Privacy Policy

1. Who we are and what this policy covers

RevEats AI is operated by Reveats INC, doing business as RevEats AI (RevEats, we, us or our), at 1579 Quail run drive oshawa ON L1K0E1. This policy explains how we collect, use, disclose, retain and protect personal information through reveatsai.ca and the services described below. Personal information means information about an identifiable individual, including information that can identify someone when combined with other information.

Our services may include AI telephone ordering and inquiries, outbound campaigns, text and social messaging, web chat, reservations where configured, POS and payment integrations, website and social media services, and reviews of restaurant operating expenses. Collection depends on the services a restaurant selects and how those services are configured. Listing a category here does not mean that every feature is enabled for every restaurant.

This policy applies to website visitors, prospective clients, restaurant business contacts, and individuals whose information we handle through participating restaurants. It does not replace a restaurant's own privacy notice or the notices of independent payment, social media or other services. We comply with privacy laws applicable to our activities, including PIPEDA where applicable and relevant provincial laws.

2. Our role when serving restaurants

For website inquiries, our business relationships, billing, security and our own authorized marketing, RevEats determines the purposes for handling information. Our Privacy Lead is responsible for questions and complaints about our privacy practices and can be reached using the contact details in section 15.

For restaurant customer information used to take orders or deliver restaurant campaigns, we generally process information on the restaurant's documented instructions. The restaurant decides why it collects customer information, which services to enable and which campaigns to authorize. Our contract with the restaurant governs this processing. We retain our own legal responsibilities and do not treat the restaurant's instructions as permission to act unlawfully.

If your request concerns an order, refund, food preparation, marketing permission or information held by a restaurant, contact that restaurant first. You may also contact us. We will help identify the appropriate organization and assist the restaurant where required, without disclosing information to an unauthorized requester.

3. Information we collect

Website and inquiry information. We collect details you submit, such as your name, restaurant or company name, email address, telephone number, city, POS system, service interests, booking preferences and message contents. When you request a guide, we collect the information needed to deliver it and any separately chosen subscription preferences.

Client account and business information. We may handle business contact details, authorized user identities, service configuration, menus, prices, availability, promotions, restaurant hours, support requests, agreements, invoices, billing status and integration identifiers. Supplier invoices, contracts and expense records supplied for a savings review may contain personal information. Please redact unrelated personal details before sharing them.

Restaurant customer information. Depending on the enabled service, we process names, phone numbers, email addresses, messaging account identifiers, delivery or pickup details, order items, modifiers, transaction references, reservations, customer instructions, order history and communication preferences. We also process consent records and opt-out or do-not-call status supplied by the restaurant or captured through the service.

Conversation information. We process spoken or written messages and the resulting transcripts, order summaries and interaction metadata. Audio recordings are retained only where recording is enabled and the required notice and consent process has been applied. Metadata may include call time, duration, delivery status and routing or error information.

Sensitive information. A customer may volunteer an allergy or dietary restriction relevant to an order. We limit its use to handling that request and related support. Do not provide medical records, government identifiers, passwords or unrelated sensitive information through our ordering or chat services. Ordinary ordering does not require you to supply a voiceprint for identity verification. Any proposed biometric identification would require a separate notice and any consent required by law before activation.

Technical information. Our website and service providers may process IP addresses, device and browser details, timestamps, page requests, referring pages, session identifiers and security logs. Section 9 explains cookies and analytics.

4. Where information comes from

We collect information directly from you, from the restaurant you contact or order from, from its authorized users and connected systems, and from providers carrying or processing the relevant interaction. Examples include a telephone carrier delivering a call, a social platform delivering a message, a POS returning an order status and a payment processor returning a payment confirmation.

Restaurants must have lawful authority to provide information and instructions to us. We do not treat possession of a telephone number, a prior order or an uploaded contact list as automatic permission for every form of marketing.

5. Why we use information

We use information to respond to inquiries, deliver requested materials, schedule demonstrations, set up and administer services, authenticate authorized users, provide support and bill restaurant clients.

On a restaurant's behalf, we use information to answer questions using approved restaurant information; build and confirm orders or reservations; send order details to configured systems; route payment links; send requested transactional updates; and conduct authorized campaigns using the relevant consent and suppression records.

We also use information as necessary to investigate errors and complaints, monitor service reliability, detect misuse, protect systems, maintain lawful records, resolve disputes and meet legal obligations. Access to identifiable conversation content for support or quality review is limited to an appropriate purpose and authorized personnel.

We may produce aggregated or de-identified operational statistics to understand service performance. We take reasonable steps to reduce identification risks and do not attempt to re-identify individuals except where permitted and necessary to test the effectiveness of de-identification or comply with law.

We do not sell personal information, use restaurant customer lists to market unrelated businesses, or use identifiable restaurant customer conversations to train general-purpose AI models. These restrictions also apply to providers processing this information on our behalf. [BUSINESS VERIFICATION REQUIRED: Confirm that provider contracts and account settings prohibit general-purpose model training and unrelated advertising or sale using identifiable customer information.] A materially different purpose requires an appropriate legal basis and new notice or consent where required.

6. Consent and your choices

We seek consent appropriate to the sensitivity of the information and the circumstances, unless the law permits or requires processing without consent. Notices explain the relevant collection, purpose and material consequences. Sensitive information or unexpected uses may require express consent. Reading this policy or visiting our website alone is not blanket consent to unrelated uses.

You may decline optional information requests or withdraw consent by contacting us or using the relevant channel controls. We will explain reasonably foreseeable consequences, such as being unable to complete an order without a contact number. Withdrawal does not undo lawful past processing, and some records may remain necessary for legal obligations, security, dispute resolution or suppression of future marketing.

Call recording and AI interaction. When you interact with a RevEats AI assistant, you are communicating with an automated system. Where recording is enabled, the notice at the beginning of the call explains the recording and its purposes, and consent is obtained as required by law. [BUSINESS VERIFICATION REQUIRED: Confirm that the live call notice, consent workflow and recording settings implement this statement.] If you do not wish to be recorded, ask for an alternative. The restaurant may offer a staff transfer or another ordering channel where available. A transfer is not guaranteed outside staffed hours.

Audio processing needed to understand and answer a call is separate from retaining an audio recording. The applicable interaction notice explains the processing and recording enabled for that service. Public use of a recording or transcript as a demonstration requires a separate lawful basis and appropriate permissions; agreeing to place an order is not permission for a public testimonial.

7. Marketing messages and outbound calls

Requesting a demo or guide permits us to fulfill and follow up on that request as allowed by law. It does not automatically subscribe you to unrelated promotional campaigns. Where a subscription is offered, the purpose and sender are identified and any required marketing consent is collected separately.

For restaurant campaigns, the restaurant and RevEats must establish the applicable consent or other lawful basis for the channel and activity. Commercial electronic messages include sender identification and an accessible unsubscribe method where required. You can follow an email unsubscribe link or use the instructions in a text message, such as replying STOP where supported. You may also contact the identified sender.

We process electronic marketing opt-outs without delay and within the applicable legal deadline, no later than 10 business days where CASL applies. We retain limited suppression information where necessary to prevent future unwanted messages. An opt-out from marketing does not necessarily prevent essential requested order communications or legally required notices.

Telephone marketing is assessed separately under applicable telemarketing, National Do Not Call List and internal do-not-call, and automated calling rules. Consent for email or text is not automatically consent for AI voice solicitation. Tell the caller or contact us if you want to be added to the applicable internal do-not-call list.

8. Sharing and service providers

We disclose order and interaction information to the restaurant concerned and its authorized personnel and configured systems so they can fulfill requests, support customers and administer their business. The restaurant's own handling is governed by its notice and applicable law.

We use providers for hosting, email delivery, telecommunications, voice processing, AI inference, messaging, social integrations, POS connectivity, payments, support and security as applicable. They receive information needed for their assigned functions, subject to appropriate contractual and technical controls. Independent platforms may also process information under their own terms when you use their services.

Our website uses Hostinger for hosting and Resend for email delivery. Hosting providers may process website requests and associated technical information; email providers process recipient contact details and the contents of the communications they deliver. Restaurant service providers process the relevant contact, conversation, order, payment-reference or technical information needed for their assigned functions.

[BUSINESS VERIFICATION REQUIRED: Confirm Hostinger and Resend and insert the current restaurant-service provider disclosure or a working provider-register link, identifying AI, voice, telecommunications, messaging, POS and payment providers and their functions.]

You may request further information about providers involved in a particular interaction by contacting our Privacy Lead and identifying the restaurant, channel and approximate date.

We may disclose information to professional advisers under confidentiality duties, to authorities where legally required or permitted, and where reasonably necessary to investigate unlawful activity, protect rights or respond to an emergency as allowed by law. We assess requests and limit disclosures to the relevant purpose.

If a merger, acquisition, financing, reorganization or sale of assets involves personal information, we apply the safeguards, necessity restrictions and notices required by law. This is not an unrestricted right to sell customer lists. Information may also be shared at your direction or with your valid consent.

9. Cookies and analytics

Our website may use cookies, local storage or similar technologies to support essential functions such as session integrity, security and preferences. These technologies may record identifiers, browser settings or information about how a page is used. Where optional analytics or advertising technologies are enabled, their purposes, providers and applicable choices are described in the notice below. We obtain consent where required and do not treat acceptance of essential functions as consent to optional advertising.

[BUSINESS VERIFICATION REQUIRED: Insert the actual cookie and analytics disclosure, including providers, purposes, duration and available controls. If no optional analytics or advertising technologies are used, state that fact and remove references to unavailable preference controls.]

You can control certain cookies through browser settings. Blocking essential technologies may affect site functions. External sites reached through links or embedded services have their own practices; please review their notices.

10. Processing outside your province or Canada

Our providers and authorized support personnel may process information outside your province or Canada. When information is processed elsewhere, the laws of that jurisdiction may allow courts, law enforcement or other authorities to access it. We remain accountable for information under our control and use appropriate contractual and other safeguards for service-provider processing.

[BUSINESS VERIFICATION REQUIRED: Identify the countries or regions in which personal information is processed, here or in the provider disclosure.] We do not promise Canadian-only storage unless expressly agreed and technically supported. Additional assessment, notices or contractual safeguards will be applied where required by the laws governing the information.

11. Retention and disposal

We retain personal information only for as long as reasonably necessary for the disclosed purpose, restaurant instructions and applicable legal requirements. We consider the information's sensitivity, account activity, support needs, financial record obligations, consent evidence and potential disputes. Legal holds may suspend ordinary deletion, with access and use restricted to the reason for the hold.

Inquiry and guide-request records are kept while needed to fulfill the request, manage related correspondence and document any consent or withdrawal. Optional marketing records are reviewed in light of the individual's preferences and the continuing lawful basis for contact.

Client account, agreement and billing records are retained for the relationship and afterward as needed to satisfy applicable accounting and legal obligations or resolve disputes. Audio, transcripts, orders and support records are kept for the periods agreed for the relevant restaurant service, based on fulfillment, quality review and support needs, rather than indefinitely for unspecified future use.

Consent and campaign records are kept for the period reasonably needed to demonstrate the lawful basis for communications and address complaints. Security logs are retained for a period appropriate to detecting and investigating incidents. Backup copies expire through the documented backup cycle.

For services governed by our standard Terms of Service, the default post-termination arrangements provide a 30-day export-request window, deletion or return from active systems within 60 days, and backup expiry no later than 120 days after termination, subject to lawful holds, required retained records and expressly agreed lawful exceptions. Any different arrangement must be documented and must not extend retention beyond what is lawful and necessary. You may contact us for the retention arrangements applicable to your information.

Restaurant service data is returned, deleted or de-identified in accordance with the restaurant agreement and lawful instructions. Backup copies may remain until the documented backup cycle expires and are protected against ordinary use. Restoring a backup must not permanently reverse a valid deletion or marketing opt-out.

We retain limited opt-out records to honour suppression requests and legally required records for the applicable period. When information is no longer required, we securely delete it or render it appropriately non-identifiable. Account closure does not mean every record can immediately be erased.

12. Safeguards and incidents

We use administrative, technical and physical safeguards appropriate to the sensitivity, volume and nature of information. Our program includes access authorization, staff confidentiality obligations, provider oversight, access protection and secure handling and disposal procedures. Safeguards vary with the system and the sensitivity of the information. No website or transmission method is completely secure.

If an incident affects personal information, we investigate, contain it, assess the risk and take appropriate corrective action. We notify the restaurant, affected individuals, regulators or other organizations as required by law and applicable contractual commitments. Where PIPEDA applies, breaches presenting a real risk of significant harm must be reported and affected individuals notified as soon as feasible. Required breach records are maintained even when notification is not required.

Contact our Privacy Lead promptly if you believe information has been exposed or misused. Do not email passwords, complete payment details or additional sensitive information when reporting an incident.

13. Access and correction requests and privacy complaints

You may ask whether we hold personal information about you, request access and an account of its use or disclosure, challenge accuracy and request correction. You may also withdraw consent or request deletion, subject to applicable law and legitimate retention requirements. Deletion is not an unconditional right to erase records that must lawfully be retained.

Send requests to reveatsai@gmail.com with the subject Privacy Request. Include enough information to locate the interaction, such as the restaurant name, approximate date and contact channel. We may reasonably verify identity and authority before acting, using no more additional information than necessary.

We respond within applicable legal deadlines. For access requests governed by PIPEDA, the usual deadline is 30 calendar days. Where an extension or refusal is legally permitted, we explain it and the available complaint options. We protect other people's information and privileged or otherwise protected records; where feasible, we provide the remaining information with appropriate redactions.

For information processed on a restaurant's instructions, we route or assist with your request as appropriate. If you are dissatisfied, contact our Privacy Lead for review. You may also complain to the Office of the Privacy Commissioner of Canada at www.priv.gc.ca or the provincial regulator with jurisdiction. You do not have to give up those rights to use our services.

14. Children and geographic scope

Our business website and client accounts are directed to adult business users, not children. We do not knowingly solicit children's information for marketing. A restaurant interaction may involve a young customer; information must be handled with consent appropriate to age, capacity and applicable law. Contact us if you believe a child has supplied information without appropriate authorization.

This policy describes our Canadian operations. Mandatory rights under applicable provincial and other laws remain available. Additional notices or terms may apply to services offered in other jurisdictions; this policy does not exclude rights available under those laws.

15. Changes and contact information

We update this policy when our practices or legal requirements change and identify the effective date at the top. We provide additional notice of material changes where appropriate and obtain new consent where required before applying a new purpose to existing information. An update does not itself create consent.