Privacy Policy

OrderFlow AI (“OrderFlow,” “we,” “our”) is an AI-powered phone answering service for restaurants. We process phone orders, capture customer intent, and route structured tickets to restaurant teams.

Questions about this policy: privacy@orderflow-ai.com

• Service delivery — answering calls, capturing orders, routing tickets to your POS or kitchen display.
• Account management — onboarding, billing, support.
• Product improvement — aggregated, de-identified call data may be used to improve AI accuracy.
• Communications — transactional emails about your account. We do not send unsolicited marketing without opt-in.
• Legal compliance — we may retain records as required by applicable law.

OrderFlow AI may offer optional transactional text messages for a specific restaurant order, including an order confirmation, a secure payment link, and status updates. Texting is not a condition of placing or purchasing an order.

• We ask for an explicit verbal opt-in during the phone call before sending any order text.
• You may receive up to five messages for that order. Message and data rates may apply.
• Reply STOP to opt out or HELP for help.
• We retain the consent choice, timestamp, and source as an operational compliance record.

Mobile numbers and SMS consent records are never sold, rented, or shared with third parties or affiliates for marketing or promotional purposes. We disclose them only to service providers that help us deliver the requested transactional messages, or when required by law.

See the public SMS Consent & Messaging Disclosure for the exact opt-in flow.

We do not sell your data. We share information only with:

• Twilio — telephony and voice processing (subject to Twilio’s Privacy Policy).
• Google (Gemini) — AI inference for speech-to-intent processing.
• Railway — hosting for the live voice-call streaming service.
• Neon — managed PostgreSQL database hosting.
• Vercel — hosting and edge delivery.
• Resend — transactional email delivery (order notifications, receipts, account emails).
• PostHog — product analytics (anonymous visitor data).
• Payment processors — Stripe.

All sub-processors are under data processing agreements obligating them to protect your data.

• Call recordings: retained for 90 days, then automatically deleted unless you request longer retention for dispute resolution.
• Order data: retained for 2 years to support analytics and re-ordering features.
• Account data: retained for the duration of your subscription plus 90 days after cancellation.
• Analytics data: aggregated page events retained for 2 years; raw events for 12 months.

Depending on your location, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate information.
• Delete your account and associated data.
• Export your data in a portable format.
• Opt out of analytics tracking (contact us or use a browser opt-out).

To exercise any of these rights, email privacy@orderflow-ai.com. We will respond within 30 days.

We use TLS encryption in transit and AES-256 encryption at rest for sensitive data. Access to production systems is restricted to authorized personnel. We conduct periodic security reviews.

No system is 100% secure. If you believe your data has been compromised, notify us immediately at privacy@orderflow-ai.com.

OrderFlow AI is a business-to-business service. We do not knowingly collect data from anyone under 18. If you believe a minor has submitted data, contact us and we will delete it promptly.

We may update this policy as our services evolve. We will notify active subscribers by email at least 14 days before material changes take effect. Continued use after that date constitutes acceptance.

OrderFlow AI
privacy@orderflow-ai.com
(770) 525-5393