Privacy Policy

1. Introduction

Shisu, Inc. ("Shisu," "we," "us," or "our") operates an AI platform for restaurants. Our services include a voice ordering agent that answers restaurant phone calls, an SMS-based operations assistant that restaurant staff and owners use to run day-to-day operations (shift scheduling and coverage, item availability, inventory notes, operational questions, and end-of-day sales summaries), and point-of-sale and payment tools. This Privacy Policy explains how we collect, use, store, and protect information when you interact with our services — whether you are a restaurant operator, a member of a restaurant's staff, a customer placing an order, or a visitor to our website.

By using our services, you agree to the practices described in this policy. If you do not agree, please do not use our services.

2. Information We Collect

We collect the following categories of information:

A. Customer (caller) information

• Phone number (provided by the telephone network)
• Name (if provided verbally during the call)
• Order details (items, quantities, special instructions)
• Call recordings (audio recordings of phone orders)
• Call transcripts (generated from recordings)

B. Restaurant operator information

• Restaurant name, address, and phone number(s)
• Owner/operator contact name, email address, and mobile number
• Menu data (items, prices, descriptions, availability)
• Schedule, shift, and sales data generated through the platform
• Account credentials (managed via Supabase Auth)

C. Restaurant staff information (SMS operations)

• Name, role/position, and mobile phone number, entered by the restaurant operator
• Availability and shift assignments
• The content of text messages exchanged with our operations number (for example, claiming a shift, sending availability, or marking an item unavailable)
• Opt-in and opt-out status for text messaging

D. Payment information

• For restaurants that enable payments, transaction amounts, order totals, tips, and payment status
• Payment card details are collected and processed directly by our payment processor (Stripe) and are not stored on Shisu's systems

E. Website visitor information

• Information you submit through our contact or demo request forms (name, email, phone, restaurant details)

We do not use cookies, tracking pixels, or third-party advertising analytics on our website.

3. How We Use Your Information

• Processing orders — to take, confirm, and transmit food orders to the restaurant
• Restaurant operations — to run scheduling and shift coverage, notify staff of open shifts, record availability, propagate item-availability ("86") and inventory updates, answer operational questions, and send sales summaries to the owner
• AI understanding — to interpret the content of calls and text messages so the assistant can respond and take the requested action
• Payments — to process and reconcile card and cash transactions for restaurants that enable payments
• Improving service quality — to review recordings and message handling for accuracy and to improve our models
• Communication — to respond to demo requests and provide customer support
• Legal compliance — to comply with applicable laws, regulations, or legal processes

4. SMS / Text Messaging

Our SMS operations assistant is used by a restaurant's own staff and owners. A restaurant operator adds a staff member's mobile number to the platform, and the staff member consents to receive operational text messages from Shisu as part of their work with that restaurant. We do not send marketing or promotional text messages.

• Message types: shift assignments and coverage requests, availability replies, item availability and inventory updates, operational questions, and sales summaries to owners.
• Message frequency varies based on restaurant activity. Message and data rates may apply.
• Opt-out: you may opt out at any time by replying STOP to any message. Reply HELP for help, or START to opt back in.
• We do not sell, rent, or share mobile phone numbers or SMS opt-in/consent data with third parties or affiliates for their own marketing or promotional purposes. Mobile information is used only to operate the service for the restaurant.
• Your mobile information will not be sold or shared with third parties for promotional or marketing purposes.

5. How We Store and Protect Your Data

• Call recordings are stored in Amazon Web Services (AWS) S3, encrypted at rest, in US-based data centers
• Database records (orders, restaurant data, staff, schedules, message state, account information) are stored in Supabase, hosted in the US
• All data is transmitted over encrypted connections (TLS/HTTPS)
• Access to production systems is restricted to authorized personnel

6. Data Sharing

We do not sell, rent, or trade your personal information. We may share data with:

• Restaurant partners — order details, caller information, and staff operational data are shared with the restaurant they belong to
• Service providers that process data on our behalf under their respective privacy policies: Telnyx (telephony and SMS), OpenAI (AI processing of call and message content), Amazon Web Services (hosting and storage), Supabase (database and auth), and Stripe (payment processing)
• Legal obligations — we may disclose information if required by law, subpoena, or court order

7. Data Retention

• Call recordings are retained for up to 90 days, then automatically deleted
• Order, schedule, staff, and message records are retained for as long as the restaurant partner maintains an active account
• Demo request submissions are retained for up to 12 months

You may request earlier deletion by contacting us at the address below.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Request access to the personal information we hold about you
• Request correction or deletion of your personal information
• Opt out of call recording (inform the voice agent at the start of your call)
• Opt out of text messaging (reply STOP to any message)
• Request a copy of your data in a portable format

To exercise any of these rights, email us at support@shisu.ai. We will respond within 30 days.

9. California Residents (CCPA)

If you are a California resident, you have the right to know what personal information we collect, request its deletion, and opt out of its sale. We do not sell personal information. To submit a request, contact us at support@shisu.ai.

10. Children's Privacy

Our services are not directed to individuals under the age of 13. We do not knowingly collect personal information from children. If we learn that we have collected information from a child under 13, we will promptly delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Effective" date at the top of this page. Continued use of our services after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy, contact us at:

Shisu, Inc.
770 Broadway, New York, NY 10003
support@shisu.ai
(469) 344-5203