Privacy Policy

1. Information We Collect

We collect and process the following categories of information: (a) account registration data such as name, email address, phone number, and business details; (b) business profile data including restaurant name, address, menu information, operating hours, and branding assets; (c) order and transaction records including counterparty information, order details, and payment-adjacent data; (d) lead and messaging data from customer inquiries, review responses, and marketing communications; (e) integration metadata from connected third-party platforms such as Square, Toast, Stripe, Google Business Profile, and social media accounts; (f) usage and analytics data including page views, feature usage, and system performance metrics; and (g) device and browser information collected automatically through cookies and similar technologies.

2. Google User Data

When you connect your Google account through our platform, we access certain Google user data through OAuth 2.0 authorization with your explicit consent. Specifically:

• Gmail Send Access (gmail.send): We use this scope to send transactional emails on your behalf, including order confirmations, follow-up messages, review requests, invoices, and marketing communications to your restaurant customers. Emails are sent directly from your connected Gmail account.
• Gmail Read Access (gmail.readonly): We use this scope to verify that emails sent through the platform were successfully delivered and to surface incoming customer replies within your platform dashboard so you can manage communications without switching to Gmail.
• Google Business Profile (business.manage): We use this scope to manage your Google Business Profile listing, including publishing posts, offers, and updates on your behalf, and retrieving customer reviews to display within your platform dashboard.

We do not use Google user data for advertising purposes. We do not allow third parties to use Google user data. We do not sell, rent, or share Google user data with any external party. Google user data is only accessed when you explicitly authorize it through the Google OAuth consent screen and is used solely for the functionality described above. You may revoke access at any time through your Google Account permissions at myaccount.google.com/permissions.

The Alis Restaurants Platform's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not use Google user data to develop, improve, or train generalized or non-personalized AI and/or ML models. Any AI-powered features within the platform (such as content generation or analytics) operate independently of Google user data and do not access, process, or learn from information obtained through Google API scopes.

3. Facebook & Instagram Data

When you connect your Facebook or Instagram account through our platform, we access certain data from Meta Platforms ("Meta") through OAuth 2.0 authorization with your explicit consent. Specifically:

• Facebook Pages (pages_show_list, pages_read_engagement, pages_manage_posts, pages_manage_metadata): We use these permissions to list your Facebook Pages, read engagement metrics, publish posts on your behalf, and manage page settings to support your restaurant's social media presence.
• Instagram Publishing (instagram_basic, instagram_content_publish): We use these permissions to access your Instagram Business Account linked to your Facebook Page and publish content to Instagram on your behalf.
• Business Management (business_management): We use this permission to verify your business identity and manage business assets connected to your Facebook Business Portfolio.
• Instagram Account Profile (instagram_business_basic): When you connect Instagram directly via Instagram Login, we use this permission to fetch your Instagram Business or Creator account profile (handle, account type) so we can confirm the account is eligible and display it in your dashboard.
• Instagram Content Publishing (instagram_business_content_publish): We use this permission to publish images, carousels, and Reels to your Instagram Business or Creator account from the KitchenRush content calendar.
• Instagram Comments Management (instagram_business_manage_comments): We use this permission to read comments customers leave on your Instagram posts and to reply to them on your behalf from your KitchenRush inbox. The platform's AI assistant may draft replies for you to review and send, or send replies automatically on your behalf when you have enabled auto-reply.
• Instagram Direct Messages (instagram_business_manage_messages): We use this permission to receive direct messages customers send to your Instagram account and to reply on your behalf from your KitchenRush inbox. AI-drafted replies are clearly marked as automated, sent within Meta's standard messaging window, and escalated to you under Meta's Human Agent policy when needed.
• Instagram Insights (instagram_business_manage_insights): We use this permission to read account-level, post-level, and story-level performance metrics (reach, impressions, engagement, plays, replies) and surface them in your KitchenRush analytics dashboards. We capture story metrics via webhook before stories expire so historical performance is preserved.

Data we store: We store your Facebook User ID, name, Page access tokens, Page ID and name, and Instagram Business Account ID and username. Access tokens are stored encrypted and are used solely to publish content and read page engagement on your behalf.

Data we do NOT store: We do not store your Facebook password, friends list, personal timeline posts, private messages, photos, or any data from your personal Facebook profile beyond the public name and User ID needed for authentication.

We do not sell, rent, or share Meta Platform Data with any third parties. We do not use Meta data for advertising, profiling, or any purpose beyond operating the platform features you authorized. You may disconnect Facebook/Instagram at any time from your Owner Settings, which immediately revokes our access. You may also remove the app from your Facebook account at facebook.com/settings → Apps and Websites. Upon removal, we automatically delete all stored Meta Platform Data in compliance with Meta's data deletion requirements.

4. How We Use Your Information

We use collected information to: operate and maintain your workspace; process and fulfill orders; send transactional and marketing communications on your behalf; provide customer support; deliver platform features including onboarding, integrations, and analytics; improve platform reliability and performance; comply with legal and regulatory requirements; and protect against fraud and unauthorized access. We do not intentionally use one restaurant's private data to operate another restaurant workspace.

5. Data Sharing and Disclosure

We do not sell your personal information. We may share data with: (a) service providers who assist in operating the platform (hosting, payment processing, email delivery) under contractual obligations to protect your data; (b) connected third-party integrations that you explicitly authorize (e.g., Square, Stripe, Google Business Profile); and (c) legal authorities when required by law, court order, or governmental regulation. We maintain strict tenant isolation — your workspace data is never shared with other restaurant operators on the platform.

6. Data Security

We implement industry-standard security measures to protect your information, including: encryption of data in transit (TLS/SSL) and at rest; secure authentication and access controls; regular security assessments; workspace-level data isolation ensuring no cross-tenant access; and secure handling of API credentials and OAuth tokens. While no system is completely immune to security threats, we are committed to protecting your data using commercially reasonable measures.

7. Data Retention

We retain your data for as long as your account is active or as needed to provide services. Data retention periods are based on operational, contractual, and legal requirements. When you close your account, we will delete or anonymize your data within a reasonable timeframe unless retention is required by law. Email metadata used for delivery tracking is retained only as long as operationally necessary.

8. Your Rights

You have the right to: access the personal data we hold about you; request correction of inaccurate data; request deletion of your data (subject to legal retention requirements); export your data in a portable format; withdraw consent for optional data processing; and revoke third-party integration access at any time. To exercise any of these rights, contact us at the email address below.

9. Cookies and Tracking

We use essential cookies to maintain your session and provide core platform functionality. We may use analytics cookies to understand how features are used and improve the platform experience. You can manage cookie preferences through your browser settings.

10. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of significant changes by posting a notice on the platform or sending an email to your registered address. Your continued use of the platform after changes take effect constitutes acceptance of the updated policy.

11. SMS & Messaging Privacy

When you opt in to the KitchenRush Messaging Program (operated by Ali's Industries LLC) or to SMS from a restaurant operating on the platform, we collect your mobile phone number, your opt-in source (web form, keyword response, or in-person request), the opt-in timestamp, and the content of messages you send to or receive from the platform. Full SMS program terms — including program description, message frequency, message & data rates disclosure, and HELP and STOP instructions — are available on our Terms of Service page under section 14.

No mobile opt-in information will be shared with third parties or affiliates for marketing or promotional purposes. We do not sell, rent, or share your mobile phone number, your SMS opt-in consent, or any other SMS-related personal information with third parties for their own marketing purposes. Mobile opt-in data and SMS consent records are used only to deliver the messages you requested and to operate the messaging program (e.g., carrier routing, delivery tracking, fraud prevention).

We may share your mobile number with trusted service providers strictly to deliver messages on our behalf — for example, Twilio (our SMS carrier gateway) and mobile carriers (AT&T, T-Mobile, Verizon Wireless, U.S. Cellular, Sprint, and others). These providers are contractually prohibited from using your information for their own marketing. We do not share mobile information with advertising networks, data brokers, analytics platforms, or other third parties for marketing, profiling, or resale.

You can opt out of the SMS program at any time by replying STOP to any message. For help, reply HELP or email [email protected]. Upon opt-out, we retain your opt-out record as required by law to ensure no further messages are sent to your number.

12. Contact Us

For privacy requests, questions, or concerns, contact us at: [email protected]

Ali's Industries — Houston, TX