frameworks that permit cacao.tax to retrieve only the specific receipt data necessary to provide the Services, without accessing unrelated account content. By connecting an account, you represent that you are the rightful owner or an authorized user of that account and that you have the right to authorize the retrieval of receipt data for the purposes of these Services.

4. How We Use Your Information

cacao.tax uses personal information solely to render each of the Services in accordance with applicable Texas law and regulation and to fulfill the legal and operational obligations arising from those Services. This includes the delivery of in-location and App-based services, the administration of refund claims and disbursements, compliance with applicable recordkeeping and regulatory requirements, and the security and integrity of the Services and client accounts. Personal information is not used for any purpose outside the scope of the Services or the legal obligations connected to them.

5. Receipt and Document Processing

Purchase receipts and identity documents submitted through the App may be processed using optical character recognition (OCR) or functionally equivalent document-processing technology to extract information necessary to evaluate a SEED Request or support refund tracking. Such processing may be performed by cacao.tax directly or by vetted third-party service providers operating under written confidentiality and data-processing obligations.

Automated document-processing technology may on occasion produce inaccurate, incomplete, or misread results. Clients are responsible for reviewing all processed information for accuracy and for reporting discrepancies through the in-app correction feature or by contacting support@cacao.tax.

cacao.tax does not extract or retain payment card numbers or bank account numbers from receipt images. Where receipt images incidentally contain payment card data, such data is not processed or stored.

Passport information and government-issued identity documentation, collected exclusively in connection with in-location services, are handled under heightened confidentiality and security controls, are stored in encrypted form, and are accessible only to personnel with a documented, legitimate operational need. Such documentation is retained only for the period necessary to fulfill the purposes for which it was collected or as required by applicable law, and is securely destroyed thereafter.

6. Mobile App, Device Permissions

The App may request access to your device's camera and photo library to allow you to photograph and submit purchase receipts and identity documents in connection with the App-based services. Camera and photo library access are optional. Denial of such permissions will not prevent access to other App features.

If you deny camera access, the App will not redirect you to the device Settings application. The App will instead display an informational message advising that the camera feature is unavailable and describing how you may optionally enable it through your device Settings at your discretion. Any in-App message displayed prior to a system permission prompt will present neutral button labels, such as "Continue" or "Next." The App does not use directive or coercive button language in connection with permission requests.

Images captured or uploaded through the App are processed solely in connection with receipt and document analysis for the Services and are not used for any other purpose.

7. Disclosure of Personal Information

cacao.tax does not sell personal information. cacao.tax does not disclose personal information to third parties for advertising, marketing, or any commercial purpose unrelated to the Services.

cacao.tax may share personal information in the following limited circumstances:

7.1 Licensed Customs Brokers and Authorized Personnel

In connection with in-location services, client personal information, identity documentation, and merchandise information are disclosed to the Texas-licensed customs broker performing the verification and certification services, and to duly authorized employees of that customs broker, to the extent necessary to perform those services. Such disclosure is an operational requirement of Texas law and the Services and is made under applicable professional and confidentiality obligations.

7.2 Third-Party Service Providers

cacao.tax engages third-party vendors and service providers to support the delivery of the Services, including providers of cloud infrastructure and data hosting, document processing and OCR services, payment processing, identity verification, fraud detection, customer support platforms, and App diagnostics. Service providers are contractually permitted to process personal information only as necessary to perform services on cacao.tax's behalf and are required to maintain appropriate confidentiality and security standards.

Current categories of service providers include:

• Cloud infrastructure and hosting providers
• Payment processors
• Document and OCR processing vendors
• App diagnostics and crash-reporting services

7.3 Government and Regulatory Authorities

In connection with the pursuit of tax refund claims, cacao.tax may submit client information and documentation, including identity verification information, receipt data, and executed certificates, to Texas retailers, the Texas Comptroller of Public Accounts, and other governmental or regulatory authorities, as required by law or as necessary to collect the applicable refunds pursuant to the executed Power of Attorney.

7.4 Legal Process and Protection

cacao.tax may disclose personal information where required to comply with applicable law, regulation, court order, legal process, or enforceable governmental request; to enforce its Terms and Conditions or agreements with clients; to detect, investigate, or address fraud or security incidents; or to protect the rights, property, or safety of cacao.tax, its clients, or the public.

7.5 Business Transfers

In the event of a merger, acquisition, corporate reorganization, or sale of all or substantially all of the assets of cacao.tax, personal information may be transferred as part of that transaction. cacao.tax will provide notice of any such transfer and any material changes to information practices through the App or by email prior to the transfer taking effect.

7.6 With Client Consent

cacao.tax may share personal information for other purposes where the client has provided specific, prior, informed consent.

8. Location Data

The App does not employ background location tracking, geofencing, persistent location monitoring, or movement tracking of any kind. cacao.tax does not derive frequently visited locations from client data, and does not send location-triggered communications.

IP address data may be collected through the App for general geographic context at the country level and for security and fraud-prevention purposes. This does not constitute precise geolocation data and is not used for advertising or behavioral profiling.

Should any future version of the App introduce location-based features, this Policy will be updated and explicit client consent will be obtained prior to activation of any such feature.

9. Cookies and Tracking Technologies

The App is a native iOS mobile application and does not use browser cookies. To the extent cacao.tax maintains a web-based interface in connection with the Services, limited session cookies may be used for authentication and security purposes only. cacao.tax does not deploy persistent tracking cookies or pixel tags on any web interface associated with the Services.

10. Information Security

cacao.tax implements technical, administrative, and physical safeguards appropriate to the sensitivity of the personal information processed, designed to protect against unauthorized access, disclosure, alteration, loss, or destruction. These safeguards include:

• Encryption of personal information in transit using industry-standard TLS protocols;
• Encryption of personal information at rest, including identity documentation, passport data, and financial information;
• Role-based access controls restricting personal information access to personnel with a documented, legitimate operational need;
• Secure account authentication mechanisms, including password protection and optional multi-factor authentication; and
• Periodic review, testing, and assessment of security practices and controls.

No method of data transmission or electronic storage is absolutely secure. While cacao.tax employs reasonable and appropriate security measures, it cannot guarantee the absolute security of personal information. In the event of a data security incident that triggers notification obligations under applicable law, cacao.tax will notify affected clients and relevant regulatory authorities as required and within the timeframes prescribed by law.

11. Data Retention

cacao.tax retains personal information only for as long as necessary to fulfill the purposes for which it was collected, to deliver the Services, and to comply with applicable legal, regulatory, and tax recordkeeping obligations.

Applicable retention guidelines:

• Account and contact information is retained for the duration of an active account and for a reasonable period thereafter to comply with legal obligations or resolve pending disputes.
• Receipt submissions, merchandise verification records, and SEED Request data are retained for the period necessary to complete the relevant evaluation or refund claim and to satisfy applicable Texas and federal tax recordkeeping requirements.
• Identity documentation, including passport copies and verification records collected in connection with in-location services, is retained for the period necessary to complete the identity verification and export eligibility assessment for which it was collected, and is securely destroyed promptly thereafter, unless a longer retention period is required by law.
• Executed Power of Attorney documents and related legal instruments are retained for such period as may be required by applicable law or necessary to enforce or defend claims arising under those instruments.
• Payment and transaction records are retained for such periods as required by applicable financial, tax, and legal recordkeeping obligations.
• Accounts that have been inactive for seven hundred thirty (730) consecutive days are subject to the inactivity process described in the applicable Terms and Conditions. Data associated with closed or permanently inactive accounts will be deleted or anonymized within a reasonable period following closure, subject to mandatory legal retention requirements.

12. Account Deletion, Data Erasure, Mandatory Retention, and Forfeiture

IMPORTANT: PLEASE READ THIS SECTION CAREFULLY BEFORE DELETING YOUR ACCOUNT. ACCOUNT DELETION TRIGGERS PERMANENT DATA ERASURE WITH SIGNIFICANT FINANCIAL CONSEQUENCES. IT CANNOT BE UNDONE.

12.1 How to Delete Your Account

Clients may request deletion of their App account at any time through either of the following channels:

• In-App: Navigate to Settings > Account > Delete Account. The deletion flow includes an identity confirmation step, a full disclosure of the consequences described in this section, and a final confirmation before permanent deletion is executed.
• By written request: Contact support@cacao.tax. Requests will be verified before processing.

12.2 Information Erased Upon Deletion

Upon confirmed account deletion, the following personal information is permanently and irreversibly erased from cacao.tax's active systems:

• All unprocessed SEED Request submissions and associated documentation;
• All pending tax exemption certificate issuance requests not yet completed;
• All refund tracking records, whether pertaining to collected or pending refunds;
• All internal ledger allocations of collected funds not yet transferred to an external account; and
• Personal identifying information linked to the account, including email address, phone number, and account credentials.

12.3 Information Retained After Deletion, Legal Obligations

cacao.tax is required by applicable Texas law, regulation, and rules governing licensed customs broker operations to retain certain records independently of any client deletion request. Records subject to mandatory retention include:

• Transaction records of all Texas Sales Tax Exemption Export Certificates issued, in the form and for the duration required by applicable Texas and federal law;
• Customs broker verification logs and certification documentation;
• Records of refund claims filed, amounts collected, and disbursements made, for audit and regulatory compliance; and
• Executed Powers of Attorney, for such period as required by law.

These records are retained solely to satisfy legal and regulatory obligations. Their retention does not preserve the client's identity in connection with those records, nor does it preserve any entitlement to refund proceeds, as described in Section 12.4.

12.4 Financial Consequences of Deletion, Forfeiture of Funds and Refund Entitlements

Account deletion severs the link between a client's identity and all transaction records, internal ledger allocations, and outstanding refund entitlements associated with that account. Specifically:

• Allocated but Untransferred Funds: cacao.tax maintains an internal ledger through which refund proceeds, once collected from retailers or the Texas Comptroller of Public Accounts, are allocated to identifiable client accounts prior to external disbursement. Upon account deletion, the client's identifying information is removed from cacao.tax's active database. This removal renders any funds allocated in the internal ledger to that account unidentifiable as to the client to whom they were assigned. Because cacao.tax can no longer attribute those allocated funds to an identifiable client, disbursement is legally and operationally impossible, and those funds become the sole and exclusive property of cacao.tax.
• Pending Uncollected Refunds: Similarly, deletion severs the client's identity from any refund claims that cacao.tax has not yet collected from retailers or governmental authorities under certificates issued prior to deletion. The client permanently forfeits the right to pursue, follow up on, or receive proceeds from those outstanding transactions.

BY DELETING YOUR ACCOUNT, YOU IRREVOCABLY AND PERMANENTLY FORFEIT: (A) ALL FUNDS ALLOCATED TO YOUR ACCOUNT IN CACAO.TAX'S INTERNAL LEDGER THAT HAVE NOT BEEN TRANSFERRED TO AN EXTERNAL ACCOUNT; AND (B) ALL PENDING AND FUTURE REFUND PROCEEDS ATTRIBUTABLE TO EXPORT CERTIFICATES ISSUED PRIOR TO DELETION. ALL SUCH FUNDS AND PROCEEDS BECOME THE SOLE PROPERTY OF CACAO.TAX.

cacao.tax strongly recommends that before initiating account deletion, clients: (1) ensure that all funds allocated to their profile have been fully transferred to an external bank account or payment processor, as untransferred allocated funds will be permanently forfeited; and (2) ensure that there are no refund collections pending from retailers or the Texas Comptroller of Public Accounts, as the right to follow up on and receive those proceeds will be permanently forfeited upon deletion.

cacao.tax is not liable for any financial loss arising from a client-initiated account deletion, including forfeiture of allocated funds or outstanding refund entitlements. Account deletion is permanent and irreversible. Temporary deactivation of an account does not constitute deletion.

13. Your Privacy Rights

Depending on your jurisdiction of residence, you may have certain statutory rights with respect to your personal information. cacao.tax will respond to verifiable privacy rights requests from U.S. residents in accordance with applicable law.

13.1 Rights That May Be Available

• Right to Know: the right to request disclosure of the categories and specific pieces of personal information cacao.tax has collected about you, the sources from which it was collected, the purposes for which it is used, and the categories of third parties to whom it has been disclosed.
• Right to Access: the right to obtain a portable copy of the personal information cacao.tax holds about you.
• Right to Correction: the right to request correction of inaccurate personal information.
• Right to Deletion: the right to request deletion of your personal information, subject to applicable legal retention requirements.
• Right to Opt Out of Sale or Sharing: cacao.tax does not sell personal information. Should this practice change, you will be notified and provided with a clear mechanism to opt out.

13.2 Submitting a Request

To exercise any of the above rights, submit a written request to privacy@cacao.tax, including your full legal name, the email address associated with your account, and a description of the right you wish to exercise. cacao.tax will verify your identity before processing any request and will respond within forty-five (45) calendar days. Where reasonably necessary, cacao.tax may extend this period by an additional forty-five (45) days, with prior notice.

13.3 Authorized Agents

An authorized agent may submit a privacy rights request on a client's behalf upon presentation of signed written authorization from the client or proof of legal authority, such as a duly executed power of attorney. cacao.tax may contact the client directly to verify the agent's authority prior to processing.

13.4 Appeals

If cacao.tax declines to act on a privacy rights request, you may appeal that decision by submitting a written appeal to privacy@cacao.tax with the subject line "Privacy Rights Appeal." cacao.tax will respond within a reasonable period in accordance with applicable law.

13.5 Non-Discrimination

cacao.tax will not retaliate against or discriminate against any client for exercising any privacy right described in this Policy.

14. Children's Privacy

The Services are intended exclusively for adults who have reached the age of majority in their jurisdiction of residence, and in no event for persons under eighteen (18) years of age. cacao.tax does not knowingly collect, solicit, or retain personal information from children under the age of thirteen (13). If cacao.tax becomes aware that personal information has been collected from a child under the age of thirteen, such information will be deleted promptly. If you have reason to believe that a child under the age of thirteen has provided personal information to cacao.tax, please contact privacy@cacao.tax immediately.

15. International Clients and Cross-Border Data Transfers

cacao.tax's Services are designed, in part, to assist international travelers and foreign nationals seeking Texas Sales and Use Tax export refunds. All data processing, storage, and business operations are conducted in the United States and are subject to United States law. If you are a resident or national of a country other than the United States, please be aware that the privacy laws of the United States may differ materially from those of your home jurisdiction. By engaging the Services, you consent to the transfer of your personal information to the United States and to its processing in accordance with this Policy.

cacao.tax does not currently offer services within the European Economic Area and does not represent compliance with the General Data Protection Regulation (GDPR) or the United Kingdom General Data Protection Regulation. Should this change, this Policy will be updated accordingly.

16. European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA), you have rights under the General Data Protection Regulation (GDPR), including the right to access, rectify, erase, restrict processing, object to processing, and data portability. You also have the right to lodge a complaint with your local data protection authority.

To exercise any of these rights, please contact us at privacy@cacao.tax.

17. Third-Party Services

The App may contain links to or integrations with third-party platforms or services not owned, operated, or controlled by cacao.tax. This Policy does not apply to any third-party service, and cacao.tax is not responsible for the privacy or data security practices of any third party. Clients are encouraged to review the privacy policies of any third-party services accessed in connection with the App.

18. Changes to This Policy

cacao.tax may revise this Policy from time to time to reflect changes in the Services, applicable law, or information-handling practices. Material revisions will be communicated through the App and by email to the address associated with your account, with not less than thirty (30) days' advance notice where reasonably practicable. The "Effective Date" and "Last Revised" fields at the top of this Policy reflect the date of the most recent revision. Your continued engagement with the Services following notice of a revised Policy constitutes acceptance of the updated practices. If you do not agree to a revised Policy, you must discontinue use of the Services.

19. Contact Information

For all questions, concerns, or requests relating to this Privacy Policy or the processing of your personal information, please contact:

cacao.tax will acknowledge all privacy inquiries within a reasonable period and will respond substantively no later than forty-five (45) calendar days from receipt.