This Privacy Policy describes how Liberty IT Technology and Solutions ("BistroAI", "we", "our", or "us") collects, uses, and shares information when you use the BistroAI platform, including our website at bistroai.us and our voice AI ordering service (collectively, the "Service").

1. Information We Collect

From restaurant operators (merchants):

Account registration information: name, business name, email address, phone number
Square account data accessed via OAuth: merchant ID, location IDs, catalog items, order data, payment data
Billing information (processed by our payment provider)

From restaurant customers (callers):

Name and phone number (provided voluntarily during the ordering call)
Order details: items ordered, quantities, special instructions
Call recordings and transcripts (for order processing and quality assurance)

Automatically collected:

Server logs: IP addresses, request timestamps, API usage
Call metadata: call duration, caller ID (from the phone carrier)

2. How We Use Your Information

To process and fulfill food orders placed via the BistroAI voice AI
To create and manage orders in Square on behalf of the restaurant operator
To send SMS payment links to customers who choose to pay in advance
To provide call transcripts and order history to restaurant operators
To improve the accuracy and quality of our AI ordering agent
To send transactional notifications to restaurant operators
To comply with legal obligations

3. Square Integration

BistroAI integrates with Square via their official OAuth API. When a restaurant operator connects their Square account, BistroAI receives access to their Square catalog, locations, and order management data solely to operate the voice ordering service. We access only the Square API scopes required for order processing (Orders, Payments, Catalog, Locations). We do not access Square customer loyalty data, financial reports, or employee data.

Square's privacy policy governs your relationship with Square: squareup.com/legal/privacy

4. Data Sharing

We do not sell your personal information. We share data only as follows:

With Square: Order data is sent to Square's API to fulfill orders on the POS
With Vapi.ai: Voice calls are processed by Vapi's AI platform, subject to their privacy policy
With SMS providers: Customer phone numbers are used solely to deliver order confirmations and payment links
With service providers: Cloud hosting, database, and analytics vendors under confidentiality agreements
As required by law: When compelled by a valid legal process

5. Data Retention

Call recordings: retained for 90 days, then automatically deleted
Call transcripts and order records: retained for 2 years for operator review
Account data: retained while your account is active, deleted within 30 days of cancellation upon request

6. Your Rights

Depending on your location, you may have rights to access, correct, or delete your personal data. Restaurant operators can export or delete their order and call data from the BistroAI dashboard. To exercise any rights or for data deletion requests, contact us at privacy@bistroai.us.

7. Security

BistroAI uses industry-standard security measures including TLS encryption for all data in transit, encrypted storage of access tokens, and regular security reviews. Square OAuth tokens are encrypted at rest and never exposed to third parties.

8. Children's Privacy

BistroAI is not directed at individuals under 13. We do not knowingly collect personal information from children.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify restaurant operators of material changes via email or in-app notification. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

10. Contact Us

Liberty IT Technology and Solutions
Email: privacy@bistroai.us
Support: support@bistroai.us