Privacy Policy
Last updated: November 2026
Ordered from a restaurant that uses OpenPOS? See For guests. Run a restaurant on OpenPOS, work at one, or visiting our site? See the numbered sections below.
For guests of restaurants that use OpenPOS
This part is for you if you order from, book a table with, join a waitlist at, call, or message a restaurant whose ordering, website, phone line or kiosk runs on OpenPOS, including through an AI app such as ChatGPT or Claude. The restaurant decides how it uses your information and is responsible for it; OpenPOS handles it on the restaurant's behalf to run ordering, payments and messages. A few things work across all restaurants on OpenPOS, and for those OpenPOS decides too: your guest sign-in and saved cards, STOP replies to texts, keeping the service secure and free of fraud, and orders started in AI apps. A restaurant may also publish its own privacy policy.
What we collect
- Contact details — your name, phone number and email address (email is optional for dine-in).
- Your order — items and choices, notes, tip, promo or referral codes, pickup, curbside, dine-in or delivery, the time you chose, your table or car for curbside, and for delivery your address and instructions. The restaurant's customer record keeps your delivery addresses so its staff can use them for phone orders.
- Sign-in — a one-time code sent to your phone or email when you sign in to see saved cards or rewards.
- Payments — handled by Stripe, including Apple Pay, Google Pay and Stripe Link. Stripe receives your name, email and phone with the payment. We keep the card brand, last four digits, whether it is credit or debit, and payment references, never the full card number.
- Bookings and waitlists — party size, time and what you tell the restaurant (occasions, dietary or accessibility needs). The restaurant may keep those needs as notes on your customer record.
- Catering and events — your contact details, event details and messages with the restaurant.
- Rewards — if the restaurant runs a rewards program: points, store credit, referrals, and your birthday if you choose to give it.
- Feedback — if you answer a restaurant's short survey: your ratings, the reasons you pick, thumbs up or down on dishes, your comments, and whether you'd return or would like to be contacted. It is linked to your order and your customer record. The restaurant can reply and may offer an apology credit, which a person approves.
- Phone calls — if the restaurant's phone is answered by AI Phone, our voice-ordering partner records and transcribes the call and the order is created like an online order. If you call or scan a restaurant's Voice Kiosk, your voice is sent live to AI services that understand and answer you, and the call is transcribed; restaurant staff may listen in to help. We keep the transcript and your phone number for 30 days, and your first name and order with the order.
- On your device — your cart, your contact details (so checkout is pre-filled next time, for 30 days), your language, a dine-in guest id, a sign-in cookie that lasts 30 days, and a 30-day cookie that tells the restaurant which campaign brought you.
Ordering through an AI app
If you ask an AI app such as ChatGPT or Claude to find a restaurant or put an order together through the OpenPOS Order connector, the app sends us what it needs to answer: the words of your search, the restaurant, the items and choices you want, pickup or delivery and the time, your language, and which app it is. ChatGPT may also send your approximate location (such as your city), which we use only to list nearby restaurants first and don't keep. The app does not send us your name, phone number or email: you enter those on the restaurant's checkout page, and everything above about orders applies from there. The cart is saved as a link for 24 hours and afterwards kept, with no name or contact details in it, so the restaurant can see how many carts became orders. As for any website, our servers' request logs record each request's IP address and time, and we use the IP address to limit how many requests can come from one connection. What you type in the AI app itself is handled by that app's company under its own privacy policy.
How it is used
- To place your order with the restaurant, take payment, and hand over or deliver it.
- To send you updates by text or email about your order, booking, waitlist place or payment, and receipts.
- To run the restaurant's rewards program and customer records (your visits, orders and preferences), and to ask how your order went if the restaurant uses feedback.
- Marketing. A restaurant can send promotional texts and emails to the guests in its customer records, including guests who booked or joined its waitlist. You can stop them at any time: reply STOP to any text — this stops texts from every restaurant on OpenPOS and can also stop order updates by text; reply START to get them again. An email's unsubscribe link stops that restaurant's marketing emails.
- To help the restaurant run its business with AI tools — for example an AI assistant that answers the owner's questions about orders or bookings.
- To keep the service secure, prevent fraud, fix problems and improve OpenPOS. We use de-identified, combined data for that where we can.
Saved cards
When you are signed in, the card you pay with is saved automatically by Stripe to your OpenPOS guest profile (your phone number and email), so you can pay faster next time — at that restaurant and at any other restaurant on OpenPOS where you sign in with the same phone or email. You can remove saved cards at any time from your account page on any restaurant's ordering site.
Who receives it
- The restaurant you order from, book with or call.
- Delivery partners — today FirstDelivery and the couriers it works with, and others such as Nash or DoorDash Drive when used, or the restaurant's own drivers: your name, phone, address, delivery instructions and order, to deliver it.
- Companies that run parts of the service for us: Stripe (payments); Twilio (texts); Google and Resend (email); Cloudflare (store web addresses and email we receive for restaurants); Google Maps Platform (finding and checking addresses); Anthropic, OpenAI and xAI (AI features), LiveKit (Voice Kiosk calls) and our voice-ordering partner (AI Phone); Google Cloud and Amazon Web Services (hosting and files); Sentry (error reports).
- Our team, which may receive copies of order messages to check they work and to fix problems.
- Others when the law requires it, to protect rights and safety, or as part of a merger or sale of our business.
We do not sell your personal information.
Tracking on ordering pages
OpenPOS does not run its own analytics or advertising tags on restaurants' ordering pages or websites; it runs error reporting (Sentry) so we can fix problems. A restaurant may add its own tags (for example Google Analytics, the Meta pixel or the TikTok pixel) to measure its ads; those see which pages you visit and what you order (the order value and items, not your name, phone or email), under the restaurant's and those companies' policies. Maps and fonts on those pages load from Google.
How long it is kept
Orders and payment records are kept while the restaurant uses OpenPOS and as long as needed for tax, accounting and refunds. Customer records are kept until the restaurant removes them or you ask us to delete them. Voice Kiosk transcripts and caller numbers are deleted after 30 days.
Your choices and rights
- Stop marketing texts: reply STOP. Stop a restaurant's marketing emails: use the unsubscribe link.
- Remove saved cards: from your account page on the restaurant's ordering site.
- See, correct or delete your information: ask the restaurant, or email [email protected]. We will confirm it's you, work with the restaurant, and answer within the time the law sets (usually 45 days). We may keep what the law requires us or the restaurant to keep, such as payment records.
- Depending on where you live you may have more rights; see Your privacy rights below.
Children
Ordering and booking are not directed to children under 13, and we do not knowingly collect their information.
For restaurants, their teams and our visitors
1. Who we are and what this covers
OpenPOS Inc. ("OpenPOS", "we", "us") runs a restaurant platform: online ordering, store websites, point of sale, staff apps, reservations, delivery, marketing, and AI tools including the AI Manager, AI Phone, the Voice Kiosk and ordering through AI apps (the "Service"). This policy explains what personal information we collect, how we use and share it, and your choices.
- Guests of restaurants: see For guests above.
- Restaurants (owners, managers and admins), restaurant teams and visitors to openpos.ai and our apps: the sections below.
For information a restaurant collects about its guests and team through the Service, the restaurant decides how it is used and we handle it on its behalf, under our Restaurant Terms. For our own customers' accounts, our website and the things that work across restaurants, OpenPOS decides.
2. Restaurants and their owners
What we collect
- Account — your name, email, phone, password (stored hashed) or sign-in codes, your role, and the stores you can access.
- Your business — business and store names, addresses, phone, hours, menus, prices, photos, logos, settings and the content you create (websites, campaigns, notes).
- Payments — when you connect Stripe, Stripe collects your identity and bank details for verification and payouts; we receive your account's status. Until a store connects Stripe, its guests' payments are held in our Stripe account and paid out to the store once it connects. For optional prepaid services, Stripe saves the card you top up with.
- Your use of the Service — orders, sales and reports of your stores, what you do in the dashboard and apps, messages with us and with the AI Manager, and voice notes you send it.
- Before you sign up — we may build a demo storefront for a restaurant from public information (its website, menu and listings) so the owner can see OpenPOS working, and contact the business about it.
How we use it
- To provide the Service, process payments and payouts, and charge our fees.
- To run AI features you use, such as the AI Manager reading your sales or drafting a campaign.
- To send you service, security and account messages, and — unless you opt out — news about OpenPOS.
- To support you, keep the Service secure, prevent fraud, and fix and improve it.
3. Restaurant teams
When a restaurant uses OpenPOS to run its team, it is the employer and decides how its team's information is used. We handle it on the restaurant's behalf. That can include:
- name, phone, email, role, pay rate and the stores you work at;
- a PIN or code to sign in to the staff, Shift or Terminal apps, and the devices you use;
- clock-ins and clock-outs, breaks, timesheet changes, schedules, availability and time-off requests;
- a photo at clock-in if the restaurant uses that (deleted after 90 days), and, only if the restaurant turns it on, an AI check that the photo matches you;
- tips, cash drawer activity, team messages, shift notes and announcements, and push notifications.
We don't collect Social Security numbers, tax forms or bank details for team members, and we don't track your location. Payroll files are downloaded by the restaurant to use with its payroll provider.
4. Visitors to our website and apps
- Logs — our servers record each request's IP address, time and page, to run and secure the Service.
- Cookies — we use cookies needed to sign you in and keep your session.
- Analytics — on openpos.ai, the dashboard and our staff, driver and clock pages we use PostHog and Google Analytics to understand how the product is used, and Sentry to find errors. We don't run our analytics on restaurants' ordering pages or websites.
- iPad apps — the Terminal and Kiosk apps use Google Firebase for usage statistics and crash reports.
5. Public store information
A restaurant's public information — name, address, phone, hours, menu, prices, photos and how to order — is public by default: on its ordering pages and website, through our open API and store directory, on menu pages for Google if the restaurant turns them on, and in AI apps through our OpenPOS Order connector. Search engines and AI companies may read and keep these public pages, including to train their models. A restaurant can limit this in its settings. Orders, guests' details and a restaurant's finances are never public.
6. AI
AI features send the information they need to AI providers — Anthropic, OpenAI and xAI — and, for the Voice Kiosk, call audio through LiveKit. We don't train AI models on your information, and we use these providers' business services, which don't use the data we send them to train their models. AI can be wrong: restaurants review what it writes before relying on it.
8. Security
We protect information with encrypted connections, hashed passwords, access controls by role and store, and payments handled by Stripe so card numbers never reach our servers. No system is perfectly secure; if a breach affects your information, we will tell you and, where it's a restaurant's data, the restaurant, as the law requires.
9. How long we keep it
We keep account and business information while the account is open. After an account closes, we delete or de-identify personal information when we no longer need it, except what we must keep for legal, tax, accounting or dispute reasons (for example payment records, often up to 7 years). Some information has a shorter life: clock-in photos (90 days), Voice Kiosk transcripts and caller numbers (30 days), and the caller numbers we receive from AI Phone (24 hours).
10. Your privacy rights
Depending on where you live — for example California, Colorado, Connecticut, Texas, Virginia and other U.S. states — you may have the right to:
- know what personal information we have about you and get a copy;
- correct it;
- delete it;
- opt out of the sale or sharing of personal information or its use for targeted advertising (we don't do these); and
- not be treated differently for using these rights.
To ask, email [email protected]. We will confirm it's you (an authorized agent can ask for you with your permission), answer within 45 days (or tell you if we need longer, as the law allows), and explain how to appeal if we decline. If the information is held for a restaurant, we will pass the request to the restaurant and help it answer. You can also opt out of our marketing emails with the link in any of them.
11. Children
The Service is not directed to children under 13, and we do not knowingly collect their information. Accounts for restaurants are for adults. A restaurant may add team members under 18 where the law lets them work; we handle that information for the restaurant.
12. Changes to this policy
We may update this policy. If a change matters, we will tell restaurants by email or in the dashboard, and show the new date at the top of this page.
13. Contact
Privacy questions and requests: [email protected]. Other questions: [email protected].