Privacy Policy

This Privacy Policy explains how BistroLift ("BistroLift," "we," "our," or "us") collects, uses, discloses, and protects information in connection with our AI-powered restaurant ordering and growth platform (the "Services").

Throughout this Privacy Policy, "Merchant" or "Restaurant" refers to a restaurant business that registers for and uses the Services, and "Customer" refers to an individual who places an order or otherwise interacts with a Restaurant's BistroLift-powered digital menu or ordering experience. By accessing or using the Services, you agree to the practices described in this Privacy Policy.

Who This Policy Covers

This Privacy Policy applies both to Restaurants that use BistroLift to operate their business, and to Customers who interact with a Restaurant's digital menu or online ordering experience. Some sections of this Privacy Policy apply specifically to one group; where that is the case, it is stated clearly.

About Our Services

BistroLift is an AI-powered restaurant ordering and growth platform. The Services currently include:

• AI-powered digital menu
• Online ordering
• AI Ordering Assistant
• AI-powered upsell recommendations
• Restaurant analytics dashboard
• AI Restaurant Manager
• Marketing automation
• Review automation
• Customer profile management
• Menu synchronization with Clover
• Clover POS integration
• Optional online payments through Clover Ecommerce

This Privacy Policy describes our practices for the Services as they currently exist. As BistroLift introduces new features or integrations, we will update this Privacy Policy accordingly.

Current Integrations

BistroLift currently integrates with:

• Clover POS, for menu synchronization and order processing
• Clover Ecommerce, for optional online payment processing
• Google Cloud Platform, for hosting and infrastructure

BistroLift also uses third-party AI service providers to power certain AI features of the Services, as described in the "Artificial Intelligence" section below.

BistroLift may integrate with additional third-party services in the future. If we do, we will update this Privacy Policy to reflect those changes before they take effect.

Information We Collect

Information Provided by Restaurant Owners

When a Restaurant registers for and uses the Services, we may collect information such as:

• Name
• Email address
• Phone number
• Business name
• Restaurant profile information
• Business address
• Account credentials

Information Received from Clover

After a Merchant authorizes BistroLift to connect to their Clover account, we may access the following information from Clover, limited to what is necessary to provide the Services:

• Restaurant information
• Menu items
• Categories
• Modifier groups and modifiers
• Prices
• Inventory availability
• Orders
• Payment status
• Merchant configuration

We access this information only as needed to synchronize menus, process orders, and provide the Services to the Merchant. See "POS Integrations" below for more detail on how this connection works.

Customer Information

When Customers place an order or otherwise voluntarily provide information through a Restaurant's BistroLift-powered digital menu or ordering experience, we may collect:

• Name
• Email address
• Phone number
• Order details

A Customer's email address and phone number are used solely to send promotional offers, updates, and other communications on behalf of the Restaurant where a Customer has ordered. BistroLift does not use this information to send unrelated or unsolicited marketing, and does not sell or share it with third parties for advertising purposes.

This information is collected on behalf of, and at the direction of, the Restaurant. Restaurants are solely responsible for obtaining any consents required by applicable law before collecting or using Customer information, and for providing Customers with any legally required notices.

Automatically Collected Information

When you use the Services, whether as a Restaurant or a Customer, we may automatically collect:

• Device information
• Browser information
• IP address
• Operating system
• Pages visited
• Usage statistics
• Log information

Cookies

We use cookies and similar technologies, including:

• Authentication cookies, to keep you signed in
• Session cookies, to maintain your session while using the Services
• Preference cookies, to remember your settings
• Analytics cookies, to help us understand how the Services are used
• Security cookies, to help detect and prevent fraudulent activity

You can manage or disable cookies through your browser settings. Disabling certain cookies may affect the functionality of the Services.

How We Use Information

We use the information we collect to:

• Operate and provide the Services
• Synchronize restaurant menus
• Process customer orders
• Process online ordering
• Provide AI-powered recommendations
• Generate analytics
• Help restaurants improve their operations
• Detect and prevent fraud
• Improve the security of the Services
• Respond to support requests
• Improve platform performance

Artificial Intelligence

BistroLift uses artificial intelligence to provide:

• The AI Ordering Assistant
• Menu recommendations
• Upsell suggestions
• Business insights through the AI Restaurant Manager
• Restaurant analytics
• Marketing content suggestions

AI outputs are generated automatically and may not always be accurate. AI outputs should not be considered legal, financial, accounting, tax, or other professional advice. Restaurant owners remain responsible for reviewing AI-generated content and for the business decisions they make using the Services.

To provide these features, BistroLift may share information necessary to generate the relevant output, such as menu data, order history, or business performance data, with third-party AI service providers. These providers are contractually restricted from using this information for any purpose other than providing the requested output to BistroLift.

POS Integrations

BistroLift connects to Clover using Clover's OAuth authorization process. This means:

• BistroLift never stores a Merchant's Clover login credentials.
• OAuth access tokens issued by Clover are stored securely.
• Merchants control the scope of the authorization granted to BistroLift.
• Merchants may disconnect BistroLift from their Clover account at any time.

Payment Processing

Restaurants may enable online payments through Clover Ecommerce.

• Payment card information is processed directly by Clover.
• BistroLift does not store complete payment card information.
• Payment security is handled by Clover.

Customer Data Ownership

Customer data collected through a Restaurant's use of the Services belongs to that Restaurant. BistroLift processes Customer data solely to provide the Services to the Restaurant under our agreement with that Restaurant.

BistroLift does not:

• Sell Restaurant Customer data
• Use Restaurant Customer data for unrelated advertising

Sharing Information

BistroLift does not sell personal information. We may share information only where necessary, with:

• Cloud hosting providers
• Third-party AI service providers
• Clover
• Government authorities, when legally required

Security

We implement administrative, technical, and organizational safeguards designed to protect information, including:

• TLS encryption for data in transit
• Encrypted storage where appropriate
• Authentication controls
• Access controls
• The principle of least privilege
• Logging of system activity
• Secure cloud infrastructure
• Security monitoring

No security system is completely secure.

Data Retention

We retain information for as long as necessary to provide the Services, including:

• Merchant accounts, for as long as the account remains active, and for a reasonable period afterward
• Orders, for as long as necessary to support the Restaurant's operations and legal obligations
• Analytics, for as long as necessary to provide reporting and insights
• Support requests, for as long as necessary to resolve the request and maintain a record

We may retain information for longer where required by applicable law.

International Data Transfers

BistroLift and our service providers may process and store information in the United States and other countries where we or our service providers operate. Your information may therefore be transferred to, and processed in, a country other than the one in which it was originally collected.

California Privacy Rights (CCPA)

If you are a California resident, applicable law may give you the following rights regarding your personal information:

• Right to Know: request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to Access: request a copy of the personal information we hold about you.
• Right to Correct: request correction of inaccurate personal information, where applicable.
• Right to Delete: request deletion of personal information we have collected, subject to certain exceptions.
• Right to Non-Discrimination: we will not discriminate against you for exercising any of these rights.

To submit a request, contact us using the information in the "Contact Us" section below. We may need to verify your identity before fulfilling your request.

GDPR

If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with similar data protection laws, you may have the following rights regarding your personal data:

• Access: request confirmation of whether we process your personal data, and access to that data.
• Rectification: request correction of inaccurate or incomplete personal data.
• Erasure: request deletion of your personal data, subject to certain exceptions.
• Restriction: request that we limit how we use your personal data in certain circumstances.
• Data Portability: request a copy of your personal data in a structured, commonly used format.
• Objection: object to certain processing of your personal data.
• Withdrawal of Consent: where processing is based on consent, withdraw that consent at any time.

To exercise any of these rights, contact us using the information in the "Contact Us" section below.

Children's Privacy

The Services are not intended for children under the age of 13, or the applicable minimum age in your jurisdiction. BistroLift does not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can take appropriate action.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Services, or applicable law. When we make material changes, we will update the "Last Updated" date at the top of this page and, where appropriate, provide additional notice, such as posting a notice on our website or notifying Merchants directly.

Contact Us

If you have questions about this Privacy Policy, or wish to exercise any of the rights described above, please contact:

BistroLift
Email: hello@bistrolift.com
Website: www.bistrolift.com
One Riverway, Suite 1700, Houston, TX 77056, United States