Privacy Policy

Just Make the Food Inc ("JMTF", "we", "us") operates the JMTF restaurant operating system. This policy describes how we collect, use, and protect information from restaurants who use the platform, and from customers who order food through restaurants powered by JMTF.

From restaurants:

• Business information (name, address, phone, EIN, owner information) collected to set up the account
• Point of sale credentials (e.g., Clover API tokens) needed to sync menus and dispatch orders
• Stripe Connect account identifiers (not bank credentials — those are held by Stripe)
• Menu, hours, branding content uploaded to the platform

From customers:

• Name and phone number (required for every order)
• Email address (optional, used for order confirmations)
• Delivery address (when ordering delivery)
• Order history (items, totals, timestamps)
• Payment details: card information is collected directly by Stripe in the customer's browser. JMTF never sees, stores, or transmits card numbers.

From callers, when a restaurant uses the optional voice ordering add-on:

• An audio recording of the call. Recording is on for JMTF voice lines: it is configured at our voice orchestration provider (Section 4), not chosen per call by the restaurant, and the call opens with a spoken notice about it.
• A written transcript of the call and an automated summary of it, produced from that audio
• Your phone number as presented by the telephone network, and the name, phone number and order details you give during the call

See Section 5 for what we do and do not do with call audio, and Section 6 for how long each of these is kept.

Automatically collected:

• IP address, browser type, device information
• Pages visited and actions taken (for product analytics)
• Cookies for session management

• To operate the platform and provide the services described in our Terms
• To process orders, route payments, and dispatch deliveries
• To send transactional email and, only with checkout opt-in, one order-confirmation SMS with a tracking link for that order
• To take a phone order and pass it to the restaurant, where the restaurant uses the voice ordering add-on, and to let the restaurant review what was said on a call it answered
• To provide customer support to restaurants and to customers
• To improve the platform (aggregate analytics, never sold or shared with advertisers)
• To comply with legal obligations (tax reporting, payment regulations, law enforcement requests when legally required)

We do not sell personal information. We do not share customer information with third parties for advertising purposes.

JMTF uses the following third-party services to operate the platform. Information shared with these providers is subject to their respective privacy policies. The mobile information and messaging consent protections in Section 8 apply to this sharing.

• Google Maps Platform — address suggestions. When available, the address text you type is sent to Google to suggest and fill addresses. See the Google Privacy Policy. You can also enter your address manually.
• Stripe — payment processing. Card details are collected directly by Stripe.
• Twilio — telephone connectivity for the voice ordering add-on, optional checkout order-confirmation texts, and messaging opt-out, opt-in, and help responses.
• Clover (and future POS providers: Toast, Square) — order dispatch and menu sync, on behalf of the restaurant.
• DoorDash Drive, Uber Direct, Grubhub Direct — delivery dispatch when the customer chooses delivery.
• Vapi — voice orchestration for restaurants that enable the optional voice ordering add-on. Call audio is transmitted to Vapi in real time during the call, and Vapi — not JMTF — stores the audio recording. See Section 5.
• Deepgram — speech-to-text. Call audio is transmitted to Deepgram during the call so that the words spoken can be converted to text.
• ElevenLabs — text-to-speech. It generates the assistant's spoken replies from text, using a single fixed stock voice. Caller audio is not used to create or alter it.
• Railway, Vercel, Cloudflare — hosting and content delivery infrastructure.

Some restaurants on JMTF answer their phone with an automated assistant. On those lines, the call is answered by software rather than a person, and the call is recorded and transcribed. Every call opens with a spoken notice about recording, which JMTF's servers add ahead of the restaurant's own greeting; a restaurant cannot remove, shorten or reorder it. The assistant is software, not a person, and if you ask whether it is a person, whether it is an AI, or whether the call is recorded, it is required to answer truthfully and is instructed never to claim to be human.

What happens to the audio. During the call, audio is transmitted to our voice providers (Section 4) so that the words spoken can be converted to text and so the assistant can reply. The audio recording is stored by our voice orchestration provider, Vapi, rather than on JMTF's own servers; JMTF keeps only a reference that lets an authorised restaurant or JMTF administrator play the recording back, and every such playback is logged. The call is also transcribed: we keep a written transcript of what was said and an automated summary of the call, both retained on the schedule in Section 6.

What we do not do with your voice:

• We do not create voiceprints. Nothing in the platform generates, stores or compares a template, model or other mathematical representation of the sound of your voice.
• We do not perform speaker identification, speaker verification, speaker diarisation or voice biometric matching. We do not use call audio to work out who is speaking, to recognise a caller across calls, or to confirm a caller's identity.
• We do not clone voices. The assistant speaks in a single fixed stock voice that is the same on every call and is not derived from any caller's audio.
• We do not use call audio to identify callers. We identify an order by the phone number the telephone network gives us and by the name you provide — not by how you sound.

We identify callers by telephone number only. Speech is converted to text so that the assistant can understand what was said; it is never processed to determine who said it.

If you ask a question about allergens or ingredients, the assistant is required to route you to a person at the restaurant rather than answer. It does not give allergen assurances.

Order records and restaurant business records are retained for as long as the restaurant's account is active and for up to seven (7) years after account termination to satisfy tax and audit requirements. Voice and messaging records have the shorter retention targets below; actual erasure depends on processing.

Retention and destruction schedule

These are the configured default retention targets. When run, retention processing uses the configured windows to identify and erase expired records in bounded batches. Where scheduled erasure is switched on, processing runs daily; otherwise an operator must start a maintenance run. If processing is disabled, delayed or backlogged, records and playback can remain available beyond these targets. Reaching a target age alone does not erase a record or stop playback.

Call audio. The recording is stored by our voice orchestration provider (Section 4), not on JMTF's servers. When retention processing anonymizes an expired call, playback stops: both the recording view and the playback link refuse it from that moment on. The default target is 90 days, but this depends on the call being processed. Provider deletion can still be outstanding after playback has stopped.

Erasing the audio at the provider is a separate step under its own control, because destroying a provider call record cannot be undone. Where provider-side erasure is switched on, JMTF issues the erase at the provider itself rather than leaving the audio to the provider's own retention practices; it works through a bounded number of recordings per run, so a backlog drains over several runs instead of all at once; and it drops its reference to the recording only once the provider has confirmed the erase or reported the audio already absent. A failed erase is retried and then left visible to us as an unresolved failure rather than quietly written off, and the outcome of every attempt is recorded in an audit trail kept deliberately longer than the windows above. Where it is switched off, or set only to report what it would erase, the audio stays with the provider and JMTF keeps its reference. Playback stays closed once the local call has been anonymized, regardless of the provider deletion outcome.

Records of who accessed a caller's phone number, a recording or a transcript are deliberately kept longer than the events window above, so that access to personal information stays auditable after the underlying data is gone.

We use industry-standard security practices: encryption in transit (TLS), encryption at rest for database and backups, least-privilege access controls, and regular security audits. Card information is collected directly by Stripe (PCI DSS Level 1 certified) and never touches our servers.

SMS is optional. At checkout, customers can select an unchecked box to receive one automated order-confirmation text from JMTF (Just Make The Food), on behalf of the restaurant, with a link to track that order. Placing an order or providing a phone number alone does not give SMS consent. Consent is not required to purchase. No marketing messages are included.

We record the consented phone number, order and restaurant, disclosure version, source, and time of consent. Up to 1 message per order. Message and data rates may apply. Reply STOP to opt out or HELP for help, or email support@justmakethefood.com. START removes a messaging block but does not replace a new checkout opt-in. Missed calls and voice orders do not establish consent to this web-order SMS program.

We do not sell, share, or provide mobile phone numbers, mobile information, SMS opt-in data, or messaging consent to third parties or affiliates for marketing or promotional purposes. Service providers that deliver messages on our behalf may process the information needed to provide that service.

Depending on your jurisdiction (e.g., California, EU), you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Request deletion of your information
• Object to certain processing
• Data portability

To exercise these rights, email privacy@justmakethefood.com. We respond within 30 days.

Calls, transcripts and text messages

To ask for a copy of, or the deletion of, a specific call, email the same address and include the phone number you called from, the restaurant you called, and the approximate date and time. We need those to find the call: calls are stored under the restaurant that answered them, and we have no way to search for a caller across restaurants. We will ask you to confirm control of the phone number before releasing a recording or transcript, because that number is the only identifier tying the call to you.

• Access. We can provide the transcript and summary of a call while we still hold them, and arrange playback of the recording while playback remains available. After retention processing removes the local transcript and summary, we cannot provide those copies. Provider audio may remain as described in Section 6.
• Deletion. We will erase the transcript, summary and caller number for the call ahead of the scheduled window, and end playback of the recording at the same time. For the audio we use the same mechanism as the schedule, under the same control: where provider-side erasure is switched on, we issue the erase to our voice orchestration provider directly and will tell you the outcome it returned, including if it failed; where it is not, we will tell you that the audio remains with the provider. We cannot delete the record of the order itself where we are required to keep it for tax or audit purposes, and we cannot delete the log of who previously accessed the data.
• Text messages. Reply STOP to any message to opt out immediately, which we honour permanently; see Section 8.

JMTF is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided information, contact us and we will promptly delete it.

We may update this Privacy Policy from time to time. Material changes will be communicated to restaurants via email. The "Last updated" date at the top reflects the current version.

Privacy questions or requests? privacy@justmakethefood.com

Just Make the Food Inc