The short version
- Your restaurant decides how guest data is used; we only process it for you.
- We never use it for our own marketing or to train AI models.
- We tell you about a breach within 72 hours of finding it.
- We list every company that helps us, and warn you 15 days before adding one.
This summary helps you read the policy; the full text below is what applies.
1.Who decides and who processes
Under the Digital Personal Data Protection Act, 2023, your restaurant is the Data Fiduciary for its guests' personal data: you decide why it is collected and how it is used. ALL4YOU INTERNATIONAL PRIVATE LIMITED is your Data Processor: we process that data only to provide AICNI Restro to you and on your instructions.
These terms form part of our Terms of Service and apply automatically to every account. Enterprise customers can ask for a signed copy.
2.What we process for you
| Guest data | Why it's processed |
|---|---|
| Names, phone numbers, party size, booking times | Reservations, the waitlist and confirmations |
| Orders, seats, bills and payment method | Taking orders, the kitchen display and billing |
| Notes your staff add (allergies, preferences, birthdays) | Showing them to your team at the right time |
| Call transcripts and summaries | The phone agent, and letting your team check what was booked |
| WhatsApp messages | The WhatsApp agent and your team's inbox |
| Reviews and ratings | Your Reviews screen and dish quality |
| Delivery addresses | Delivery orders and riders |
3.Our promises as your processor
- We process guest data only to provide and support AICNI Restro for you, and never for our own marketing or to train AI models.
- Everyone at our company who can access it is bound by confidentiality and has access only when their work needs it.
- We protect it with reasonable security safeguards, as described on our Security page.
- We help you answer guests who ask to see, correct or erase their data, and we pass on any request that reaches us.
- We tell you about a personal data breach affecting your guests without undue delay and within 72 hours of becoming aware of it, with what we know and what we are doing, so you can meet your own duties.
- When your account closes or stays read-only without a plan, you can export your guest data for 90 days; then we delete it, except where the law requires us to keep records.
- We keep activity logs for at least one year, as the DPDP Rules require.
4.Your promises as the fiduciary
- You have a lawful basis, and where needed valid consent, for the guest data you put into AICNI Restro.
- You give guests the notices the law requires, including that calls may be answered by an automated assistant.
- You send marketing messages only to guests who agreed to receive them.
- You answer your guests' requests and complaints, with our help.
5.Companies that help us (sub-processors)
We use these companies to run parts of the service. Each is bound by a contract to protect the data and use it only for the purpose below. Some are used only when you switch on the feature that needs them.
| Company | What it does | Data involved | Where |
|---|---|---|---|
| Amazon Web Services (Lightsail) | Hosting the app, the voice server and the database; daily backups | All service data | India (Mumbai region) |
| Resend | Sending sign-in codes and account emails | Email address, name | United States |
| Cashfree Payments | Taking payment for AICNI Restro plans (UPI, cards, net banking) | Owner's name, email, phone; payment details are entered on Cashfree's page, not ours | India |
| "Continue with Google" sign-in, only if you choose it | Name, email, profile photo | Global | |
| Anthropic (Claude) or Groq | The AI that runs the phone and WhatsApp agents and writes suggestions | Conversation text, menu, table availability | United States |
| Sarvam AI | Speech-to-text and text-to-speech for the phone agent | Call audio | India |
| Exotel | Connecting phone calls to the phone agent | Caller number, call audio | India |
| Meta (WhatsApp Business Platform) | Sending and receiving WhatsApp messages | Guest phone number, messages | Global |
We will update this list and email account owners at least 15 days before adding a new sub-processor that handles guest data. If you object for a good reason, tell us at info@aicni.in and we will work with you on a solution, or you can cancel without penalty.
6.Transfers outside India
Our servers and database run on Amazon Web Services (Lightsail), India (Mumbai region). Some sub-processors process data in other countries, as the table shows. The DPDP Act allows this except to countries the Government of India restricts, and we will stop using any provider in a restricted country.
7.Contact
Data protection questions: info@aicni.in
Security reports: info@aicni.in
Questions about this policy?
Write to info@aicni.in or see how to raise a complaint.