US privacy policy and California notice at collection

01Who we are and the two roles we play

[Company name] ("Zogu," "we" or "us") is a [State of incorporation] [entity type] at [Registered address]. We make the phone agent that answers a restaurant's ordering number, takes pickup and delivery orders from the menu in the restaurant's POS, reads the order back once, sends it to the restaurant and hangs up.

We handle personal information in two roles.

When you call a restaurant's Zogu number, the restaurant decides why your information is collected and what happens to it. We act for the restaurant, as its service provider (or contractor) under the CCPA and as its processor under other state privacy laws, where those laws apply. The restaurant's own privacy notice applies to you too, and the restaurant decides requests about its calls.

For our own business, we decide. That covers the people we deal with at restaurants, people who contact us and visitors to this site. Here we're the "business" under the CCPA, or the "controller" under other state laws, where those laws apply.

This policy doesn't cover our own employees or job applicants, who get a separate notice. It also doesn't cover the restaurant's other systems, such as its website, its app or its POS.

If you're in the UK, read our UK privacy policy instead. Our US Terms of Service set out how restaurants may use Zogu, and AI disclosure and call transcripts explains how the phone agent tells callers it's automated.

02What happens to your information on a call

A call to a restaurant's Zogu number goes like this.

1. Twilio, which provides our phone lines, connects the call. It passes us the number you're calling from, unless you've withheld it, and the number you dialed. The number you dialed is how we know which restaurant you want. If that number isn't set up, or the restaurant has switched Zogu off, you hear a short message and the call ends. We never guess which restaurant you meant.
2. The phone agent opens by telling you it's automated, usually with the words "the automated ordering assistant." If a restaurant writes its own greeting and it doesn't say so, we add "You're through to the automated ordering assistant."
3. From Twilio, your voice reaches Zogu over an encrypted connection. Speech recognition (Deepgram Flux, running on Cloudflare Workers AI) turns it into text as you talk. We don't save the audio.
4. A language model (GLM-4.7-Flash, also on Cloudflare Workers AI) reads the text of the conversation and decides what to say next. Zogu's own code looks items up on the restaurant's menu, works out prices and builds the order. The replies you hear come from a text-to-speech voice (Deepgram Aura-2, on Cloudflare Workers AI).
5. If you've ordered from that restaurant by phone through Zogu before, from the same number, the phone agent greets you by first name. Ask for "same as last time," and it puts your last order there back in and checks each item against today's menu. It only looks at earlier Zogu phone orders at that restaurant. It doesn't use your app, web or in-store history, and it doesn't look up withheld numbers.
6. When you say yes to the read-back, the order goes to the restaurant's POS. It carries your first name (and last name, if you gave one), your phone number, the items and any notes like "no onions." A delivery order also carries your address and any delivery instructions. The restaurant's accept or reject comes back later and updates our record.
7. We save a written transcript of both sides of the call, the order and how the call ended. If you hang up before ordering, nothing goes to the restaurant, but the call record stays, with whatever you said.

The phone agent never asks for card details on the call. Please don't read out a card number, a Social Security number or anything else sensitive, because everything you say goes into the transcript.

The only audio we keep is the phone agent's own voice, saved for phrases it says often, such as a restaurant's greeting, so it can answer without a pause. A returning caller's greeting includes their first name, so a saved greeting can too. We keep up to 200 of these phrases across all restaurants and drop the least recently used.

We don't create voiceprints, and we don't identify anyone by their voice. You're recognized only by the number you call from.

03Notice at collection for callers

This is what we collect on calls, on behalf of the restaurant you called, in the categories the CCPA uses. Restaurants that use Zogu can include this section in their own notice at collection.

We get it from you (what you say on the call), from your phone company through Twilio (the number you call from), and from the restaurant and its POS (its menu and the status of your order).

[Nothing deletes call records automatically yet: no retention job covers the database, the call's Durable Object storage, greeting clips that contain names, or Twilio's call logs. Until one is built, deletion is done by hand on request, and these periods are still being set. Tell the lawyer this before filling them in.] We'll set these periods by how long a restaurant needs records to deal with questions about an order and to recognize returning callers. A restaurant can tell us to delete its call records sooner. Copies of orders also sit in our log of messages exchanged with our POS integration platform for [__ days], and system logs with call IDs, timings and errors are kept for [__ days]. When we delete records, copies can stay in our database's restore history for up to 30 days.

We don't collect precise geolocation or biometric identifiers, and we don't ask for card or bank details. We don't analyze your calls to predict your preferences or other personal characteristics. We do not sell or share any of this information.

04How we work as a restaurant's service provider

Each restaurant that uses Zogu signs a written contract with us, including the data processing terms in sections 4 and 5 of our US terms. Under them, for caller information, we:

• use it only to provide Zogu to that restaurant (answering its calls, placing its orders and keeping its call records), to support, secure and improve the service, and as the law requires;
• do not sell it or share it for cross-context behavioral advertising;
• do not keep, use or disclose it outside our direct business relationship with that restaurant;
• do not combine it with personal information from other restaurants, or from our own dealings with you, except where the CCPA allows;
• follow the CCPA, and tell the restaurant if we can no longer meet these obligations;
• let the restaurant take reasonable steps to check how we use it and to stop any use it hasn't allowed;
• help the restaurant answer requests from callers.

In states whose laws use the terms controller and processor, the same contract also has us keep caller information confidential, delete or return it when the restaurant stops using Zogu, hold our own subprocessors to the same terms, and give the restaurant the information it needs for any assessment its state requires.

Each restaurant's callers are kept apart. The returning-caller greeting and "same as last time" only look at earlier Zogu phone orders at the restaurant you're calling, so ordering from one restaurant that uses Zogu doesn't make you known to another.

We read transcripts to find and fix the phone agent's mistakes, such as hearing part of an order as a name. The CCPA allows a service provider to use information to improve its own service, within limits, and a fix made from one restaurant's call goes into the software every restaurant uses. When we copy a call into our tests or quote it anywhere, we take out names, phone numbers, addresses and the restaurant's name first. We don't train AI models on call data.

If you send us a request about a call to a restaurant, we'll pass it to that restaurant within [__ business days] and help it respond. We may also suggest you contact the restaurant directly, since it decides. When the restaurant tells us to delete or correct something, we do it, and we pass the instruction on to any of our service providers that hold a copy.

05Information we collect for our own business

For our own business, we collect the following. This table is our notice at collection for it.

Card details for our fees are entered on [Payment processor]'s pages and never reach us.

This site doesn't use advertising cookies or tracking pixels. Our Cookie Policy lists what it does use.

06The web demo

This site has a demo of the Zogu agent that you can type or talk to. There's no restaurant behind it, so we handle that information for our own business.

Nothing from the demo goes into our call records, and no demo order reaches a restaurant or its POS. Please don't type real names, addresses, phone numbers or card details.

If you use the microphone, the speech-to-text is done by your browser, not by Zogu. Chrome sends your voice to Google and Safari sends it to Apple to turn it into text, under their own privacy terms. If you'd rather not, type instead.

07Who receives personal information

We disclose personal information only to the recipients below, and only what each one needs.

• The restaurant you called. It gets your order in its POS and can ask us for the call record.
• The restaurant's POS, and the POS integration platform that connects it to Zogu: the restaurant's own systems for its menu and orders. They aren't our service providers: they receive the order for the restaurant and send the restaurant's accept or reject back to us.
• Twilio, which provides our phone lines. It connects the call, carries the audio and keeps its own log of each call (the numbers, the time and the length) in our account for [__ days].
• Cloudflare, which hosts Zogu and our database, and runs speech recognition, the language model and the text-to-speech voice on Workers AI.
• [Payment processor], for restaurants paying our fees.
• Lawyers, accountants and other professional advisers, when they need it to advise us.
• Courts, law enforcement or regulators, when the law requires it or to protect someone's safety.
• A buyer or successor, if our business is sold or merged, on the terms of this policy.

[Pay by link is built but switched off: after the yes, the agent can offer to text the caller a secure card-payment link (Stripe Checkout, sent by Twilio SMS), and texts a refund notice if the kitchen rejects a paid order. Decide whether it's part of the launch. If it is, rewrite this clause, add Stripe and Twilio SMS to the sub-processors and privacy policies, and have counsel review the consent wording for texts (TCPA and A2P 10DLC in the US, PECR in the UK). If it isn't, make it impossible to switch on for live stores.] Twilio, Cloudflare and [Payment processor] are our service providers and process personal information for us under contract. In the past 12 months, we've disclosed the categories in the tables above only to these recipients, and only for the purposes listed there.

We do not sell or share personal information

We do not sell personal information, and we do not share it for cross-context behavioral advertising, as the CCPA defines those terms. We haven't done either in the past 12 months, and that includes information about people under 16. We don't give personal information to other companies for their own direct marketing, which is what California's Shine the Light law (Civil Code section 1798.83) covers.

We use sensitive personal information only to provide the service and for the other purposes the CCPA permits, and never to infer characteristics about anyone, so the right to limit its use doesn't apply.

If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of sale and sharing. We do neither, so nothing changes. This site doesn't track you across other websites or let third parties do so: it sets no cookies, and its fonts and scripts come from the site itself. It responds the same way to Do Not Track signals.

We don't offer financial incentives for personal information. If we ever plan to sell or share personal information, we'll update this policy and give you a way to opt out before we start.

08Your privacy rights and how to use them

If you live in California, you have the right to:

• know what personal information we collect, use and disclose about you, and get a copy;
• delete it;
• correct it if it's wrong;
• opt out of its sale or sharing (we do neither);
• limit the use of your sensitive personal information (our use doesn't trigger this right);
• not be treated differently for using these rights. We won't refuse service, charge you more or give you a worse service.

If you live in another state with its own consumer privacy law ([states confirmed by counsel]), you have similar rights: to confirm whether we process your personal data and to see it, to correct it, to delete it, to get a portable copy, and to opt out of targeted advertising, the sale of personal data, and profiling used for decisions about things like credit, housing or jobs. We don't use personal data for any of those. Where your state gives you a right to appeal our decision, you have that as well.

The phone agent's automated decisions are about your order, such as which menu item you meant. It doesn't make decisions about credit, housing, jobs, education or health care.

How to make a request

If you called a restaurant, the quickest route is the restaurant itself, because it decides. You can also send your request to us, and we'll pass it on and help.

Email [privacy email], call [toll-free number] or write to us through our contact page. Tell us the restaurant, the date and rough time of the call, and the number you called from. That's how we find the call.

How we check it's you

We match what you tell us against our records. For a copy of a transcript, or to delete one, we'll also ask for something the caller would know, such as an item you ordered, and, for a copy of a transcript, a signed statement, under penalty of perjury, that you made the call. [Counsel to confirm: the CCPA regulations call for that statement only for requests for specific pieces of information, so asking it for deletion may be an unreasonable barrier.] We use these details only to check who you are and answer you.

Someone else can make a request for you as your authorized agent if you give them signed permission. We may still ask you to confirm your identity with us directly.

When you'll hear back

We'll confirm we've received your request within 10 business days and answer within 45 calendar days. If we need longer, we'll tell you why and take up to 45 more days. For a request about a restaurant's call, we work to the restaurant's deadline and help it meet it.

We can't delete information that the law requires us or the restaurant to keep, such as tax records. If we keep something, we'll tell you what and why.

If we turn down your request and your state gives you a right to appeal, reply to our decision with "Appeal" in the subject line. We'll answer within [__ days] and explain our reasons. If you're not satisfied, you can contact your state attorney general.

09Security, storage, children and changes

From Twilio, call audio reaches Zogu over an encrypted connection, and this site and our connection to our POS integration platform use HTTPS. The access tokens it gives us are encrypted before we store them, and our staff console sits behind Cloudflare Access sign-in. No system is perfectly secure. If a breach affects personal information, we'll tell the restaurants affected without undue delay, and the people affected and regulators where the law requires it.

For a call to a US restaurant, we ask Cloudflare to run the part of Zogu that handles the call in eastern North America. Our database, which holds call records and orders, is hosted by Cloudflare in Western Europe, so those records are stored outside the United States. Twilio and Cloudflare, including Workers AI, may also process data in other countries where they operate.

Zogu is a service for restaurants, and this site isn't aimed at children. We don't knowingly collect personal information from children under 13 through this site. Anyone can call a restaurant's line, and the phone agent doesn't ask callers their age. If you're a parent or guardian and think your child's information is in a call record, contact us or the restaurant, and we'll work with the restaurant to delete it.

If you need this policy in another format, email [privacy email].

When we change this policy, we change the "last updated" date at the top, and only then. If a change is material, we'll email the restaurants that use Zogu at least [30] days before it takes effect.

Questions about this policy go to [Company name], [Registered address], by email to [privacy email] or by phone at [toll-free number].