How Zogu handles personal data in the UK

01Who we are and who decides

Zogu is run by [Company name], a company registered in England and Wales (company number [Company number]) with its registered office at [Registered address]. "We" and "us" in this policy mean [Company name].

Zogu answers a restaurant's phone, takes a pickup or delivery order from the menu in the restaurant's POS, reads it back once and sends it to the restaurant's till through our POS integration platform. Who decides how your information is used depends on why we have it.

[Solicitor to confirm this controller and processor split, including where our POS integration platform sits.]

When you ring a restaurant, its own privacy notice applies as well as this one, and the restaurant is the first place to ask about your call. We work for the restaurant under the data processing terms in our terms of service. We don't use callers' details for anything the restaurant hasn't agreed to. We don't sell them, and we don't use them for advertising.

For anything in this policy, email [Contact email] or write to [Company name], [Registered address]. [Name and role of the person who handles data protection, and whether a data protection officer is appointed.] We're registered with the UK regulator, the Information Commission (still known as the ICO), under number [ICO registration number].

02What's kept when you ring a restaurant

Every call opens with the agent saying it's the restaurant's automated ordering assistant. From then on, this is what's kept:

• The number you're ringing from, which restaurant you rang, when the call started and ended, and how it ended: with an order, without one, with you hanging up, or with an apology and goodbye.
• A written transcript: what the speech recogniser heard you say, what the agent said back, how sure the recogniser was of each thing you said, how long each reply took, and where you talked over the agent.
• Your order: the items and options, notes for the kitchen such as "no onions", pickup or delivery, the total, and whether you'll pay on pickup or on delivery.
• The name for the order. The agent only takes a name from your own words, when it has asked for one or when you say something like "my name's Sam" or "it's for Sam".
• For delivery, your postcode, address and any delivery instructions. If you give a contact number that isn't the one you're ringing from, the agent reads back only its last three digits.
• If your number is withheld, the contact number you give instead.
• Things the agent couldn't help with, such as a dish it couldn't find on the menu or a question it couldn't answer. These are saved so the restaurant's team can teach the agent.
• Updates from the restaurant's POS on whether the restaurant accepted, rejected or completed your order.
• Technical logs: a call reference, timings and any errors. If you ring a number that isn't set up for a restaurant, you hear a short message, the call ends, and the log keeps the number you rang from.

You don't have to give your name, number or address. The agent can't place an order without a name and a phone number, though, and a delivery order also needs an address.

If you've ordered before

If you've ordered from the same restaurant by phone through Zogu before, the agent matches your number to your last order there. It greets you by first name and can put that order back in if you say "same as last time". It doesn't read your last order out unless you ask. Only earlier Zogu phone orders at that restaurant count, not app, website or in-shop orders. Withheld numbers aren't looked up.

No call recordings

The call is not recorded. Your voice is turned into text as you speak, and we don't store the audio. Nobody at Zogu listens to the call. The agent never asks for card details.

The only audio we keep is the agent's own voice saying its greeting and its apology line, saved so the next call starts without a pause. For a returning caller the greeting includes their first name ("Hi Sam, welcome back..."), so we treat those clips as personal data too. We keep the 200 most recently used clips and delete older ones automatically.

Transcripts can be wrong

A transcript is what the speech recogniser heard, which isn't always what you said. On one of our test calls, a caller said "and a doner kebab" and the recogniser wrote down "And I'm Donica Buck", at 69% confidence. The agent didn't take that as a name. It asked the caller to say it again. If your transcript is wrong, you can ask for a note to be added or for it to be deleted.

How the agent tells callers it's automated, and what's in a transcript, is set out on our AI disclosure and call transcripts page.

03Why it's used and the lawful basis

For calls to a restaurant, the restaurant chooses the lawful basis. The table shows the bases we expect restaurants to rely on. [Solicitor to confirm. Each restaurant states its own in its privacy notice.]

If the police or another public body asks us for a caller's information, we pass the request to the restaurant unless the law requires us to answer it ourselves.

For the web demo, we're the controller. We rely on our legitimate interests in showing how Zogu works. What the demo handles is set out under "The web demo" below.

[Decide before publishing, with the solicitor: keep or delete this paragraph, and use the same position in terms 4.14 and on the AI disclosure page. If kept, our terms must let restaurants agree to it explicitly.] We also use transcripts of restaurant calls, with names, phone numbers and addresses taken out, to find the agent's mistakes and to test fixes. For that use we're a controller and rely on our legitimate interests.

We don't train AI models on calls. The language model works from the text of what you say, not your voice. Cloudflare runs it for us, and we chose a model that Cloudflare's catalogue lists with zero data retention. [Confirm against Cloudflare's current terms, and check the same for the speech models.] When a restaurant's team "teaches" the agent a word on our Teach page, for example that "cheeseburger" means their Mega Burger, that word goes into the restaurant's own menu matching. No AI model is trained on it.

Allergies and health

If you mention an allergy or a health condition ("no nuts, I'm allergic"), it goes into the transcript and may reach the kitchen as a note on the order. That's health information, which the law protects more strictly. [Solicitor to confirm the Article 9 condition the restaurant relies on.] The agent answers allergen questions only from what the restaurant has in its POS or has written in itself. When the menu lists allergens, the answer ends with a reminder to check with the restaurant before ordering if you have a serious allergy. When the information isn't there, the agent says it doesn't know.

Decisions the agent makes on its own

During a call the agent applies the restaurant's rules. It checks whether your postcode is inside a delivery area and whether the order meets the delivery minimum. It won't place an order without a clear yes to the read-back, or once ordering has closed. If it can't make out an address after two tries, it ends the call rather than guess. These decisions don't have legal consequences for you or affect you in a similar way, so the rules on automated decisions in Articles 22A to 22D of the UK GDPR don't apply to them. [Solicitor to confirm.] If you think the agent got something wrong, contact the restaurant.

04How long it's kept

The periods below are still being set. Until they are, nothing is deleted automatically: we delete callers' information by hand when the restaurant, or a caller through the restaurant, asks. [Nothing deletes call records automatically yet: no retention job covers the database, the call's Durable Object storage, greeting clips that contain names, or Twilio's call logs. Until one is built, deletion is done by hand on request, and these periods are still being set. Tell the lawyer this before filling them in.]

When a restaurant stops using Zogu, we'll delete its callers' information by hand, or return it if the restaurant asks, within [period to be set], unless the law requires us to keep it.

How long we keep information about restaurant contacts and website visitors is set out under "Restaurant contacts and website visitors" below.

05Who else handles it, and where

We use these providers to run Zogu. Each one handles callers' details only to provide its service to us, under a written contract. [Confirm each data processing agreement is in place, and that our terms list these sub-processors for restaurants.] [Pay by link is built but switched off: after the yes, the agent can offer to text the caller a secure card-payment link (Stripe Checkout, sent by Twilio SMS), and texts a refund notice if the kitchen rejects a paid order. Decide whether it's part of the launch. If it is, rewrite this clause, add Stripe and Twilio SMS to the sub-processors and privacy policies, and have counsel review the consent wording for texts (TCPA and A2P 10DLC in the US, PECR in the UK). If it isn't, make it impossible to switch on for live stores.]

The restaurant's own systems

The restaurant's POS, and the POS integration platform that connects it to Zogu, aren't our providers. They're the restaurant's own ordering systems: we send your order to the restaurant's POS, and receive the restaurant's menu, opening hours and updates on the order from it, because the restaurant asks us to. Once your order is there, the restaurant's own arrangements with its POS and that platform cover it. This matches our terms of service (section 4.8).

Call audio passes through Twilio, which carries the call, and Cloudflare, which runs the speech and language models for us. The restaurant's POS gets your order, not the transcript. We don't send call data to Deepgram or to the language model's maker.

Transfers outside the UK

Some of this processing happens outside the UK, in the European Economic Area and the US. Transfers to the EEA are covered by UK adequacy regulations. For US companies we rely on the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge) where the company is certified, and otherwise on the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. [Confirm the mechanism for each provider from its data processing agreement.] Email [Contact email] for a copy of the safeguards.

How we protect it

• The call reaches Twilio over the phone network like any other call. From there, everything travels encrypted between Twilio, Cloudflare and our POS integration platform.
• Messages from Twilio and our POS integration platform, including the start of the audio stream, are checked for that company's signature. Anything without a valid one is refused.
• Our access tokens for our POS integration platform are stored encrypted, and credentials are stripped out of our POS request log.
• Call records are read through our console. Only named members of the Zogu team can sign in to it, using Cloudflare Access with Google sign-in. Restaurants don't have their own login yet.

06Restaurant contacts and website visitors

For this information we're the controller.

If you own, run or work at a restaurant

We keep:

• your name, role and work contact details, and the messages between you and our team;
• the restaurant details our POS integration platform sends us when your location is connected to Zogu: the restaurant's name, address, phone number, email address, opening hours and menu. If you're a sole trader, or the email address or mobile number is your own, that's personal data;
• the settings you ask us to use, such as the greeting, the voice, add-on questions, delivery areas and fees, how to say dish names, and answers the agent gives callers;
• [billing details, once we charge for Zogu: what's collected and which payment provider handles it].

We use this to set up and run Zogu for your restaurant, to support you and to send you messages about the service. The lawful basis is contract, or our legitimate interests where the contract is with the business you work for. [If we'll send marketing emails, add: we may email you about Zogu, relying on our legitimate interests, and every email lets you opt out.] We keep it while your restaurant uses Zogu and for [period to be set] after.

If you visit this website or email us

Cloudflare, which hosts this website, handles your IP address and browser details to deliver the pages and protect the site, and keeps server logs for [period to be set]. The lawful basis is our legitimate interests in running a secure website. The site's fonts are served from the site itself, so no page asks Google or anyone else for them. The site sets no cookies; our cookie policy has the details.

If you email us or get in touch through our contact page, we keep your message and contact details to reply and follow up, for [period to be set]. Our email is provided by [Email provider]. The lawful basis is our legitimate interests, or steps before a contract if you're asking about using Zogu for your restaurant.

07The web demo

This website has a demo of the Zogu agent that you can type or talk to. There's no restaurant behind it, so we're the controller for it, relying on our legitimate interests in showing how Zogu works and keeping the demo running.

Nothing from the demo goes into our call records, and no demo order is sent to any POS. Please don't type real names, addresses, phone numbers or card details.

If you use the microphone, the speech-to-text is done by your browser, not by Zogu. Chrome sends your voice to Google and Safari sends it to Apple to turn it into text, under their own privacy terms. If you'd rather not, type instead.

[Confirm with the solicitor that legitimate interests is the right basis, and the period for the daily counts.]

08Your rights and how to use them

You can ask to:

• get a copy of your information, including a call transcript;
• have wrong information corrected, or a note added to a transcript;
• have your information deleted;
• have its use paused while a correction or complaint is sorted out;
• stop a use that relies on legitimate interests, including being recognised as a returning caller;
• get the details you gave for an order in a format a computer can read, or have them sent to another organisation;
• withdraw your consent, where consent is the lawful basis.

Some of these have exceptions, for example where a record has to be kept by law.

About a call to a restaurant

The restaurant decides about your call, so you can ask the restaurant directly. You can also email us at [Contact email]. We'll pass your request to the restaurant and help it answer. To find your call, tell us the restaurant's name, the number you rang from, and the date and rough time of the call. We may need to check the number is yours before we send a transcript.

To stop being greeted by name, ask the restaurant or us to delete your earlier Zogu phone orders at that restaurant. The restaurant's own till records aren't affected. For a single call, you can also withhold your number by dialling 141 first. The agent won't look you up, and it will ask for a contact number for the order.

About anything else

For the web demo, your dealings with us as a restaurant, or this website, email [Contact email].

How long it takes

We reply within one month. If a request is complex, or you've sent several, we can take up to two more months, and we'll tell you within the first month. The clock pauses while we wait for something we reasonably need from you, such as proof that the number is yours. Requests are usually free.

Complaints

Please tell us first. Email [Contact email] with "Complaint" in the subject line, or write to us at [Registered address]. We'll acknowledge your complaint within 30 days, look into it without undue delay, keep you updated and tell you the outcome. If it's about a call to a restaurant, we'll work through it with the restaurant, which has the same duty.

You can also complain to the Information Commission (ICO). It usually expects you to have raised the problem with the organisation first. You can complain online at ico.org.uk/make-a-complaint, ring its helpline on 0303 123 1113, or write to ICO Head Office, 4th Floor, No.3 Circle Square, 5 Hawkshaw Street, Manchester M1 7BL.

09Changes under the Data (Use and Access) Act 2025

The Data (Use and Access) Act 2025 changed UK data protection law in stages. Most of its changes came into force on 5 February 2026. The duty to handle complaints followed on 19 June 2026, and the Information Commissioner's Office became the Information Commission on 30 September 2026. We checked this policy against those changes on 5 November 2026. Here is what they changed in it:

• Organisations must now give you a way to complain and acknowledge a complaint within 30 days. Our route is under "Complaints" above.
• When you ask for your information, the one-month time limit pauses while we wait for something we reasonably need from you, and the search for your information has to be reasonable and proportionate.
• Automated decisions now come under Articles 22A to 22D of the UK GDPR. "Decisions the agent makes on its own" above explains why they don't apply to the agent's choices during a call.
• A new lawful basis, "recognised legitimate interests", covers things like preventing or detecting crime. It would only come into play if a caller's information had to go to the police or another public body. The Act also gives keeping systems secure as an example of a legitimate interest, which covers our technical logs.
• New UK adequacy decisions for other countries use a "data protection test". Existing arrangements, including the UK-US data bridge, carry on.
• Cookies used only to collect statistics to improve a website no longer need consent, as long as you're told about them and can opt out. Our cookie policy says whether this site uses any.

Changes to this policy

If we change how we use personal data, we'll update this page and the date below, and tell the restaurants we work for before the change takes effect.

Last updated: [Date]