Privacy Policy

Kubilo provides (a) an informational Site and (b) a software Platform used by restaurants to take and manage orders across channels (counter and QR-code ordering, website ordering, walk-in, and AI phone), print kitchen tickets, run optional marketing, and accept card payments through a third-party payment processor.

For personal information of a Merchant's own customers processed through the Platform, the Merchant directs that processing and Kubilo acts as a service provider on the Merchant's behalf. Kubilo is responsible for its own Site and account data.

We are committed to handling any information you share with us responsibly and transparently, and only as described in this policy.

Through the Site: The Site includes no forms, account registration, or checkout flows. If you contact us by emailing contact@kubilo.com, we receive any personal information you include (such as your name and email address), solely so we can respond to your inquiry. Our hosting infrastructure (currently Cloudflare) automatically records standard server access logs (your IP address, the pages requested, the date and time of your visit, and your browser type); we do not use these to identify or track individual visitors.

Through the Platform — when you place an order with a Merchant: we collect the information needed to fulfill your order, which may include your name, phone number, order details and any special instructions, a table number (for dine-in orders), and a delivery address and delivery notes (for delivery orders).

Through the Platform — AI phone orders: calls placed to a Merchant's AI phone line may be recorded and transcribed to take your order. We disclose recording at the start of the call (see "AI Phone Calls & Call Recording" below).

Through the Platform — accounts and marketing: for Merchants, we collect business details and staff-account information used to operate the Platform. If you opt in to a Merchant's promotions, we collect your contact details and a record of your consent (see "SMS and Text Messages" below).

Payments: card payments are handled by our third-party payment processor. We do not receive or store your full card number (see "Payment Processing" below).

We do not set any cookies of our own. Fonts used on this Site are self-hosted, so no requests are made to Google Fonts or similar external font services at runtime.

This Site embeds a YouTube video using a click-to-load approach. The video player does not contact YouTube's servers until you actively click the play button. Once you click play, YouTube (a Google service) may set cookies and collect data in accordance with Google's privacy policy, available at https://policies.google.com/privacy.

We currently use no analytics service on this Site. We may add a privacy-friendly analytics tool in the future, at which point this policy will be updated.

Site email: the only personal information we receive through the Site is what you voluntarily send us by email. We use that information solely to respond to your inquiry and for no other purpose, and we do not sell, rent, or share your email correspondence with third parties.

Platform: we use order and account information to provide and operate the Services — to take, route, print, and manage orders; process payments through our payment processor; send transactional order updates; and, where you have opted in, send Merchant promotions.

De-identified and aggregated data: we may use de-identified and aggregated data (from which no specific person, customer, or store can reasonably be identified) to operate, analyze, and improve our products and services, including our AI features.

Server access logs retained by our hosting provider are used for normal operational purposes such as diagnosing technical issues and maintaining service reliability.

Card payments are processed by our third-party payment processor (Stripe). You enter your card details on the processor's hosted checkout page or on a physical card reader.

We do not receive, process, or store your full card number (PAN) or card security code. We receive only non-sensitive transaction identifiers and amounts.

The payment processor handles card data under its own privacy policy and its PCI-DSS obligations.

Calls placed to a Merchant's AI phone line may be recorded and transcribed to take and process your order. We provide a recording disclosure at the start of the call.

We do not actively store call audio or transcripts ourselves. They are retained by our AI/telephony service provider under that provider's then-current retention terms, after which the provider deletes them.

Separately from this Site, the Kubilo platform sends text messages to customers of restaurants ("Merchants") that use Kubilo's order management software. If you opt in to receive promotional or transactional text messages from a Merchant, we will collect and store your phone number, the exact opt-in consent language you saw, your IP address, the device user-agent string, and a timestamp of when you opted in. This information is retained as a TCPA audit record for the duration of your subscription and for a reasonable period thereafter (typically two years after opt-out).

Phone numbers collected through Kubilo's Merchant order flows are used only to deliver: (a) order status updates (transactional, no opt-in required); (b) promotional content from the Merchant whose receipt or QR code you scanned (opt-in required and explicitly recorded); and (c) service-related notifications such as opt-out confirmations.

We do NOT share, sell, or rent phone numbers to other parties. We do not use phone numbers to target advertising or build cross-site profiles. Phone numbers are shared only with Twilio Inc. (our SMS infrastructure provider, solely for delivery), the Merchant whose campaign you opted in with, and law-enforcement agencies pursuant to a valid legal order.

In compliance with messaging carrier requirements: mobile information of the end user opting in to the message program will never be shared or sold to third parties or lead generators for any purpose.

You may opt out of promotional SMS at any time by replying STOP to any message. Opt-outs are processed in real time through Twilio, our messaging provider. Reply HELP to any message to receive contact information.

Message and data rates may apply (charges from your wireless carrier). Message frequency varies by campaign but is typically capped at no more than 4 promotional messages per month per Merchant.

For full details on SMS opt-in flows, data handling, and discount-code rules, see our SMS Policy at https://kubilo.com/sms-policy.

We share information with service providers only as needed to operate the Services. These include categories such as: our payment processor (card processing), hosting infrastructure (currently Cloudflare), SMS and email providers (message delivery), and an AI/telephony provider (AI phone calls).

We do not sell your personal information, and we do not share it with third parties for their own advertising.

We retain personal information for as long as needed to provide the Services and as required by law. For example, SMS opt-in audit records are retained for the duration of your subscription and a reasonable period thereafter (typically two years after opt-out).

AI call audio and transcripts are retained by our AI/telephony provider under its terms, not stored by us.

When a Merchant closes its account, the Merchant may export its data for a limited period (currently 30 days), after which we may delete or de-identify it.

We use reasonable administrative, technical, and organizational measures to protect personal information. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Depending on where you live, you may have rights under applicable privacy laws. For example, residents of California (under CCPA/CPRA) and individuals in the European Economic Area (under GDPR) may have rights to access, correct, delete, or restrict the processing of personal data about them, or to object to certain uses.

You may request a copy or deletion of your data at any time by emailing contact@kubilo.com. For data tied to a specific Merchant, we may direct or coordinate your request with that Merchant, who directs that processing.

You may opt out of promotional SMS at any time by replying STOP to any message, and reply HELP to any message to receive contact information.

This Site is not directed at children under the age of 13. We do not knowingly collect personal information from children. Kubilo's SMS services are also not directed at children under 13. If you believe we have inadvertently received information from a child, please contact us and we will delete it.

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects when the policy was last revised. Continued use of the Site or Platform after an update constitutes your acceptance of the revised policy.