Privacy Policy

Effective date: August 30, 2026
Last updated: August 30, 2026

This Privacy Policy describes how Start At 0, LLC (“Start At 0,” “we,” “us,” or “our”) collects, uses, and shares information when you:

• visit startat0.com and related pages we operate;
• use our restaurant phone-ordering agent (the “Agent”), including related text messages, payment links, and feedback forms; or
• use our operator tools as a restaurant customer of Start At 0.

If you called or texted a restaurant, that restaurant is typically the business responsible for your order. We provide the Agent as a service to that restaurant.

1. Who this policy covers

This policy applies to:

• Diners who call, text, or otherwise place an order through a restaurant using the Agent
• Restaurant operators who use our admin console or APIs
• Visitors to startat0.com

It does not replace a restaurant’s own privacy policy, menu, or in-store practices.

2. Who is responsible for your information

To correct an order, change a delivery address, or ask a restaurant to stop using your number, start with that restaurant. You can also email privacy@startat0.com and we will help route the request.

3. Information we collect

3.1 When you call or message a restaurant

Depending on the conversation, we may collect:

• Contact details: phone number; name if you give it
• Call content: live audio of the conversation; a written transcript of what was said
• Order details: items, quantities, modifiers, special instructions, pickup vs delivery, requested time
• Delivery details: street address, city, state, ZIP, and a formatted address (when you ask for delivery)
• Dietary and allergen information you volunteer (for example “no peanuts,” “gluten-free”). This is used to warn you and the kitchen. Do not rely on the Agent as medical advice.
• Preferences: spice level, call preferences you ask us to remember, favorite items from past orders at that restaurant
• Call metadata: time, duration, which restaurant number you reached, whether the call completed, transferred, or dropped

Phone numbers. We store the number on the call and text-message record so we can text a confirmation, payment link, or survey. For returning-customer profiles, SMS opt-outs, and one-time discount tracking we store a one-way hash of the number, not the raw number, on those records.

3.2 Recordings

A restaurant can turn call recording on or off. When it is on, we store caller and agent audio so the restaurant and our team can review order quality and fix problems.

Default recording retention is 30 days, then the files are deleted. Transcripts and other call records follow the longer schedule in Section 8.

3.3 Texts (SMS)

We may send and receive texts about:

• Order confirmation
• A payment link
• “Reply CONFIRM” to place a hang-up order
• A short satisfaction survey (typically a 1–5 rating)
• Opt-out and opt-in confirmations

We store the numbers, message body, and delivery status so we can show the restaurant what was sent and honor STOP.

Text STOP to a restaurant’s number to opt out of that restaurant’s Agent texts. Text START to opt back in. Opt-out is per restaurant. Transactional messages you already requested (for example a confirmation) may still be sent where permitted.

3.4 Payments

If you pay online, we send you to Stripe Checkout. We do not collect or store full card numbers, CVVs, or bank account numbers.

We do store: order totals, deposit amounts, payment-link status, Stripe identifiers, and (until they age out) the Checkout URL so we can text it to you.

Card data is handled by Stripe under Stripe’s privacy policy.

3.5 Feedback

• After some orders we may text a 1–5 rating. You can add a short comment.
• A restaurant may email a one-time feedback link. That page does not use cookies. You pick a category and may add a note.
• During a call you can volunteer a suggestion; we store that text for the restaurant.

3.6 Restaurant operators

If you run a restaurant on our platform we collect account details (name, email, login), restaurant settings, menu and hours, API credentials you issue, and usage of the admin console.

3.7 Website visitors (startat0.com)

When you visit startat0.com we may collect:

• Technical data such as IP address, browser type, device, referring URL, and pages viewed — the ordinary server and hosting logs needed to run the site
• Information you choose to send us (for example a contact form or email)

Cookies

• Public diner feedback form on the Agent: no cookies, no account, no tracking pixels.
• Operator admin console: one essential cookie, _ra_operator_session. It is HttpOnly, SameSite=Strict, scoped to /admin, and used only to keep you signed in (about 8 hours idle / 24 hours absolute). It is not an advertising cookie.
• startat0.com: this site is hosted on Squarespace. Squarespace may set cookies needed to run the site (including security and, if you are logged into Squarespace, editing cookies). We do not use advertising cookies or sell site-visit data. If we add audience measurement (for example Squarespace Analytics or Google Analytics), we will name it in this section before or when it goes live.

We do not use diner-facing advertising pixels, session replay, or cross-site trackers on Agent surfaces. There is no diner login and no diner account.

4. How we use information

We use the information above to:

• Operate startat0.com and respond to inquiries
• Answer the phone and take the order you asked for
• Read the order back, apply modifiers, and send it to the kitchen
• Check hours, delivery availability, and (when you ask) a pickup time
• Warn about allergens you mentioned and record that you acknowledged a warning
• Text confirmations, payment links, and surveys the restaurant has enabled
• Create or update a per-restaurant customer profile so a returning caller can reorder favorites (we do not build an advertising profile of you across unrelated restaurants)
• Process payments via Stripe and keep an honest record of what was charged
• Measure whether the Agent took the order correctly (quality review, transcripts, optional recordings)
• Secure the service, prevent abuse, debug failures, and comply with law
• Improve the product using aggregated statistics (for example, how often orders complete)

We do not use your calls or texts to train our own AI models. Live audio and relevant text are sent to the speech/language provider the restaurant has configured so the Agent can understand you and reply during that call. Those providers process the conversation to run their APIs. We choose providers that, under their API terms, restrict use of API content for their own model training where that option exists. The restaurant’s chosen provider’s terms also apply.

5. Who we share information with

We share diner information with:

The restaurant you contacted — the kitchen ticket, order, name, phone, address, allergen notes, and feedback. That is the point of the Agent.

Service providers who process data on our instructions:

• Telnyx — phone calls, SIP, and SMS delivery
• Google (Gemini), xAI (Grok), and/or OpenAI — real-time speech understanding and the Agent’s spoken replies (the restaurant’s configured provider)
• Stripe — payment links and card processing
• Resend — email to the restaurant (and, where used, customer email)
• Squarespace — hosting this website
• Infrastructure hosts — servers, database, and backups that run the Agent

Optional restaurant integrations. If the restaurant connects a POS such as Toast, order-related events may be exchanged with that POS.

We do not sell personal information and we do not share it for cross-context behavioral advertising.

We may disclose information if required by law, to protect rights and safety, or in a merger or sale of the business (the new owner must honor this policy or notify you of changes).

Address checks. Delivery addresses are stored on the order. We do not currently send addresses to a third-party address-validation vendor. If that changes, we will update this policy.

6. Sensitive information

Allergen and dietary notes can be health-related. We collect them only if you (or someone ordering for you) provide them, and only to fulfill the order and warn the kitchen. They are stored on the order and, if you have a profile at that restaurant, as dietary preferences you asked us to remember.

After the retention period in Section 8, allergen notes are removed from the stored order even if the order row itself is kept for accounting.

7. Payments and money records

• Card entry happens on Stripe’s pages, not ours.
• We keep order totals, what was paid online vs due onsite, and payment-link status so the restaurant can fulfill the order.
• After the retention period we remove the payable Checkout URL from our database. Stripe may still retain payment records under its own policy; we cannot delete Stripe’s copy from here.
• We do not issue automatic refunds from the Agent. Refunds and disputes are handled through the restaurant and Stripe.

8. How long we keep information

These are the product defaults. A restaurant or our operations team may use a shorter window; they should not use a longer one without updating this policy.

• Call audio recordings (if enabled): 30 days, then deleted
• Call transcripts, call journals, call event logs: 90 days, then deleted
• Webhook logs (payment and carrier events, stored with customer details stripped on write): 90 days, then deleted
• SMS bodies and phone numbers on message records: 90 days, then numbers and body are cleared
• Phone numbers on call records: 90 days, then cleared
• Delivery address and allergen notes on an order: 90 days, then cleared from the order
• Suggestion and feedback free text: 30 days (text removed); the remaining feedback row is deleted at 90 days
• Payment-link Checkout URLs (completed, expired, or cancelled links): 90 days, then the URL is removed; the money record stays
• Customer profile (hashed phone, name, favorites, dietary preferences at that restaurant): until you or the restaurant ask us to delete it
• SMS STOP / opt-out list: until you text START or request deletion (deleting an opt-out would cause us to text you again, so we keep it until you ask otherwise)
• Order row (items, totals, status — without address, allergens, or phone after scrub): kept for restaurant accounting and kitchen history
• Website server logs: as long as needed for security and operations, then deleted or aggregated

When you request erasure (Section 10) we delete or irreversibly clear personal fields sooner, including recordings, transcripts, profile, texts, feedback, and payment URLs tied to you. We keep the order as a business record with name, phone, address, and allergens removed.

9. How we protect information

• Phone-linked profiles, opt-outs, and discount-use records are keyed by a cryptographic hash, not the raw number
• Logs and internal traces are run through PII redaction (phones, cards, emails, addresses, free-text notes)
• Operator access is authenticated; restaurant credentials only see that restaurant’s data
• Payment card data is never stored on our servers
• Call recordings are deleted on a schedule and on erasure requests

No method of transmission or storage is 100% secure.

10. Your choices and rights

You can:

• Ask the restaurant to correct an order or delete your profile
• Text STOP to opt out of that restaurant’s non-essential texts from the Agent
• Decline to give a name, address, or dietary information (some orders cannot be completed without an address or a confirmation)
• Skip a survey by not replying
• Request access, correction, deletion, or a copy of personal information we hold

To request deletion or a copy, email privacy@startat0.com with the phone number you used and, if you know it, the restaurant name. We identify records by that number (and its hash). We may need to verify you control the number.

If you are in the EEA/UK you may also have rights to restrict or object to certain processing, and to lodge a complaint with your data protection authority. If you are a California resident you have rights to know, delete, correct, and to not be discriminated against for exercising those rights. We do not sell or share personal information as those terms are used in the CCPA.

We do not offer a diner account, so there is no in-app privacy dashboard. Erasure is handled by our operations team with the restaurant.

11. Children

The Agent is for placing restaurant orders. startat0.com is not directed at children under 13, and we do not knowingly build profiles for children. If you believe a child has provided information, contact privacy@startat0.com and we will delete it.

12. International processing

Start At 0, LLC is a United States company. We and several providers (including AI and payment companies) process data in the United States. If you call from another country, your audio and order details are transferred to the U.S. to operate the Agent. Where required, we use appropriate transfer mechanisms in our vendor contracts.

13. Do we use your voice to train AI?

• Start At 0: no. We do not train our own models on your calls.
• During the call: audio is streamed to the configured AI provider so the Agent can listen and speak.
• After the call: if recording is on, we may transcribe locally for quality review; those files follow Section 8.
• We do not sell recordings or transcripts.

14. Changes

We will post updates at https://www.startat0.com/privacy and change the “Last updated” date. If we expand collection in a material way (for example a third-party address validator, new analytics cookies, or a new AI provider category), we will update this policy before or when that change goes live.

15. Contact

Start At 0, LLC
Website: https://startat0.com
Privacy requests: privacy@startat0.com

If we cannot resolve a complaint, you may contact your state attorney general or, where applicable, your data protection authority.

For restaurants linking this from your site

Phone orders at [Restaurant] may be answered by an AI ordering assistant operated with Start At 0, LLC. The assistant may collect your name, number, order, delivery address, and any allergen notes you provide, and may text you a confirmation or payment link. Calls may be recorded if we have recording enabled. See https://www.startat0.com/privacy. Text STOP to opt out of non-essential texts. For privacy requests, email us or privacy@startat0.com.