Privacy Policy

Who is responsible for your information

There are two roles, and which one applies to you changes who you should contact.

When a restaurant uses our service to run its business, the restaurant decides what data goes in (its employees, applicants, vendors, sales and so on) and we process that data for the restaurant under our Terms and Data Processing Addendum. In privacy-law terms the restaurant is the business or controller and we are its service provider or processor. If you are an employee or a job applicant of a restaurant, the restaurant is the one responsible for your information, and requests about it should go to the restaurant first (see "Employees and job applicants" below).

For the people who visit our website, request a demo, sign up for or manage an account, or contact us, we decide how the information is used, and we are responsible for it.

Information we collect

Depending on how you use the service, we collect:

• Account and contact information: name, work email, phone number, role, restaurant name, login credentials (passwords are stored only as one-way hashes), and your language choice.
• Restaurant records entered by the restaurant or its people: employee cards (name, contact details, job title, hire and termination dates, availability, documents), schedules and shift swaps, time-clock punches (when and by which code scan), time-off requests, pay rates, payroll records and pay stubs, tax forms the restaurant collects (such as W-4, I-9 and W-9), accounting records, vendors, recipes, inventory and sales.
• Photos and files: profile photos, checklist photos, documents, résumés, invoices and receipts that people upload.
• HR and performance information: training and policy sign-offs, electronic signatures (typed or drawn name, date, time and device), written notices, check-ins, growth-plan reviews and feedback messages.
• Job applicant information on a restaurant's careers page: name, contact details, city, résumé, links, answers to questions, work eligibility, and consents given.
• Phone calls and voicemails answered by the AI receptionist: the caller's number, the audio, a transcript and a summary.
• Messages with Chef Benny: what you type or upload and the answers. Finished chats are deleted when you sign out and in any case after one day. The employee helper's chat log is kept so the restaurant's owners and admins can review it, until they clear it.
• Technical information: IP address, browser and device type, pages and features used, and error and security logs.
• Payment information for our own subscription is handled by Stripe. We receive a billing contact, plan and the last digits of a card, never the full number.

How we use information

• To provide, secure and support the service the restaurant has asked for, including sending the alerts, reminders and messages the restaurant sets up.
• To run Chef Benny: to read documents, answer questions and draft work for the person who asked.
• To bill, to communicate about the service, and to answer requests.
• To protect the service: fraud and abuse prevention, security monitoring, debugging and incident response.
• To improve the product using de-identified or aggregate usage information.
• To meet legal obligations and enforce our terms.

Artificial intelligence

Chef Benny is powered by an AI service or agent the restaurant chooses and connects with its own key or its own computer. When you use Chef Benny, the text and files you send, plus the facts needed to answer (for example your schedule), are passed to that AI. We do not use restaurant data or chats to train our own AI models. The AI provider the restaurant chooses has its own terms about how it handles what it receives, and the restaurant should choose one whose terms fit its needs.

AI can make mistakes. Chef Benny proposes sensitive changes (such as pay, taxes, alerts or job posts) as a card that a person must confirm, and the restaurant remains responsible for what it approves. Do not rely on AI output as legal, tax, medical or accounting advice.

Who we share information with

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share it only:

• With service providers (subprocessors) who help us run the service, under contracts that limit their use of the data. The current list is on our Subprocessors page.
• At the restaurant's direction, for example when it connects an integration, sends you an email, runs a background check with your authorization, or shares an application as you agreed.
• With the restaurant's other authorized users, according to the access settings the restaurant's owner sets.
• To comply with law, legal process or a valid request from authorities, or to protect rights, safety and the security of the service.
• In a merger, acquisition or sale of assets, with notice to affected customers.

Cookies and similar technologies

We use only the cookies needed to sign you in, keep your session secure and remember your language and sign-in choices. We do not use advertising or third-party analytics cookies. Optional third-party content, such as a map, stays off until you press Accept, we keep a record of your choice, and a Global Privacy Control signal counts as Decline. Details are on our Cookie Notice.

How long we keep information

• Restaurant records are kept while the restaurant's account is active, and the restaurant controls what it deletes. After an account ends we keep the data for [30] days so it can be exported, then delete it, except where law requires us to keep something longer or it sits in backups that expire on their normal cycle.
• Chef Benny chats: deleted at sign-out and after one day at most. Employee helper chat logs: until the restaurant clears them.
• Applicant records: as long as the restaurant keeps them, and the restaurant sets its own period.
• Security and audit logs: up to [24] months.
• Website and account contact information: as long as needed for the relationship plus the period the law requires.

Security

Each restaurant's data is kept in its own database. We use encryption in transit, hashed passwords, signed sessions, account lockouts, rate limiting, role-based and area-based access controls chosen by the restaurant's owner, and an audit log of sensitive actions. See our Security page. No system is perfectly secure; if there is an incident that affects personal information we will notify the affected restaurants and, where the law requires, the people affected and regulators.

Your rights and choices

Depending on where you live, you may have the right to know what personal information is held about you, to receive a copy, to correct it, to delete it, to limit certain uses, to opt out of sale, sharing and targeted advertising (we do none), and not to be discriminated against for using these rights. These rights are provided by laws such as the California Consumer Privacy Act as amended, and the privacy laws of Virginia, Colorado, Connecticut, Maryland and other states.

To use a right about information we control (website visitors, account contacts), email us at the address below. We will verify who you are and respond within the time the law allows (generally 45 days). You may use an authorized agent.

To use a right about information in a restaurant's records, contact the restaurant. We will help the restaurant respond (restaurant owners and admins can download everything held about a person, and erase a former employee's personal details, from the employee card), and if you contact us we will tell you who to ask.

If you are unhappy with our answer you may appeal by replying to us, and you may contact your state attorney general.

Employees and job applicants

If you work for or apply to a restaurant that uses our service, your employer or the restaurant decides what is collected about you and is responsible for telling you. Our Notice for Employees and Job Applicants explains in plain words what the app collects about people who work there and who can see it. A restaurant should give you its own notice at collection, and where the law requires it, ask for your consent (for example for background checks, photos or call recording).

We process this information only to provide the service to the restaurant. We do not use it for our own marketing and we do not sell it.

Children

The service is for businesses and their workers and is not directed to children under 16. We do not knowingly collect information from children under 16. Restaurants must follow child-labor and parental-consent rules where they employ minors. If you believe a child has given us information, contact us and we will delete it.

International users and transfers

We operate in the United States and store data in the United States. If you access the service from elsewhere you understand your information is processed in the United States. Where a transfer from the EEA, UK or Switzerland requires it, we rely on the Standard Contractual Clauses incorporated in our Data Processing Addendum.

Notice at collection (California and similar laws)

In the past 12 months we have collected these categories of personal information for the business purposes described above. We have not sold or shared any of it.

Changes to this policy

We may update this policy. If a change is material we will tell restaurant owners in the app or by email before it takes effect. The date at the top shows when it was last updated.

Contact

Questions or requests: [email protected]. Mail: Chef Nerd AI, [Mailing address].