PizzaFlow Privacy Policy

1.Who this policy is for#

This policy covers two different groups of people, and the difference matters.

Section 3 covers shop owners. Section 4 covers callers, and it is the important one.

2.Who we are#

PizzaFlow is a trade name of Macrophantom LLC, a California limited liability company whose address is 6494 Florin Perkins Rd, Sacramento, CA 95828, USA. In this policy, “we” and “us” mean Macrophantom LLC.

For questions about privacy, email privacy@pizzaflow.io.

PizzaFlow is offered in the United States only. If that ever changes, this policy needs rewriting before the first customer outside the US is signed, and a UK or EU customer would also mean a named data protection representative and possibly a DPO.

3.What we collect from shop owners and staff#

3.1Account data. Name, email address, and the password you set, which we never see in readable form because authentication is handled by our database provider. If you sign in with Google, Google tells us your name and email address, and your Google password never reaches us.#

3.2Business data. Business name, address, real phone number, opening hours, delivery settings, menu, prices, assistant configuration and any notes you write.#

3.3Billing data. Your plan, your billing history and enough of your card details to identify it, such as the last four digits and the expiry. We never see or store your full card number. Stripe does.#

3.4Usage data. When you sign in, what you change in the panel, and how many calls your shop handled. The system keeps an activity log for this.#

3.5Technical data. IP address, browser type, and error logs, collected so the service works and so we can debug it.#

3.6Why we hold it. To give you the service you are paying for, to bill you, to support you, to keep the service secure, and to meet our own legal duties such as keeping tax records.#

3.7We do not sell it or share it for advertising. We do not sell personal information, we do not share it for cross-context behavioural advertising, and our website carries no advertising or analytics trackers.#

4.What passes through the system about callers#

This is the section a regulator will read first.

4.1When somebody calls a shop that uses PizzaFlow, or uses that shop’s voice ordering page, the following is processed:#

Every one of those texts can be stopped. Each confirmation and ready message says how. Replying STOP stops texts from that shop’s number, and so does the shop marking the number “Do not text”. Replying START turns them back on.

4.2What we do not do with it.#

• We do not sell caller data. Ever.
• We do not use caller data for our own marketing.
• We do not use caller conversations to train AI models of our own. Our AI provider is used on its paid service terms, under which it does not use the content to improve its own products.
• We do not share a caller’s data with any other shop on the platform. Each shop sees only its own callers.

4.3Being recognised when you call back. Each shop keeps a customer record for the numbers that call it, so a regular does not have to repeat everything every time. That record holds the caller’s name, their phone number, their last delivery address, what they last ordered, any allergy or preparation note they gave, whether they asked us not to text them, how many times they have ordered and when they last called.#

The record belongs to that shop alone. It is never shared with another shop on the platform, and a caller who orders from two PizzaFlow shops has two unconnected records.

Two rules the assistant follows, and they are built into the product rather than left to each shop:

• It may greet you by name. It will never read out a saved address. If you are ordering delivery it asks whether you want the same address as last time and waits for you to say yes. Caller ID is unreliable on forwarded calls, phone numbers are shared inside households and workplaces, and carriers recycle numbers, so reading a saved home address to whoever is holding a number would be a data leak.
• A shop can block a number. If a caller is abusive or is making prank calls, the shop can mark that number blocked. The assistant then does not take a call from that number: the caller hears a short line and the call ends. The shop records why it blocked the number, and it can unblock it.

A caller can ask a shop to delete their record, or ask us. See section 10.

4.4Call audio. We do not keep any. The assistant has to hear a caller in order to answer the phone, so audio passes through in real time to our AI provider. It is never recorded and never stored, on any plan. What is kept is the written transcript. There is no recording of your call anywhere in our systems, so there is none to give you, to lose, or to hand to anybody else.#

4.5Children. The service is not aimed at children. We do not knowingly collect data from a child. If a child rings a shop and places an order, whatever they said will be in that call’s transcript. If you believe a child’s data is held and should not be, contact us and we will delete it.#

5.How the data flows#

One call, in order. Two of these steps carry most of the risk and are marked the risk: the caller is a person who agreed to nothing, and the AI provider is a company outside your building that hears their voice.

1. The caller speaks into their phone. the risk They agreed to nothing and they had never heard of us before the call connected.
2. Their voice reaches our telephony provider, which owns the phone number and the line.
3. That provider streams the audio to the PizzaFlow bridge, our own server.
4. The bridge passes the audio to our AI provider, which hears it and speaks back. the risk
5. The bridge writes the transcript, the order, and the caller’s name, phone number and address to our database.
6. The address alone goes to a mapping provider to check it is real and inside the delivery radius.
7. An order that is still in progress is held in a three hour cache, so a dropped call can resume.
8. A confirmation text message goes back out through the same telephony provider, unless the number has asked not to be texted.
9. The shop owner sees the order on their board and can read the transcript.
10. Separately, the shop owner pays us through Stripe. No caller data goes anywhere near that.

6.Who else handles data#

We share what is described above with these kinds of company, and with nobody else. We stay responsible for what they do with it, whichever one we are using.

We name categories rather than companies, because a policy that names a supplier is wrong the day we change one. Any customer may ask for the current list and we will send it. We will tell you before we add a kind of provider that handles call audio or caller details.

7.Our legal basis for processing#

7.1Shop owners. We process your data to perform our contract with you, to meet legal obligations such as tax, and for our legitimate interests in running and securing the service.#

7.2Callers. The shop is the controller and we are its processor. The shop’s legal basis is normally performance of a contract, because the caller is placing an order, together with the shop’s legitimate interest in taking orders efficiently.#

7.3Transcription needs telling people, and we do it ourselves. In states where an automated call or a transcript requires notice or consent, the caller has to be told. Rather than leave that to each shop, the assistant discloses in its first sentence, on every call, that it is an AI and that it takes notes. There is no per-shop switch, so there is no shop that forgot to turn it on. A caller on the phone who objects is transferred to the shop’s own line straight away; on the shop’s web page, which cannot transfer a call, the assistant gives them the shop’s number. We keep no audio, which is a lighter position than a recording in every state that treats the two differently.#

7.4The honest risk. The chain “the shop has a contract with the caller, so the shop can process their data, so we can process it for the shop” is standard and it is the same reasoning any online ordering system uses. What is not standard is that the caller’s voice goes to a third-party AI provider in real time. That is where this product is most exposed, and it is why the one sentence at the start of the call matters more than any sentence in this policy. It is also why that sentence is always on and cannot be switched off.#

8.How long we keep things#

8.1When a shop is deleted, its orders, its caller records and its call records are deleted with it. This is not reversible.#

8.2A job enforces these periods, every day. Once a night it clears transcripts older than 12 months, removes the caller’s name, number, address and notes from orders older than 24 months, and deletes caller records 24 months after that caller last ordered. Billing records are never touched by it.#

8.3One thing outlives the rest, on purpose. If a number has asked not to be texted, or a shop has blocked it, we keep that number and that flag after its record expires, and nothing else about it. Deleting it would quietly undo somebody’s request not to be contacted.#

9.Rights of shop owners#

You can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or object to how we use it. Email privacy@pizzaflow.io. We respond within 30 days. [C15]

10.Rights of callers, and how to use them when you never signed up with us#

10.1If you spoke to an AI assistant when you rang a restaurant, and you want to know what was kept, or you want it deleted, you have that right even though you have no account with us and never agreed to anything.#

10.2The fastest route is to ask the restaurant you rang. They control their own order records and can delete your record from their panel.#

10.3If you would rather come to us, or the restaurant does not help, email privacy@pizzaflow.io with:#

1. the phone number you called from, which is how records are indexed;
2. the restaurant you rang;
3. roughly when you rang;
4. what you want, meaning a copy of the data, a correction, or deletion.

10.4We will find the records, tell the restaurant, and act within 30 days. [C15] We do not charge for this.#

10.5What we will not do without more care. We will not hand a full transcript to somebody just because they email us with a phone number, because that would be a way to read a stranger’s order history. We check that the number is yours by texting a one-time code to it. That is proportionate, it is not itself invasive, and it is the only check we make.#

10.6If you do not want to talk to an AI, say so and it will pass you to a person. The assistant tells you it is an AI in its first sentence. On the phone, if you say you would rather speak to somebody at the shop, it transfers you there straight away. On a shop’s web ordering page, which cannot transfer a call, it gives you the shop’s number. You do not have to argue with it.#

10.7If you are unhappy with our answer you can complain to your data protection authority.#

11.Cookies and browser storage#

11.1We use only the cookies the site needs to work. We use no advertising cookies, no analytics cookies and no tracker from any other company.#

11.2The public voice ordering page sets no cookies and stores nothing in your browser. It uses your microphone only during a call you start.#

11.3The bot check. Our signup and password reset forms load a bot check from Cloudflare, which reads information about your browser and device to tell people from automated abuse. Cloudflare’s own privacy policy covers what it does with that. No other company collects information about you through our site.#

11.4Do Not Track. We do not track visitors across other websites, and we do not let any other company do so through ours, so the site behaves the same whether or not your browser sends a Do Not Track signal.#

12.International transfers#

12.1Our providers operate in several countries, including the United States. If you or your callers are outside those countries, data will be transferred across borders.#

12.2Where the law requires it, those transfers rely on standard contractual clauses or an equivalent approved mechanism in our contracts with each provider.#

13.Security#

13.1All traffic to and from the service is encrypted in transit. Data at rest is encrypted by our database and hosting providers.#

13.2Passwords are stored only as salted hashes by our authentication provider. We never see them.#

13.3Access is separated per shop at the database level, so one shop cannot read another shop’s orders, callers or transcripts.#

13.4Only staff who need access to run and support the service have it.#

13.5No system is perfectly secure. We cannot promise a breach will never happen.#

14.If there is a breach#

14.1If personal information we hold for a shop is acquired by somebody who should not have it, we tell that shop immediately after we discover it, as California law requires of a business holding data for another (Cal. Civ. Code § 1798.82(b)), and we help it tell its callers.#

14.2Where we must tell people ourselves, we do it in the time the law of their state sets. For California residents that is within 30 calendar days of discovering the breach, and where more than 500 California residents are affected we also send a sample copy of the notice to the California Attorney General within 15 calendar days of telling them (Cal. Civ. Code § 1798.82).#

15.Changes to this policy#

We may update this policy. The date at the top changes. If a change materially affects how caller data is handled, we will tell shop owners by email.

16.Contact#

The Terms of Service and the Refund Policy sit alongside this policy.