Privacy Policy

We collect and process the following categories of information: (a) account registration data such as name, email address, phone number, and business details; (b) business profile data including restaurant name, address, menu information, operating hours, and branding assets; (c) order and transaction records including counterparty information, order details, and payment-adjacent data; (d) lead and messaging data from customer inquiries, review responses, and marketing communications; (e) integration metadata from connected third-party platforms such as Square, Toast, Stripe, Google Business Profile, and social media accounts; (f) usage and analytics data including page views, feature usage, and system performance metrics; and (g) device and browser information collected automatically through cookies and similar technologies.

When you connect your Google account through our platform, we access certain Google user data through OAuth 2.0 authorization with your explicit consent. Specifically:

• Gmail Send Access (gmail.send): We use this scope to send transactional emails on your behalf, including order confirmations, follow-up messages, review requests, invoices, and marketing communications to your restaurant customers. Emails are sent directly from your connected Gmail account.
• Gmail Read Access (gmail.readonly): We use this scope to verify that emails sent through the platform were successfully delivered and to surface incoming customer replies within your platform dashboard so you can manage communications without switching to Gmail.
• Google Business Profile (business.manage): We use this scope to manage your Google Business Profile listing, including publishing posts, offers, and updates on your behalf, and retrieving customer reviews to display within your platform dashboard.

We do not use Google user data for advertising purposes. We do not allow third parties to use Google user data. We do not sell, rent, or share Google user data with any external party. Google user data is only accessed when you explicitly authorize it through the Google OAuth consent screen and is used solely for the functionality described above. You may revoke access at any time through your Google Account permissions at myaccount.google.com/permissions.

The Alis Restaurants Platform's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not use Google user data to develop, improve, or train generalized or non-personalized AI and/or ML models. Any AI-powered features within the platform (such as content generation or analytics) operate independently of Google user data and do not access, process, or learn from information obtained through Google API scopes.

When you connect your Facebook or Instagram account through our platform, we access certain data from Meta Platforms ("Meta") through OAuth 2.0 authorization with your explicit consent. Specifically:

• Facebook Pages (pages_show_list, pages_read_engagement, pages_manage_posts, pages_manage_metadata): We use these permissions to list your Facebook Pages, read engagement metrics, publish posts on your behalf, and manage page settings to support your restaurant's social media presence.
• Instagram Publishing (instagram_basic, instagram_content_publish): We use these permissions to access your Instagram Business Account linked to your Facebook Page and publish content to Instagram on your behalf.
• Business Management (business_management): We use this permission to verify your business identity and manage business assets connected to your Facebook Business Portfolio.
• Instagram Account Profile (instagram_business_basic): When you connect Instagram directly via Instagram Login, we use this permission to fetch your Instagram Business or Creator account profile (handle, account type) so we can confirm the account is eligible and display it in your dashboard.
• Instagram Content Publishing (instagram_business_content_publish): We use this permission to publish images, carousels, and Reels to your Instagram Business or Creator account from the KitchenRush content calendar.
• Instagram Comments Management (instagram_business_manage_comments): We use this permission to read comments customers leave on your Instagram posts and to reply to them on your behalf from your KitchenRush inbox. The platform's AI assistant may draft replies for you to review and send, or send replies automatically on your behalf when you have enabled auto-reply.
• Instagram Direct Messages (instagram_business_manage_messages): We use this permission to receive direct messages customers send to your Instagram account and to reply on your behalf from your KitchenRush inbox. AI-drafted replies are clearly marked as automated, sent within Meta's standard messaging window, and escalated to you under Meta's Human Agent policy when needed.
• Instagram Insights (instagram_business_manage_insights): We use this permission to read account-level, post-level, and story-level performance metrics (reach, impressions, engagement, plays, replies) and surface them in your KitchenRush analytics dashboards. We capture story metrics via webhook before stories expire so historical performance is preserved.

Data we store: We store your Facebook User ID, name, Page access tokens, Page ID and name, and Instagram Business Account ID and username. Access tokens are stored encrypted and are used solely to publish content and read page engagement on your behalf.

Data we do NOT store: We do not store your Facebook password, friends list, personal timeline posts, private messages, photos, or any data from your personal Facebook profile beyond the public name and User ID needed for authentication.

We do not sell, rent, or share Meta Platform Data with any third parties. We do not use Meta data for advertising, profiling, or any purpose beyond operating the platform features you authorized. You may disconnect Facebook/Instagram at any time from your Owner Settings, which immediately revokes our access. You may also remove the app from your Facebook account at facebook.com/settings → Apps and Websites. Upon removal, we automatically delete all stored Meta Platform Data in compliance with Meta's data deletion requirements.

We use collected information to: operate and maintain your workspace; process and fulfill orders; send transactional and marketing communications on your behalf; provide customer support; deliver platform features including onboarding, integrations, and analytics; improve platform reliability and performance; comply with legal and regulatory requirements; and protect against fraud and unauthorized access. We do not intentionally use one restaurant's private data to operate another restaurant workspace.

We do not sell your personal information. We may share data with: (a) service providers who assist in operating the platform (hosting, payment processing, email delivery) under contractual obligations to protect your data; (b) connected third-party integrations that you explicitly authorize (e.g., Square, Stripe, Google Business Profile); and (c) legal authorities when required by law, court order, or governmental regulation. We maintain strict tenant isolation — your workspace data is never shared with other restaurant operators on the platform.

We implement industry-standard security measures to protect your information, including: encryption of data in transit (TLS/SSL) and at rest; secure authentication and access controls; regular security assessments; workspace-level data isolation ensuring no cross-tenant access; and secure handling of API credentials and OAuth tokens. While no system is completely immune to security threats, we are committed to protecting your data using commercially reasonable measures.

We retain personal information for as long as needed to provide the platform and for the purposes described in this policy. Retention periods are based on operational, contractual, and legal requirements. Specifically:

• Account data is retained for the life of your account and deleted or anonymized within a reasonable period after your account is closed, unless a longer retention period is required by law.
• Transaction and billing records are retained for approximately seven (7) years to meet tax, accounting, and audit obligations.
• Backups containing your data are purged within 90 days of deletion as part of our routine backup-rotation cycle.
• Opt-out and consent records (for example, SMS opt-out records) and email metadata used for delivery tracking are retained only as long as necessary to honor your choices, operate the service, and comply with the law.

You have the right to: access the personal data we hold about you; request correction of inaccurate data; request deletion of your data (subject to legal retention requirements); export your data in a portable format; withdraw consent for optional data processing; and revoke third-party integration access at any time. To exercise any of these rights, contact us at the email address below.

We use essential cookies to maintain your session and provide core platform functionality. We may use analytics cookies to understand how features are used and improve the platform experience. You can manage cookie preferences through your browser settings.

We may update this privacy policy from time to time. We will notify you of significant changes by posting a notice on the platform or sending an email to your registered address. Your continued use of the platform after changes take effect constitutes acceptance of the updated policy.

When you opt in to the KitchenRush Messaging Program (operated by Ali's Industries LLC) or to SMS from a restaurant operating on the platform, we collect your mobile phone number, your opt-in source (web form, keyword response, or in-person request), the opt-in timestamp, and the content of messages you send to or receive from the platform. Full SMS program terms — including program description, message frequency, message & data rates disclosure, and HELP and STOP instructions — are available on our Terms of Service page under section 14.

No mobile opt-in information will be shared with third parties or affiliates for marketing or promotional purposes. We do not sell, rent, or share your mobile phone number, your SMS opt-in consent, or any other SMS-related personal information with third parties for their own marketing purposes. Mobile opt-in data and SMS consent records are used only to deliver the messages you requested and to operate the messaging program (e.g., carrier routing, delivery tracking, fraud prevention).

We may share your mobile number with trusted service providers strictly to deliver messages on our behalf — for example, Twilio (our SMS carrier gateway) and mobile carriers (AT&T, T-Mobile, Verizon Wireless, U.S. Cellular, Sprint, and others). These providers are contractually prohibited from using your information for their own marketing. We do not share mobile information with advertising networks, data brokers, analytics platforms, or other third parties for marketing, profiling, or resale.

You can opt out of the SMS program at any time by replying STOP to any message. For help, reply HELP or email support@kitchenrush.app. Upon opt-out, we retain your opt-out record as required by law to ensure no further messages are sent to your number.

Depending on where you live, U.S. state privacy laws may give you specific rights over your personal information. We extend the following rights to residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Florida, Indiana, Iowa, and Tennessee (and we honor comparable rights for residents of other states as those laws take effect):

• Right to Know / Access: request confirmation of whether we process your personal information and access the categories and specific pieces of personal information we hold about you.
• Right to Delete: request deletion of the personal information we have collected from you, subject to legal and operational retention exceptions described in this policy.
• Right to Correct: request correction of inaccurate personal information we maintain about you.
• Right to Data Portability: receive a copy of your personal information in a portable and, where technically feasible, readily usable format.
• Right to Opt Out: opt out of any sale of personal information, any sharing for targeted or cross-context behavioral advertising, and any profiling that produces legal or similarly significant effects. As described below, we do not sell or share your personal information for these purposes.
• Right to Appeal: if we decline to act on your request, you may appeal that decision by replying to our response or emailing us at the address below. We will inform you in writing of our decision on your appeal and the reasons for it.
• Right to Non-Discrimination: we will not discriminate against you for exercising any of these rights.

How to exercise your rights. Submit a request by emailing support@kitchenrush.app with the subject line "Privacy Request" and a description of the right you wish to exercise. To protect your information, we will take reasonable steps to verify your identity before fulfilling a request — typically by confirming information already associated with your account or, where necessary, requesting additional information to match you to our records. You may use an authorized agent to submit a request on your behalf where permitted by law, in which case we may require proof of authorization and verification of your identity. We will respond to a verifiable request within 45 days. When reasonably necessary, we may extend this period by an additional 45 days and will notify you of the extension and the reason for it. There is no fee to exercise these rights unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline to act as permitted by law.

The following table describes the categories of personal information we collect (using the categories enumerated under the California Consumer Privacy Act, as amended) and the business purposes for which each category is collected and used.

The following metrics summarize the consumer privacy requests we received and processed for the period ending December 31, 2025.

Figures are for the period ending December 31, 2025.

Ali's Industries does not sell personal information for money. We also do not share personal information for cross-context behavioral advertising (sometimes called targeted advertising). We have not sold or shared personal information for these purposes in the preceding twelve months. Because we do not engage in these activities, there is no "Do Not Sell or Share My Personal Information" sale to opt out of; however, you may still exercise your opt-out and other privacy rights at any time by emailing support@kitchenrush.app.

Some browsers offer a "Do Not Track" (DNT) signal. There is no common industry standard for how DNT signals should be interpreted, and we do not currently respond to DNT signals from your browser. We will update this policy if that changes.

The platform is a business tool intended for restaurant owners and operators. It is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13 without appropriate consent, we will delete it promptly. If you believe a child under 13 has provided us with personal information, please contact us at support@kitchenrush.app.

We do not seek to collect sensitive personal information (such as government identifiers, precise geolocation, racial or ethnic origin, religious beliefs, health information, or biometric data) to operate the platform. To the limited extent any sensitive information is provided to us — for example, information an applicant voluntarily includes in a job application submitted through a restaurant's careers tools — we use it only for the specific purpose for which it was provided, do not use it to infer characteristics, and obtain consent where required by law. We do not sell or share sensitive personal information.

The platform is operated from the United States and intended for use within the United States. If you access the platform from outside the United States, your information will be transferred to, stored, and processed in the United States, where data-protection laws may differ from those in your jurisdiction. By using the platform, you consent to the transfer of your information to, and processing in, the United States.

For privacy requests, questions, or concerns, contact us at: support@kitchenrush.app

Ali's Industries — Houston, TX