Privacy Policy

Product: RestaurantPilot AI
Operator: Adrian Apps, a sole proprietor in Idaho doing business as RestaurantPilot AI
Contact: 1221adrian@gmail.com
Mailing address: 595 S Wooddale Pl, Eagle, ID 83616

1. Who we are

RestaurantPilot AI is an online service for local restaurants. It is operated by Adrian Apps, a sole proprietor in Idaho doing business as RestaurantPilot AI. It helps restaurant owners draft and, after the owner approves, manage things like review replies, social posts, customer-support answers, and (later) email campaigns.

This policy explains what information we collect, how we use it, who we share it with, and how you can ask us to delete it. It is written for a small U.S. business based in Idaho and for restaurant customers in the United States.

If something in this policy does not match what the product actually does, the product’s real practice and the law control — and we should update this page.

2. What is live today, and what comes later

We want this policy to stay honest.

• Today, you can browse the public site, send a demo request, and create a customer account. Online checkout is not open yet, so we are not collecting card payments on the site today.
• When billing goes live, we will use Stripe to process subscription payments, as described below.
• Google Business Profile reviews are planned. Restaurant owners will connect their own Google account through official Google sign-in (not by giving us a Google password). That connection is not turned on for customers yet. This policy already describes what we will do when it is, so you can read it before you connect.
• Email campaigns to a restaurant’s guests are also planned and not a live sending feature today. This policy already describes how we intend to handle guest emails and CAN-SPAM rules when that feature is offered.

If we start using information in a new way — especially Google data — we will update this policy and, where required, ask for your consent first.

3. Information we collect

3.1 Information you give us

Demo or contact requests. If you use our demo or contact form, we collect the information you submit. Today that includes your name, email, phone number (optional), restaurant name, city (optional), how many locations you have, which tools you are interested in, your message, and your confirmation that we may contact you about the request. The form also includes a hidden field used only to catch automated spam; people should leave it blank.

Accounts. If you create an account, we collect your name, email address, restaurant name, and a password you choose. We also store information needed to run your account, such as sign-in time and your role at the restaurant (for example, owner). You can also sign in with Google or with Lovable. If you do, we receive basic account information from that provider (typically your name, email address, and a unique account identifier) so we can create or open your RestaurantPilot AI account. We do not receive your Google or Lovable password.

Restaurant information you enter or approve. To draft useful replies and posts, the service needs facts about your restaurant that you provide or approve — for example menus, hours, policies, frequently asked questions, brand voice, and similar business details. In some practice or preview tools, information you type may stay only in your browser until you refresh or leave the page and may not be saved to our servers. When you use the live product to save restaurant information, that information is stored so your team can use it later.

Messages and approvals. We collect the questions, prompts, draft text, edits, and approvals you and your team submit in the product. Nothing is posted to a public review site, social network, or email list unless you (or someone you authorize) approve it and the required connection or recipient list is in place.

Guest or subscriber lists (later, for email campaigns). If and when email campaigns are offered, a restaurant may upload or collect email addresses and related subscription details for people who have agreed to hear from that restaurant. We treat that list as the restaurant’s customer data that we process to provide the service. We do not want, and the product is not meant to be used with, purchased or scraped email lists.

3.2 Payment information (when billing is live)

When online checkout is turned on, we will use Stripe as our payment processor (a service provider) to handle subscription payments.

• Your card or other payment details are collected and processed by Stripe. We do not receive or store your full card number or security code on RestaurantPilot AI servers.
• We may store information Stripe sends us so we can run your subscription — for example a Stripe customer or subscription ID, payment status, the last four digits and expiration of a card, and billing email or address if provided.
• Stripe has its own privacy policy and terms. Please read them when you pay: https://stripe.com/privacy.

Until checkout is open, do not send us card numbers by email or through a demo form. We are not set up to take cards that way.

3.3 Google Business Profile information (when you connect)

When this feature is enabled and a restaurant owner chooses to connect Google Business Profile, we will use official Google authorization. We will not ask for your Google password.

The planned access is limited to what the feature needs: basic Google account identifiers (such as openid and email) and Google Business Profile management access (https://www.googleapis.com/auth/business.manage) so we can read location and review information and, only after you approve a reply, submit that reply on your behalf.

We may store, for as long as the connection is active or as needed to provide the feature:

• the fact that you connected, and which Google locations you selected
• review text, ratings, reviewer display names, and related review metadata Google provides
• draft replies, your approvals or rejections, and whether a reply was sent
• encrypted access credentials (tokens) needed to keep the connection working, and a record of important connection events

You can disconnect Google in the product when that control is available, or by removing RestaurantPilot AI’s access in your Google account. After you disconnect, we will stop new access and delete or revoke stored tokens. We may keep limited records of the connection and of replies you already approved, as described in “How long we keep information.”

Limited Use. RestaurantPilot AI’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In plain terms, that means:

• We use Google user data only to provide or improve the visible RestaurantPilot AI features you connect it for — today, signing in with Google (if you choose that option), and later, helping you read Google Business Profile reviews and draft or post owner-approved replies.
• We do not sell Google user data.
• We do not use Google user data for advertising, including retargeting or personalized ads.
• We do not use Google user data to determine creditworthiness.
• We do not allow people to read your Google user data except with your affirmative agreement for a specific need, or when it is necessary for security, to fix a problem, or to comply with the law, or when the data has been aggregated so it no longer identifies you.
• If we need to use Google user data in a new way, we will update this policy and ask for your consent before doing so.

3.4 Information collected automatically

When you use the site, our hosting and account systems may automatically collect ordinary technical information such as IP address, browser type, device type, date and time, pages or actions in the product, and referring URL. We use this to operate, secure, and debug the service.

Lovable’s analytics records clicks on buttons and links, page visits, time on page, page speed and errors for every visitor. It records the pages visited, where visitors came from, their country, browser, operating system and device type. It uses no cookies, stores nothing on the visitor’s device, doesn’t keep IP addresses and doesn’t identify visitors. Lovable collects this data for us. Lovable’s privacy policy explains how it handles it. Detailed data is kept for 90 days and daily summaries for a year.

We do not use third-party advertising pixels or marketing-analytics software in the RestaurantPilot AI application code.

The site may use cookies and similar technologies, including:

• Essential cookies needed to sign you in and keep your session open (our account provider).
• A simple preference cookie used only to remember whether a navigation sidebar is open or closed.
• Hosting or security cookies and logs set by our website host or its infrastructure (for example, to deliver the site or to help block abuse). We do not control every cookie a host or content-delivery network may set.
• Fonts and sign-in. The public site loads fonts from Google’s servers. If you choose “Continue with Google,” Google also processes that sign-in. If you choose “Continue with Lovable,” Lovable processes that sign-in.

You can block cookies in your browser, but sign-in and some site features may not work without essential cookies.

3.5 Information we do not want

Please do not submit sensitive personal information we do not need — for example Social Security numbers, health records, or your customers’ payment card numbers. Do not put other people’s personal data into restaurant information, AI prompts, or email lists unless you have a right to do so and it is needed for the service.

The service is built for restaurant businesses, not for collecting children’s data.

4. How we use information

We use the information described above to:

• respond to demo and support requests, and tell you about RestaurantPilot AI when you have asked us to
• create and secure your account, including password resets and sign-in
• provide the service: store your restaurant information, draft AI content from what you have approved, show you drafts, and (only after approval and a valid connection or recipient list) help you publish or send
• process payments and keep billing records when checkout is live, through Stripe
• connect to Google Business Profile when you ask us to, and only for the uses described in this policy
• maintain, secure, and improve the product, prevent fraud and abuse, and meet legal obligations
• send service messages about your account (for example, security or billing notices)

We use third-party AI providers to generate drafts from the restaurant information and instructions you provide. The text needed to create a draft may be sent to those providers for that purpose. We do not sell that information. We do not use your restaurant, account, guest, or Google user data to train a general AI model that we sell or make available to the public, and we do not allow those providers to use it for their own advertising. If that practice ever changes, we will update this policy before relying on the new practice.

5. How we share information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

We share information only in these situations:

• Service providers who help us run RestaurantPilot AI, under obligations to use the data only to provide their service to us. Today that includes our website host (Lovable), our database and account provider (Supabase), and, when billing is live, Stripe for payments. When you use Google sign-in or connect Google Business Profile, Google also processes the data involved in that feature. AI providers process prompts and drafts as described above. Email delivery providers may be used later to send campaigns or transactional mail you request.
• At your direction. For example, when you approve a review reply or social post, we send the approved content to the platform you connected (such as Google or a social network), or when you approve an email campaign, we send it to the addresses you provided.
• Legal, safety, and business transfers. We may disclose information if we believe it is reasonably necessary to comply with law, a valid legal process, or a government request; to protect the rights, safety, or security of RestaurantPilot AI, our customers, or the public; or in connection with a merger, acquisition, or sale of assets, in which case we will take reasonable steps to require the recipient to honor this policy or we will give you notice.

Our service providers and the platforms you connect have their own terms and privacy policies.

6. Email, marketing, and CAN-SPAM

There are two different kinds of email.

Email we send you (the restaurant owner or person who contacted us). If you submit a demo request or create an account, we may email you about that request or about your account. You can ask us to stop promotional email by using the unsubscribe link in that message or by writing to 1221adrian@gmail.com. We may still send non-promotional service messages (for example, about security, a bill, or a material change to this policy).

Email campaigns you send to guests (later). When this feature is offered, RestaurantPilot AI will help a restaurant send messages only to people the restaurant represents have agreed to hear from that restaurant. We will require an easy unsubscribe method, honor opt-out requests promptly and in any event within 10 business days, include a valid physical postal address in commercial messages, and avoid false or misleading header or subject information — consistent with the U.S. CAN-SPAM Act and the FTC’s CAN-SPAM Act: A Compliance Guide for Business.

The restaurant is responsible for having permission to email its list, for the content it approves, and for complying with CAN-SPAM and any other law that applies to its messages. RestaurantPilot AI is not to be used to email purchased, rented, scraped, or otherwise non-consented lists, or to keep emailing someone who has opted out.

7. How long we keep information

We keep information only as long as we need it to provide the service, to keep records we reasonably need for security, accounting, dispute resolution, or the law, or as you have asked us to keep it.

• Demo requests: kept long enough to respond and follow up, then deleted or reduced to a minimal record if we still need a history of the inquiry.
• Account and restaurant information: kept while the account is open, and for a reasonable period afterward if needed to close the account, resolve a bill, or meet a legal duty.
• Google connection tokens: kept while the connection is active, then revoked or deleted when you disconnect or the account is deleted.
• Billing records: kept as needed for tax, accounting, and Stripe’s records.
• Backups: may exist for a limited time after deletion until they cycle out.

8. How we protect information

We use reasonable administrative, technical, and physical safeguards appropriate to a small online service — including encrypted connections (HTTPS), access controls, and, for Google connection credentials, encryption at rest. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If we learn of a security breach involving personal information of Idaho residents, we will notify affected people as required by Idaho Code § 28-51-105, without unreasonable delay after we determine that misuse has occurred or is reasonably likely to occur. Where other states’ breach-notice laws apply, we will follow those as well.

9. Your choices, including deletion requests

You can:

• correct account or restaurant information in the product, or by emailing us
• disconnect a connected platform when that control is available, or revoke access in that platform’s own settings (including your Google account)
• unsubscribe from promotional email as described above
• ask us to access, correct, or delete personal information we hold about you

To request deletion or a copy of your data, email 1221adrian@gmail.com from the email address on the account, and include the restaurant name. We may ask for reasonable information to confirm it is you. We will respond within 30 days.

When we grant a deletion request, we will delete or de-identify the account, restaurant information, guest lists, Google tokens, and similar data we hold, except information we must keep for a legal, security, tax, or accounting reason (for example, invoices or a record that a request was fulfilled). Content you already published to Google, a social network, or an email inbox may remain there; you may need to handle that on those services. Stripe may also keep payment records under its own policies.

Idaho does not currently have a general consumer privacy statute like some other states. If you are a resident of a state or country that gives you additional rights, tell us in your request and we will honor those rights as required by applicable law. We will not discriminate against you for asking.

10. Children

RestaurantPilot AI is a business service for restaurants. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13. You must be old enough to enter a binding contract in your state (generally 18) to create an account. If we learn that we have collected personal information from a child under 13, we will delete it.

11. Changes to this policy

We may update this policy from time to time. We will post the new version on this page and change the “Last updated” date. If a change is material — especially a new use of Google user data — we will give additional notice (for example, by email or an in-product message) and obtain any consent the law or Google’s rules require before relying on the new use.

12. How to contact us

Questions, privacy concerns, and deletion or access requests:

Email: 1221adrian@gmail.com
Mail: Adrian Apps, 595 S Wooddale Pl, Eagle, ID 83616