PizzaFlow Privacy Policy

1.Who this policy is for#

This policy covers two different groups of people, and the difference matters.

Section 3 covers shop owners. Section 4 covers callers, and it is the important one.

2.Who we are#

[COMPANY LEGAL NAME]L1, of [REGISTERED ADDRESS]L3, operates PizzaFlow.

For questions about privacy, email privacy@pizzaflow.ioL7.

PizzaFlow is offered in the United States only. If that ever changes, this policy needs rewriting before the first customer outside the US is signed, and a UK or EU customer would also mean a named data protection representative and possibly a DPO.

3.What we collect from shop owners and staff#

3.1Account data. Name, email address, and the password you set, which we never see in readable form because authentication is handled by our database provider.#

3.2Business data. Business name, address, real phone number, opening hours, delivery settings, menu, prices, assistant configuration and any notes you write.#

3.3Billing data. Your plan, your billing history and enough of your card details to identify it, such as the last four digits and the expiry. We never see or store your full card number. Stripe does.#

3.4Usage data. When you sign in, what you change in the panel, and how many calls your shop handled. The system keeps an activity log for this.#

3.5Technical data. IP address, browser type, and error logs, collected so the service works and so we can debug it.#

3.6Why we hold it. To give you the service you are paying for, to bill you, to support you, to keep the service secure, and to meet our own legal duties such as keeping tax records.#

4.What passes through the system about callers#

This is the section a regulator will read first.

4.1When somebody calls a shop that uses PizzaFlow, or uses that shop’s voice ordering page, the following is processed:#

4.2What we do not do with it.#

• We do not sell caller data. Ever.
• We do not use caller data for our own marketing.
• We do not use caller conversations to train our own AI models, and our AI provider is configured on a basis that does not use the content to train its public models.
• We do not share a caller’s data with any other shop on the platform. Each shop sees only its own callers.

4.3Being recognised when you call back. Each shop keeps a customer record for the numbers that call it, so a regular does not have to repeat everything every time. That record holds the caller’s name, their phone number, their last delivery address, what they last ordered, any allergy or preparation note they gave, whether they asked us not to text them, how many times they have ordered and when they last called.#

The record belongs to that shop alone. It is never shared with another shop on the platform, and a caller who orders from two PizzaFlow shops has two unconnected records.

Two rules the assistant follows, and they are built into the product rather than left to each shop:

• It may greet you by name. It will never read out a saved address. If you are ordering delivery it asks whether you want the same address as last time and waits for you to say yes. Caller ID is unreliable on forwarded calls, phone numbers are shared inside households and workplaces, and carriers recycle numbers, so reading a saved home address to whoever is holding a number would be a data leak.
• A shop can block a number. If a caller is abusive or is making prank calls, the shop can mark that number blocked. The assistant then does not take a call from that number: the caller hears a short line and the call ends. The shop records why it blocked the number, and it can unblock it.

A caller can ask a shop to delete their record, or ask us. See section 10.

4.4Call audio. We do not keep any. The assistant has to hear a caller in order to answer the phone, so audio passes through in real time to our AI provider. It is never recorded and never stored, on any plan. What is kept is the written transcript. There is no recording of your call anywhere in our systems, so there is none to give you, to lose, or to hand to anybody else.#

4.5Children. The service is not aimed at children. We do not knowingly collect data from a child. If a child rings a shop and places an order, whatever they said will be in that call’s transcript. If you believe a child’s data is held and should not be, contact us and we will delete it.#

5.How the data flows#

One call, in order. Two of these steps carry most of the risk and are marked the risk: the caller is a person who agreed to nothing, and the AI provider is a company outside your building that hears their voice.

1. The caller speaks into their phone. the risk They agreed to nothing and they had never heard of us before the call connected.
2. Their voice reaches our telephony provider, which owns the phone number and the line.
3. That provider streams the audio to the PizzaFlow bridge, our own server.
4. The bridge passes the audio to our AI provider, which hears it and speaks back. the risk
5. The bridge writes the transcript, the order, and the caller’s name, phone number and address to our database.
6. The address alone goes to a mapping provider to check it is real and inside the delivery radius.
7. An order that is still in progress is held in a three hour cache, so a dropped call can resume.
8. A confirmation text message goes back out through the same telephony provider.
9. The shop owner sees the order on their board and can read the transcript.
10. Separately, the shop owner pays us through Stripe. No caller data goes anywhere near that.

6.Who else handles data#

We share what is described above with these kinds of company, and with nobody else. We stay responsible for what they do with it, whichever one we are using.

We name categories rather than companies, because a policy that names a supplier is wrong the day we change one. Any customer may ask for the current list and we will send it. We will tell you before we add a kind of provider that handles call audio or caller details.

7.Our legal basis for processing#

7.1Shop owners. We process your data to perform our contract with you, to meet legal obligations such as tax, and for our legitimate interests in running and securing the service.#

7.2Callers. The shop is the controller and we are its processor. The shop’s legal basis is normally performance of a contract, because the caller is placing an order, together with the shop’s legitimate interest in taking orders efficiently.#

7.3Transcription needs telling people, and we do it ourselves. In states where an automated call or a transcript requires notice or consent, the caller has to be told. Rather than leave that to each shop, the assistant discloses in its first sentence, on every call, that it is an AI and that it takes notes. There is no per-shop switch, so there is no shop that forgot to turn it on. A caller who objects is transferred to a person straight away. We keep no audio, which is a lighter position than a recording in every state that treats the two differently.#

7.4The honest risk. The chain “the shop has a contract with the caller, so the shop can process their data, so we can process it for the shop” is standard and it is the same reasoning any online ordering system uses. What is not standard is that the caller’s voice goes to a third-party AI provider in real time. That is where this product is most exposed, and it is why the one sentence at the start of the call matters more than any sentence in this policy. It is also why that sentence is always on and cannot be switched off.#

8.How long we keep things#

8.1When a shop is deleted, its orders, its caller records and its call records are deleted with it. This is not reversible.#

8.2These periods are only true if a job enforces them. Today nothing expires by itself except the three-hour order cache, so the deletion job is part of the work that ships with these pages rather than something added afterwards. Publishing “we delete transcripts after 12 months” and then not deleting them is worse than publishing nothing at all.#

9.Rights of shop owners#

You can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or object to how we use it. Email privacy@pizzaflow.ioL7. We respond within 30 days. [C15]

10.Rights of callers, and how to use them when you never signed up with us#

10.1If you spoke to an AI assistant when you rang a restaurant, and you want to know what was kept, or you want it deleted, you have that right even though you have no account with us and never agreed to anything.#

10.2The fastest route is to ask the restaurant you rang. They control their own order records and can delete your record from their panel.#

10.3If you would rather come to us, or the restaurant does not help, email privacy@pizzaflow.ioL7 with:#

1. the phone number you called from, which is how records are indexed;
2. the restaurant you rang;
3. roughly when you rang;
4. what you want, meaning a copy of the data, a correction, or deletion.

10.4We will find the records, tell the restaurant, and act within 30 days. [C15] We do not charge for this.#

10.5What we will not do without more care. We will not hand a full transcript to somebody just because they email us with a phone number, because that would be a way to read a stranger’s order history. We check that the number is yours by texting a one-time code to it. That is proportionate, it is not itself invasive, and it is the only check we make.#

10.6If you do not want to talk to an AI, say so and it will pass you to a person. The assistant tells you it is an AI in its first sentence, and if you say you would rather speak to somebody at the shop it transfers you there straight away. You do not have to argue with it and you do not have to hang up and try again.#

10.7If you are unhappy with our answer you can complain to your data protection authority.#

11.Cookies and browser storage#

11.1We use a small number of strictly necessary cookies to keep you signed in to the panel. Without them, sign-in does not work.#

11.2The public voice ordering page uses browser storage to keep track of the conversation in progress. That data stays in the browser.#

12.International transfers#

12.1Our providers operate in several countries, including the United States. If you or your callers are outside those countries, data will be transferred across borders.#

12.2Where the law requires it, those transfers rely on standard contractual clauses or an equivalent approved mechanism in our contracts with each provider.#

13.Security#

13.1All traffic to and from the service is encrypted in transit. Data at rest is encrypted by our database and hosting providers.#

13.2Passwords are stored only as salted hashes by our authentication provider. We never see them.#

13.3Access is separated per shop at the database level, so one shop cannot read another shop’s orders, callers or transcripts.#

13.4Only staff who need access to run and support the service have it.#

13.5No system is perfectly secure. We cannot promise a breach will never happen.#

14.If there is a breach#

14.1If personal data is lost or exposed and it is likely to be a risk to people, we will notify the relevant authority within 72 hours of becoming aware, where the law requires it.#

14.2We will tell affected shop owners without undue delay, and we will help them tell their callers where that is required.#

15.Changes to this policy#

We may update this policy. The date at the top changes. If a change materially affects how caller data is handled, we will tell shop owners by email.

16.Contact#

The Terms of Service and the Refund Policy sit alongside this policy.