1. Who We Are and Which Roles We Play

Coneeko provides AI voice agents that answer restaurant telephone lines and take orders. Two different groups of people interact with us, and our role differs for each:

• Restaurant customers ("Customers"). Restaurants and their staff who subscribe to the Services and use our dashboard. For their account, billing, and website data, Coneeko acts as a business/controller.
• Callers ("End Users"). Guests who telephone a restaurant that uses Coneeko. For call audio, transcripts, and order content, Coneeko acts as a service provider/processor on behalf of the restaurant, and we handle that information under our contract with the restaurant. The restaurant, not Coneeko, decides what its callers are told and how long its order records are kept. If you are a caller with a question or request, you may contact us and we will route your request to the restaurant.

Coneeko does not knowingly provide services to, or collect personal information from, children under 16. We do not sell or share the personal information of anyone we know to be under 16.

2. Personal Information We Collect

We collect the categories of personal information listed below. We have collected each of these categories within the preceding 12 months.

• Identifiers. Name, business name, email address, telephone number (including caller line identification/ANI), postal and delivery address, account username, IP address, device and browser identifiers, and online/cookie identifiers.
• Customer records and commercial information. Order history, items, modifiers, special instructions, totals, subscription plan, transaction records, and support tickets. Payment card details are collected and stored by our payment processor, not by Coneeko.
• Audio, electronic, and similar information. Recordings of telephone calls placed to restaurant lines that we service, machine-generated transcripts of those calls, voicemail, and SMS message content.
• Internet or network activity. Pages viewed, referring and exit pages, links clicked, session duration, approximate location derived from IP address, and diagnostic and error logs.
• Inferences. Order preferences and repeat-order patterns generated from the information above, used to speed up ordering.
• Sensitive personal information. Account login credentials. If a caller volunteers information such as a food allergy, that statement is captured in the call recording and transcript. We do not ask for, and ask that you not provide, government identification numbers, health records, financial account numbers, precise geolocation, or other sensitive details over the phone. We use sensitive personal information only to perform the Services, and never to infer characteristics about you.

We collect this information directly from you (when you fill in a form, create an account, telephone a restaurant we service, or contact support), automatically from your device or the telephone network, and from our Customers and integration partners (for example, a point-of-sale system that returns order status).

3. Use of Artificial Intelligence and Automated Processing

Coneeko is an artificial intelligence product. When you call a restaurant that uses Coneeko, you are speaking with an automated AI voice agent, not a human employee. You may ask at any time to be transferred to a member of restaurant staff, or hang up and place your order another way.

To operate the Services we use automated systems, including third-party AI models, to:

• convert speech to text and text to synthesized speech;
• interpret an order, answer menu and hours questions, and assemble a ticket;
• generate call summaries and quality scores in the Customer dashboard; and
• detect fraud, abuse, and system errors.

AI output can be wrong. Automated systems can mishear items, quantities, prices, modifiers, and allergy statements. Coneeko does not make any legal or similarly significant automated decision about you, and no AI output should be relied upon as a substitute for confirmation by restaurant staff. Callers with a food allergy or other health-critical requirement should confirm it directly with restaurant staff before consuming any food.

Model training. We use call recordings and transcripts to operate, troubleshoot, and improve the accuracy of the Services for the Customer whose calls they are. We do not sell them, and we do not permit our AI vendors to use Customer or End User content to train their general-purpose foundation models; our vendor agreements require zero data retention or equivalent restrictions where that option is offered. We may create de-identified and aggregated data (from which personal information has been removed and which we do not attempt to reidentify) and use it for any lawful purpose, including improving our own models and reporting industry statistics.

4. Notice of Call Recording and Monitoring

Telephone calls to restaurant lines serviced by Coneeko are recorded, transcribed, and monitored. Some U.S. states, including California under the California Invasion of Privacy Act (Cal. Penal Code §§ 630-638.55), require the consent of all parties to record a telephone call. The restaurant you are calling is responsible for giving you any notice of recording that its law requires.

If you do not consent to being recorded, do not continue the call. Please hang up and place your order in person, through the restaurant's website or ordering app, or by asking to be transferred to a member of restaurant staff. You may also tell the voice agent at any point that you do not wish to be recorded.

Recordings and transcripts are made available to the restaurant you called. Restaurants that use the Services are contractually required to provide any additional notice their own law requires. Coneeko does not use call recordings for advertising and does not disclose them to advertisers or data brokers.

SMS messages. If you provide a mobile number, you may receive transactional order-confirmation and order-status text messages from or on behalf of the restaurant. Message and data rates may apply. Reply STOP to opt out and HELP for help. Marketing text messages are sent only where you have separately consented to receive them.

5. Third Parties That Receive or Collect Information

We disclose personal information for business purposes to the categories of recipients below. Each is bound by contract to use the information only to provide services to us and is prohibited from selling it.

• Cloud hosting and storage providers — to run and back up the platform.
• Telephony and messaging carriers — to route calls and deliver SMS.
• AI and speech technology providers — to transcribe, understand, and synthesize speech.
• Payment processors — to bill subscriptions and process transactions.
• Point-of-sale, delivery, and restaurant technology partners — to deliver the order to the restaurant, at the restaurant's direction.
• Analytics, product-monitoring, error-reporting, and advertising measurement providers — to understand how our websites are used.
• Customer support, email, and CRM providers — to answer your messages.
• Professional advisors, insurers, auditors, and, where required, law enforcement or other government authorities.
• An acquirer or successor in a merger, financing, reorganization, or sale of assets.

Third-party collection on our website. Some of these providers, including analytics and advertising-measurement vendors, place cookies, pixels, tags, software development kits, or similar technologies on our websites that collect information about your device and browsing activity directly, and they may act as independent controllers of that information. This collection is described in our Cookie Policy. Where required, we obtain your consent before non-essential technologies are activated, and you may withdraw consent at any time.

No sale of personal information. Coneeko does not sell personal information for money. We do not sell or share call recordings, transcripts, order contents, or caller telephone numbers for cross-context behavioral advertising, and we never have. Certain uses of website analytics and advertising cookies may nonetheless be treated as a "sale" or "share" under the CCPA; where they are, we honor opt-out requests and Global Privacy Control browser signals as described in Section 7.

A current list of our material subprocessors is available on request at the address in Section 12.

6. How and Why We Use Personal Information

We use personal information only for the following business and commercial purposes:

• to answer calls, take and transmit orders, and confirm them by SMS;
• to create, secure, and administer accounts and to bill subscriptions;
• to provide support and respond to your inquiries;
• to maintain, debug, and improve the accuracy, safety, and reliability of the Services;
• to detect and prevent fraud, spam, abuse, and security incidents;
• to produce de-identified and aggregated analytics and reports;
• to send service and administrative messages, and marketing messages you may opt out of at any time; and
• to comply with law and to establish, exercise, or defend legal claims.

Where the GDPR or UK GDPR applies, we rely on the following legal bases: performance of a contract; our legitimate interests in operating, securing, and improving the Services; compliance with legal obligations; and consent, which you may withdraw at any time.

We will not use or disclose personal information for purposes materially different from those described here without first providing notice and, where required, obtaining consent.

7. Your Privacy Rights and How to Exercise Them

Depending on where you live, you may have the right to: know or access the personal information we hold about you and the categories of sources and recipients; obtain a portable copy; correct inaccurate information; delete your information; opt out of any sale or sharing of your information and of targeted advertising; limit the use of sensitive personal information; appeal a denial of a request; and not be discriminated or retaliated against for exercising these rights. Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws, as well as individuals in the EEA and UK, may have some or all of these rights.

To make a request, email coneeko.com@gmail.com with the subject line "Privacy Request." We will verify your identity by matching the information in your request against our records, and we may ask for additional information for that purpose. We respond within the time limits set by applicable law (generally 45 days, extendable once). An authorized agent may submit a request on your behalf with written permission that we can verify.

Opt-out preference signals. We treat a Global Privacy Control (GPC) signal transmitted by your browser as a valid request to opt out of the sale or sharing of personal information from that browser.

Requests about call recordings. Because we hold call recordings, transcripts, and order records on behalf of the restaurant you called, we will forward such requests to that restaurant and act on its instructions, as the law permits us to do as a service provider. Tell us the restaurant name and the approximate date and time of the call so that we can locate the record.

EEA and UK individuals may also lodge a complaint with their local supervisory authority.

8. Cookies and Similar Technologies

We and our providers use cookies, local storage, pixels, tags, and similar technologies for essential functions (authentication, security, load balancing), for functional preferences, and for analytics and measurement. Details, including how to withdraw consent or change your choices, are in our Cookie Policy. Disabling essential technologies will prevent the dashboard from working.

9. Retention

We keep personal information only as long as needed for the purposes described in this Policy. As a general rule, call recordings and transcripts are retained for the period configured by the restaurant in its dashboard and are then deleted or de-identified; account, billing, and tax records are retained for as long as the account is active and afterwards for the period required by law; and website analytics data is retained on a rolling basis. We may retain information longer where necessary to comply with a legal obligation, resolve a dispute, or enforce our agreements, including under a litigation hold.

10. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit using TLS, encryption at rest, access controls on a need-to-know basis, logging, and vendor due diligence. No method of transmission or storage is completely secure, however, and we cannot and do not guarantee absolute security. You are responsible for keeping your account credentials confidential and for promptly notifying us of any suspected unauthorized access. Report security concerns to coneeko.com@gmail.com.

11. International Transfers and Third-Party Links

Coneeko is based in the United States and processes information in the United States and in other countries where our providers operate. If you access the Services from outside the United States, you understand that your information will be transferred to and processed in the United States, where data-protection laws may differ from those of your jurisdiction. Where required, we use appropriate transfer mechanisms such as the European Commission's Standard Contractual Clauses.

Our websites may link to sites we do not operate. We are not responsible for the privacy practices or content of those sites, and this Policy does not apply to them.