The short version
- The database is backed up every day, and backups are kept for 7 days.
- Everything travels over HTTPS; passwords and sign-in codes are stored only as hashes.
- Each person sees only their screens, and every sensitive action is logged for good.
- Bill prices come from your menu on the server, never from a phone.
This summary helps you read the policy; the full text below is what applies.
1.Where it runs
Our servers and database run on Amazon Web Services (Lightsail), India (Mumbai region). Only the web ports (HTTPS) and a locked-down administration port are open to the internet; the database is not reachable from outside our private network.
2.Encryption
- Every page, API call and phone-agent connection uses HTTPS or secure WebSockets (TLS), with certificates renewed automatically.
- Passwords are never stored: we keep only a salted bcrypt hash.
- Email sign-in codes are stored only as hashes, expire quickly, and are locked after 5 wrong tries.
- Sessions are signed tokens in secure, HTTP-only cookies that browser scripts can't read.
3.Who can see what
| Control | What it does |
|---|---|
| Roles | Owner, manager, waiter and kitchen roles each start with the screens their job needs. |
| Per-person access | Owners can switch individual screens on or off for each person. |
| Sensitive actions | Discounts, cancelled bills and price changes are limited to owners and managers. |
| Audit log | Every sensitive action is recorded with who did it and when. Entries can't be edited or deleted. |
| Separate outlets | Each outlet's data is kept apart; people see only the outlets they belong to. |
Inside our company, only the people who run and support the service can reach production systems, and only when their work needs it.
4.Protecting your numbers
- Prices on bills always come from your menu on the server, never from a guest's phone.
- Orders from a QR code at a table nobody has seated wait for your staff to approve them.
- GST invoice numbers are given in order and never reused, even when a bill is cancelled.
- Messages from WhatsApp are checked against Meta's signature before we accept them, and the voice server talks to the app with a shared secret.
5.Backups and recovery
The database is backed up automatically every day and backups are kept for 7 days, so we can restore to an earlier point if something goes wrong. Server snapshots are taken daily as well.
6.AI and your data
The phone and WhatsApp agents send only what a conversation needs, such as the guest's words and your menu and free tables, to our AI and speech providers through their business APIs. We do not use your data to train AI models. The list of providers is on the Data Processing page.
7.If something goes wrong
If we find a personal data breach, we contain it, tell affected restaurants without undue delay and within 72 hours, tell affected people what happened and what they can do, and report it to the Data Protection Board of India as the DPDP Rules require.
8.What you can do
- Give each person their own login, and remove people who leave from the Team screen.
- Keep owner and manager roles to the people who need them.
- Check the Audit Logs screen now and then, especially the "Worth a look" filter.
- Use a strong, unique password, or sign in with Google.
9.Report a security issue
If you think you have found a security problem, please email info@aicni.in with the details. We will acknowledge it within 2 working days and keep you informed. Please don't access other people's data or disrupt the service while testing.
Questions about this policy?
Write to info@aicni.in or see how to raise a complaint.