Privacy Policy

We collect information that you provide directly to us when you create an account, including your name, email address, business name, and phone number.

We also collect information automatically when you use the Services, including: (a) device and browser information; (b) usage data such as features accessed and actions taken; (c) approximate location derived from IP address; and (d) logs for security and troubleshooting purposes.

When your customers place orders through the kiosk, we process their order data (items, payment method, and contact details if provided) on your behalf. You are the data controller for customer order data; GrubVoice acts as your data processor.

We use your information to: (a) provide and maintain the Services; (b) process subscription payments; (c) send you service-related communications such as receipts and security alerts; (d) provide customer support; (e) improve and develop new features; and (f) detect, prevent, and address fraud or abuse.

We do not sell your personal information to third parties. We do not use your data to train third-party AI models.

Your data is stored in encrypted databases hosted on Supabase (PostgreSQL) with servers located in the European Union and the United Kingdom. All data in transit is protected using TLS encryption.

Backups are encrypted and retained for 30 days. We follow industry best practices for key management and access control.

We use essential cookies to authenticate your session and remember your preferences (such as theme selection). These cookies are necessary for the Services to function.

We use analytics cookies to understand how the Services are used and to improve them. You can control analytics tracking through your browser settings or our cookie preferences tool.

We do not use cookies for targeted advertising.

We rely on the following third-party services to operate the platform. Each service has its own privacy policy that governs how they handle data:

• •Supabase — Database hosting and authentication. Stores your account data, menu items, orders, and configuration. Data is encrypted at rest and in transit.
• •Stripe — Payment processing for both your GrubVoice subscription and your customers' order payments. Stripe handles all card data directly; we never store full card numbers.
• •Telnyx — SMS and voice services for the Voice AI feature. Telnyx processes phone numbers and call metadata to enable automated order taking.
• •OpenAI — Powers the voice AI transcription and natural language processing. Audio and text are sent to OpenAI for processing in accordance with their data usage policies.

If you are located in the European Economic Area, United Kingdom, or Switzerland, you have the following rights under the GDPR: (a) access your personal data; (b) rectify inaccurate data; (c) erase your data ("right to be forgotten"); (d) restrict processing; (e) data portability; (f) object to processing; and (g) withdraw consent at any time.

If you are located in California, you have rights under the CCPA, including the right to know what personal information we collect, the right to delete your personal information, and the right to opt out of the sale of personal information. We do not sell personal information.

To exercise any of these rights, contact us using the details in the Contact section below. We will respond within 30 days.

We retain your account data for as long as your account is active. If you cancel your subscription, we retain your data for 90 days to allow for reactivation, after which it is permanently deleted.

Order data is retained for up to 7 years to comply with tax and accounting regulations. You may request earlier deletion of non-essential data.

Server logs and analytics data are retained for 12 months.

We take security seriously. All data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Access to production systems is restricted to authorized personnel and requires multi-factor authentication.

We conduct regular security reviews and penetration testing. We will notify you of any data breach affecting your personal data within 72 hours of becoming aware of it, in accordance with GDPR requirements.

If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact us:

• •Email: [email protected]
• •Support: Visit our Help page at grubvoice.com/help
• •Postal address: GrubVoice, c/o Annatis, United Kingdom