Privacy Policy

Cluvi AI is a software-as-a-service platform for restaurants. Through the Cluvi AI web application at cluvi.ai (and, where available, the Cluvi AI mobile app) a restaurant's authorized staff can manage guest conversations in one inbox across WhatsApp and other connected channels, run an AI receptionist that answers guests and takes reservation requests and delivery orders, and send campaigns of approved WhatsApp template messages. Where available, the service can connect to the restaurant's Cluvi reservation system through integrations. Cluvi AI is a multi-tenant platform: each restaurant is an organization, and a person can belong to one or more organizations with a role of owner, admin, or member. The service is provided in Spanish and English.

Cluvi AI is operated by Braintu Inc., located at 251 Little Falls Drive, Wilmington, Delaware 19808, USA ("Cluvi AI", "we", "us", or "our"). Throughout this policy we refer to the restaurants and staff members who hold a Cluvi AI account as "you".

Scope. This policy primarily governs the personal information we handle as a controller: chiefly the account and organization information of the people who use Cluvi AI. It also explains, for transparency, the categories of personal information we process on a restaurant's behalf when the restaurant uses Cluvi AI to manage its guest conversations and records. For that processor activity, the restaurant's own privacy notices and the processor terms in our Terms & Conditions govern how the data is used, and an individual's rights run through the restaurant. We say more about this in Sections 2, 5 and 14.

Cluvi AI touches the personal information of two distinct groups of people, and our responsibilities are different for each. Please find the group that applies to you.

Account Users (a restaurant's owners, admins, and members)

Account Users are the people who register for and use the Cluvi AI dashboard: a restaurant's owners, managers, hosts and other authorized staff. For the personal information that relates to your Cluvi AI account and your use of the service, Cluvi AI is the data controller: we decide how and why that information is processed, and the rights described in Section 14 apply directly between you and us.

Guests & Contacts (the restaurant's own community)

Guests & Contacts are the members of a restaurant's own community: the diners who write to the restaurant, the people in its contact list, those who request reservations or order delivery, and the recipients of its campaigns, whose information the restaurant records and manages through Cluvi AI. For this information, the restaurant is the data controller and Cluvi AI acts only as a processor, handling the data on the restaurant's behalf and under its documented instructions.

If you are a guest and want to exercise your privacy rights (to access, correct, or delete information held about you, or to stop receiving messages, for example) please contact the restaurant. For Guests & Contacts, the restaurant is the controller and must respond to those requests; Cluvi AI will support the restaurant but will not respond to the individual directly without the restaurant's instruction, because the data belongs to that restaurant and is isolated to its workspace. See Section 14 for more.

The information below reflects what Cluvi AI actually collects and stores. Almost all of it lives in our primary backend (Supabase). We do not collect more than we describe here; in particular, we use no advertising trackers. We do run first-party product analytics for Account Users (never for Guests & Contacts), described under Technical & Usage Data below.

Account Information

When you create or use a Cluvi AI account, we collect your full name, email address, your phone number (if you sign in by phone), your role within each organization you belong to, and (optionally) an avatar. Sign-in is passwordless: you sign in with your email address and a one-time code we send to it, with your phone number and a one-time SMS code (delivered through Twilio Verify, where enabled for the service), or with "Sign in with Google" or "Sign in with Microsoft." If you sign in with Google or Microsoft, we receive basic OAuth profile data from that provider (such as your name, email address, and profile image). Cluvi AI accounts have no password: there is nothing for us to store, and authentication (including the one-time codes) is managed by Supabase Auth. See Section 6 for more on third-party sign-in.

Organization Data

For each restaurant, we store configuration such as the restaurant's name, its slug / URL, workspace settings, the connected messaging channels, and the membership and role information that controls who can access the workspace. When an owner or admin invites a colleague, we store the invitee's email address and the invitation's status so the invitation can be delivered and redeemed.

AI Assistant Conversations

When you use the AI assistant in Cluvi AI, we keep your conversations with it so you can pick them up on any device. Our support team, together with Cluvi's support team, can read them to help you, for example when you ask to talk to a person.

Guest Records

A restaurant records and manages personal information about its own guests through Cluvi AI. Depending on the features the restaurant uses, this can include contact records (names, phone numbers and contact details), the content of conversations the restaurant exchanges with guests through its connected channels, including attachments shared in those conversations (such as photos, documents, and voice notes), reservation requests (date, time, party size, the name the booking goes under, and a contact number), delivery orders (described below), and campaign data (the recipient lists the restaurant provides or builds, delivery results, and the opt-out records the service keeps so people who ask not to be contacted are not messaged again).

Important: this is third-party personal data that the restaurant chooses to collect and manage. For this data the restaurant is the controller and Cluvi AI is the processor, and we process it only on the restaurant's instructions to provide the service (see Sections 4 and 5). The restaurant is responsible for having a lawful basis (including any messaging consents its jurisdiction requires) to collect this information, to message its guests, and to give the notices its guests are owed.

Delivery Orders & Location

When a restaurant takes delivery orders through Cluvi AI, each order keeps what the delivery needs: who ordered and how to reach them, the dishes, the delivery address, the location pin where the order goes, the delivery zone and fee that pin falls in, and the instructions for the courier (such as "tower 3, apartment 502"). The pin comes from the guest: a location they share on WhatsApp, the spot they mark on the ordering page's map, or their device's location when they choose to use it there (their browser asks them first). When a guest writes an address instead, only the address text, never their name, phone number or order, is sent to Google Maps Platform to find it on the map. The location is used to quote the delivery fee, to deliver the order, and to show the restaurant on a map where its deliveries go.

A restaurant can register its own couriers (a name and a WhatsApp number) and is responsible for telling them. The courier assigned to an order receives a link with what the delivery needs: the guest's first name, phone number, delivery address and instructions, and the amount to collect; the link stops working when the order closes, and after 12 hours at most. While the courier carries the order, and only if they allow it in their browser (refusing does not stop the delivery), their page shares their current position with the restaurant's team and with that order's guest, who sees it on a map with an estimated arrival time. We keep only the latest position, never a route, and delete it as soon as the order is delivered or cancelled.

When a guest asks for delivery to a place the restaurant does not cover, we record that point rounded to about 110 meters (a block, never a door) with the time and the channel, and no name, contact or address, so the restaurant can see where a new delivery zone would help. These points are deleted after 180 days. Like the rest of the guest records, delivery orders, couriers' details and these points belong to the restaurant, which is their controller.

Social Media Posts

When a restaurant connects Instagram or Facebook, we also read the posts that account published in the last 12 months, including their text, photos and videos, so the restaurant's AI receptionist can learn from them. When a restaurant adds a YouTube channel on its AI Receptionist page, we read that channel's public videos and their titles and descriptions through YouTube API Services. A restaurant can turn this off for each account on that page, or remove the channel.

Cookies & Session Data

When you sign in, we process your authentication and session information through the essential cookies described in Section 9. We do not use non-essential or tracking cookies.

Technical & Usage Data

Like any web service, your device's IP address and similar connection information are necessarily handled by our hosting and backend providers (Vercel and Supabase) to deliver and secure the application. Apart from the delivery locations described above, which a guest or a courier gives for an order, Cluvi AI does not locate anyone or build advertising profiles, and it does not store IP addresses, device fingerprints, or browser strings about Guests & Contacts at the application layer. We do not use advertising pixels or cross-site tracking.

Mobile App Permissions

If you use the Cluvi AI mobile app, it asks for access to your camera, photo library, and microphone only when you choose to attach a photo or record a voice note in a conversation. The app does not access these in the background, and declining a permission only disables that attachment feature.

Product Analytics, Session Replay & Error Reports (PostHog)

To understand where Account Users get stuck and what errors they hit, we run product analytics through PostHog (one analytics project per product, hosted in PostHog's US cloud). For Account Users only, this collects: usage events (screens opened and actions taken), device and connection metadata, client-side error reports, and session replays, recordings of what your screen showed during a session. Replays capture screen content as you saw it, including text you type; passwords are always masked. Once you sign in, this data is linked to your account id and email so we can see a real session behind a real problem.

Scope and limits. Analytics covers Account Users only: Guests & Contacts are never instrumented. On the web, analytics events are sent through our own domain (first-party); marketing pages set no analytics identifiers until you sign in. We use analytics to improve the product, never for advertising, and we never sell it.

We use Account Users' information to provide and operate the service: creating and securing your account, delivering one-time sign-in codes and transactional email, running your restaurant's workspace, and providing support. We also use it to protect the service (preventing abuse, enforcing our terms, and meeting our legal obligations).

We do not sell personal information, we do not share it with third parties for their own marketing, and we do not use the contents of a restaurant's records to build advertising profiles. Cluvi AI's AI-assisted features operate on the restaurant's data as part of the service, on the restaurant's instructions, and never to train third-party models on your data without your agreement.

For the records a restaurant manages through Cluvi AI, the restaurant decides what is collected and why; Cluvi AI executes the restaurant's instructions: storing the data, displaying it to the restaurant's authorized staff, generating the AI receptionist's replies, sending the messages and campaigns the restaurant initiates, recording opt-outs, and deleting the data when the restaurant asks. Each restaurant's data is isolated to its own workspace, and access within the workspace is controlled by the roles the restaurant assigns.

Messaging and opt-outs. When a restaurant sends campaigns, the recipient lists belong to the restaurant, and having a lawful basis to message every recipient is the restaurant's responsibility as controller. The service keeps opt-out records so a person who asks not to be contacted is excluded from future campaigns; honoring those requests, and complying with the channel's messaging policies (such as the WhatsApp Business and Meta policies), is part of the restaurant's duties under our Terms & Conditions.

If you choose to sign in with Google or Microsoft, the provider shares basic profile data with us (name, email address, profile image) so we can create and match your account. We use this data only for authentication and your account profile. We do not receive your contacts, files, calendar, or any other data from these providers, and we cannot post or act on your behalf. Cluvi AI's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

You can connect your own AI assistant, such as Claude or ChatGPT, to Cluvi AI and run your restaurant by chatting with it. When you connect it, you sign in to Cluvi AI and choose all your restaurants' workspaces (including ones you join later) or only the ones you tick and whether it may make changes. It then works only in the workspaces you chose, as you, with your role in each.

What it can do. It reads the conversations, guests, reservations, settings and reports you can see in those workspaces and, if you allowed it, makes changes. A change such as inviting or removing people, changing a role, editing the AI receptionist's instructions or changing a reservation is shown to you as a preview first and applied only after you confirm it in the chat. Everyday order actions that take one tap in Cluvi AI, such as accepting an order, marking a dish sold out or telling a guest about their order, run as soon as your assistant asks. We receive only what each request needs, such as a search term or the change asked for, never your conversation with the assistant.

Your assistant's provider. The assistant is a service you choose, run by its own provider, such as Anthropic or OpenAI. What it reads from Cluvi AI, which can include your guests' messages and contact details, is processed by that provider under the terms and privacy settings of your own account with it. It is not one of our sub-processors, our commitments for the providers we use (Section 10) do not cover it, and we do not control or receive the copies it keeps.

Files. Files you send through your assistant are stored privately for that connection only, which can use them for 24 hours; they are deleted shortly after.

What we keep. We keep a record of each connection (the assistant's name, the workspaces it reaches or that it reaches all of yours, what it may do, and when it was connected and last used) and of each request (the assistant, the tool, its outcome and the time), including the changes it previewed and whether you confirmed them. We use these records only to list your connections, secure the service and support you, and keep them while the restaurant's workspace exists. We store the sign-in tokens your assistant holds only as one-way hashes and delete them a day after they expire. If you delete your account, your connections are deleted and the request records are no longer linked to you.

Disconnecting. Disconnect an assistant at any time in Settings, under Account; it stops at once. The restaurant's admins see every assistant that reaches its workspace and can disconnect any of them from it in Settings, under Integrations. When someone loses access to a workspace, their connections stop reaching it at once, and a connection unused for 90 days must sign in again. For questions about these connections, write to privacy@cluvi.ai.

Where a legal basis is required, we process Account Users' information because it is necessary to perform our contract with you (providing the service), because of our legitimate interests in securing and improving the service, to comply with legal obligations, or with your consent where we ask for it.

Cluvi AI serves restaurants in Colombia first, and we honor the Colombian data protection framework: Ley 1581 de 2012, its implementing decrees, and the constitutional right of habeas data. Data subjects in Colombia have the right to know, update, rectify and delete their personal data and to revoke consent, as described in Section 14. Where the data is a restaurant's guest records, those rights are exercised through the restaurant, which is the controller under that framework.

Cluvi AI uses essential cookies: the authentication and session cookies our backend (Supabase Auth) needs to keep you signed in securely, and a cookie that remembers your language preference, plus, after you sign in, a first-party identifier for the product analytics described in Section 3, kept in your browser's storage on our own domain. We set no advertising or cross-site tracking cookies, and marketing pages set no analytics identifiers, so no consent banner is required under the applicable rules.

We use a small number of service providers to run Cluvi AI. Each processes personal information only to provide its service to us and under contractual data protection commitments:

• Supabase (database, authentication, and file storage): the primary backend where account data and each restaurant's records are stored.
• Vercel (hosting and content delivery): serves the web application. AI-assisted features route model requests through Vercel's AI Gateway to the AI model providers that generate replies (Anthropic, Google, ElevenLabs and OpenAI), to Cohere for search and to TypeSafe for classifications (such as the language a guest writes in), and to xAI, which transcribes guests' voice notes when ElevenLabs is unavailable; conversation content is processed to produce the reply and is not used to train those providers' models without your agreement.
• Meta Platforms (WhatsApp Business Platform, Instagram and Facebook): delivers the WhatsApp conversations and campaign messages a restaurant exchanges with its guests, under Meta's own terms and messaging policies, and lets us read the posts of the Instagram accounts and Facebook Pages a restaurant connects.
• Google (YouTube API Services): reads the public videos of a YouTube channel a restaurant asks its AI receptionist to learn from. Our use of YouTube API Services is also subject to the Google Privacy Policy: https://www.google.com/policies/privacy
• Google (Google Maps Platform, where enabled): finds on the map an address a guest writes for a delivery (only the address text is sent, never the guest's name, phone number or order), and draws the ordering page's map in the guest's browser.
• OpenStreetMap (maps): draws the delivery maps. The browser of whoever views one asks OpenStreetMap's servers for the area shown, so they see that browser's IP address and the area, never anything about the order. It also finds a restaurant's own address when its staff set up delivery.
• Resend (transactional email): delivers one-time sign-in codes, invitations, and service email from cluvi.ai addresses.
• Google and Microsoft (optional sign-in): authenticate you when you choose "Sign in with Google" or "Sign in with Microsoft."
• Stripe (payments): processes subscription payments for restaurants when billing features are enabled; Cluvi AI never stores full card numbers.
• Twilio (SMS sign-in codes): delivers the one-time SMS codes when you sign in by phone (Twilio Verify), where enabled for the service.
• PostHog (product analytics): product analytics, session replay, and error reporting for Account Users (one analytics project per product, hosted in PostHog's US cloud). See Technical & Usage Data in Section 3.

Where the restaurant connects its Cluvi system (its reservations, and the kitchen system its orders are sent to) or another integration, the connected provider processes the data the restaurant exchanges with it under that provider's own terms. We will update this list as the service evolves; material changes will be reflected in this policy.

Cluvi AI is operated from the United States, and the service providers listed above store data primarily in the United States. If you use Cluvi AI from Colombia or elsewhere, your information (and the records a restaurant manages) will be transferred to and processed in the United States. We take the safeguards described in this policy and in our contracts with providers wherever the data is processed, and restaurants remain able to meet their local-law duties (including Colombia's international transfer rules) through our processor commitments.

We keep Account Users' information for as long as the account is active. A restaurant's records are kept for as long as the restaurant's workspace exists and are handled on the restaurant's instructions: when a restaurant deletes a record, or deletes its organization, the corresponding data is removed from the live systems, with residual copies in encrypted backups expiring on a rolling basis. Restaurants should retain their own copies of records that local regulations require them to preserve. A delivery order keeps its address and location pin with the restaurant's records; a courier's position is kept only while the order is on the way, and the rounded points of deliveries asked for outside the restaurant's zones are deleted after 180 days.

What the AI receptionist learned from a restaurant's social media posts is deleted 30 days after the account is disconnected or its learning is turned off, and immediately when Meta relays a data deletion request; what it learned from a YouTube channel is deleted when the restaurant removes the channel, or after 30 days without a successful refresh.

We protect personal information with encryption in transit (TLS) and at rest, tenant isolation enforced at the database layer (each restaurant's workspace is segregated with row-level security), role-based access inside each workspace, and passwordless authentication that eliminates stored passwords entirely. No system is perfectly secure, but we design so that the blast radius of any failure is as small as possible, and we will notify affected restaurants without undue delay if a security incident involves their data.

Account Users can access and update their name and avatar in the dashboard, and can ask us to access, correct, delete, or export the personal information we hold about them, or to restrict or object to its processing, by writing to the address in the contact block below. Where processing rests on consent, you can revoke it at any time. If you believe we have not honored your rights, you can complain to your local data protection authority (in Colombia, the Superintendencia de Industria y Comercio).

Guests exercise their rights (including habeas data rights in Colombia) through the restaurant they wrote to, which as controller must respond to requests to know, update, rectify or delete the information it manages, and to stop messaging them. We support restaurants in fulfilling those requests promptly, and the service records messaging opt-outs so they hold.

Cluvi AI accounts are for adults only (18 years or older), and the service is not directed at children. We do not knowingly allow children to create accounts, and we do not knowingly collect personal information directly from children. If a minor's information appears in a restaurant's records (for example, in a conversation or a reservation), the restaurant is the controller of that data and responsible for handling it lawfully. If you believe a child has created an account, please contact us and we will act promptly.

We may update this policy as Cluvi AI evolves. When we make material changes, we will update the effective date above and notify Account Users through the service or by email. Continued use of Cluvi AI after a change takes effect means the updated policy applies.