Privacy Policy

Diners. You do not need an account or any personal identification to use the chat. We collect the chat messages you send, dietary and allergy preferences you select, order and request selections, and session metadata (a random device-stored session identifier, table number, and timestamps). Chat sessions expire after a period of inactivity. Please do not type personal information (such as your name, phone number, or health details beyond dietary preferences) into the chat — anything you type is processed as described below.

Restaurant owners, managers, and staff. Account details (name, email, password), restaurant details (name, address, hours, timezone), menu and ingredient data, uploaded images, team membership and roles, and billing status. Payment card details are collected and processed by Stripe, our payment processor — we do not store card numbers.

Everyone. Basic technical data needed to operate and secure the Service, such as IP address, browser type, and request logs, plus essential cookies to maintain sessions.

We use the information we collect to:

• Provide and operate the Service — answer menu questions, deliver orders and requests to restaurant staff, run loyalty programs
• Process subscription payments
• Secure the Service and prevent abuse, including rate limiting
• Improve the Service, including reviewing chat interactions to improve AI answer quality
• Communicate with account holders about the Service (transactional and support email)

Diner chat messages, together with the restaurant’s menu data, are sent to third-party AI model providers (currently Google’s Gemini models) to generate responses. AI providers process this data under their own terms. Do not include sensitive personal information in chat messages.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share information only with:

• The restaurant you interact with — your chat transcript, orders, requests, feedback, and loyalty activity for that restaurant are visible to its staff in their dashboard.
• Service providers (processors) who help us run the Service: Google (AI models, analytics), Stripe (payments), Neon (database hosting), Cloudflare (storage and delivery of uploaded images), and email providers (Resend / Amazon SES). Each is bound to use the data only to provide its service to us.
• Legal and safety — when required by law, legal process, or to protect the rights, safety, or property of AskFoodie.AI, our users, or the public.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this Policy.

Restaurant account and menu data is retained while the account is active and for a reasonable period afterward. Diner chat sessions expire after inactivity; transcripts and order history are retained so restaurants can view their own history, and order records are archived (not hard-deleted) for record-keeping. We retain data as needed to comply with legal obligations, resolve disputes, and enforce agreements, then delete or anonymize it.

We use appropriate technical and organizational measures to protect personal data, including encryption in transit, hashed credentials, role-based access for restaurant teams, and least-privilege access to production systems. No system is completely secure; please use a strong, unique password.

We operate from the United States and serve restaurants in India, the United States, and elsewhere. Your information may be transferred to and processed in countries other than your own, including the United States, which may have different data-protection laws than your country. We take steps designed to ensure personal data receives adequate protection wherever processed.

If you are in India, we process your personal data on the basis of your consent (given when you use the chat or create an account) and for legitimate uses permitted by the Digital Personal Data Protection Act, 2023. You have the right to access a summary of your personal data, correct or erase it, nominate a person to exercise your rights, and withdraw consent (which stops processing that relied on it, without affecting prior processing). To exercise these rights, or to raise a grievance, contact privacy@askfoodie.ai — we will respond within the timelines required by law. If unsatisfied, you may complain to the Data Protection Board of India.

Depending on your state (for example under the CCPA/CPRA in California), you may have the right to know what personal information we collect, access it, correct it, delete it, and to non-discrimination for exercising these rights. We do not sell or share personal information as those terms are defined in the CCPA, and we do not use or disclose sensitive personal information for purposes requiring a right to limit. To exercise your rights, email privacy@askfoodie.ai; we will verify your request and respond within the time required by law. You may use an authorized agent where the law allows.

The Service is not directed at children, and we do not knowingly collect personal data from children under 13 (or under the age where parental consent is required in your jurisdiction, such as under 18 in India without verifiable parental consent). Diners do not create accounts; if you believe a child has provided us personal data, contact us and we will delete it.

We may update this Policy from time to time. We will post the updated version with a new “Last updated” date and, for material changes, notify account holders by email or through the Service.

Privacy questions, requests, or grievances: privacy@askfoodie.ai.