Legal
Privacy Policy
Version 1.0 · Last updated: 6 November 2026
1. Introduction
SRV is an app by Brainsai. It answers a restaurant’s customers on WhatsApp, Instagram and Facebook, takes their orders, and sends those orders to the restaurant’s staff. This policy explains how personal data is handled in the SRV app.
Who this policy applies to
- Restaurants and their staff who use the SRV app.
- Customers who message a restaurant that uses SRV.
Key terms
| Personal data | Any information that identifies a person or can be linked to them. |
|---|---|
| Controller | The party that decides why and how personal data is used. |
| Processor | A party that handles personal data on a controller’s behalf. |
| Restaurant | A business that uses SRV. |
| Staff | People with an SRV account at a restaurant, such as owners, managers and agents. |
| Customer | A person who messages a restaurant through a channel. |
| Channel | WhatsApp, Instagram or Facebook. |
| AI assistant | The automated part of SRV that reads customers’ messages, replies, and prepares orders. |
2. Data controller
| Legal name | Brainsai |
|---|---|
| Registered address | Fayoum, Egypt |
| Contact email | support@brainsai.net |
Brainsai is the controller of restaurant account and staff data. For customers’ data, each restaurant is the controller and Brainsai is its processor: we handle that data for the restaurant, to provide the service.
3. Personal data we collect
| Category | What it includes |
|---|---|
| Identity data | Staff: name, role and assigned branches. Staff sign in with their email address and have no separate username. Customers: the name they give in chat or that their channel shares with us. |
| Contact data | Staff: work email address. Customers: phone number, delivery address, and WhatsApp number or Instagram or Facebook account identifier. |
| Account security data | Staff passwords, stored only as a secure hash, and sign-in tokens. |
| Message data | The text of conversations between customers, the AI assistant and staff. SRV reads text only. It doesn’t read voice notes, photos or other media sent in a chat. |
| Order data | Items ordered, order notes, amounts, delivery details and order status. |
4. How we collect data
- Chat conversations: customers give their details by messaging a restaurant. There’s no separate checkout form.
- Forms in the app: the sign-in form, and the forms staff use to manage accounts, orders, customers and complaints.
- Server logs: our servers record technical events, including IP addresses, to keep the app running and secure.
- Third-party integrations: Meta delivers messages from WhatsApp, Instagram and Facebook once a restaurant connects those channels. SRV has no social login and no payment processor.
5. Why we use data
| Purpose | What we do | Data used |
|---|---|---|
| Account creation | Create staff accounts, sign staff in, and control what each role can see. | Identity, contact, account security |
| Order processing | Answer customers, take their orders, send them to the restaurant, and send order updates. | Identity, contact, message, order |
| Customer support | Let staff take over conversations and resolve complaints, and answer requests sent to us. | Identity, contact, message, order |
| Analytics and performance | Show restaurants reports on their orders and conversations, and keep the app reliable. | Order, message |
| Billing | Work out and record what each restaurant owes. | Order |
| Security and fraud prevention | Protect accounts, limit abuse, and investigate problems. | Account security |
6. Legal basis for processing
Under the GDPR, where it applies, we rely on the following lawful bases. Where we act for a restaurant, the restaurant is responsible for the lawful basis of its customers’ data.
| Purpose | Lawful basis |
|---|---|
| Account creation | Contract: we need this data to provide the service a restaurant signed up for. |
| Order processing | Contract: the data is needed to take and deliver the order a customer asks for. |
| Customer support | Contract, and legitimate interests in resolving problems. |
| Analytics and performance | Legitimate interests in helping restaurants understand their business and keeping the app reliable. |
| Security and fraud prevention | Legitimate interests in protecting users and the service. |
| Marketing, if ever offered | Consent. |
7. Third-party sharing
To run the app, we share personal data with these companies:
| Third party | Why we share data |
|---|---|
| Meta (WhatsApp, Instagram, Facebook) | Carries messages between customers and the restaurant. Meta’s own privacy policies apply to those apps. |
| Google (Gemini) | The AI model that reads customers’ messages and writes replies. |
AI models receive message text and the conversation context needed to reply.
8. Data retention
We keep personal data only for as long as it’s needed to run the business and to work for you. When it’s no longer needed, we delete or anonymise it.
| Data | Why we keep it |
|---|---|
| Staff account data | While the person needs access to SRV, so they can sign in and work. |
| Customer details and messages | While the restaurant uses SRV, so it can serve returning customers and handle complaints, unless deletion is requested. |
| Order and financial data | For as long as the restaurant needs them for its records, and for billing and accounting duties. |
| Technical and usage data | For as long as it’s useful to keep the app secure and investigate problems. |
| Backups | For a limited time, to recover from faults. Deleted data can remain in a backup until that backup is replaced. |
9. Your rights
Depending on the laws that apply to you, you have the right to:
- Access: find out what data we hold about you and get a copy.
- Correction: have inaccurate data corrected.
- Deletion: have your data deleted.
- Portability: receive your data in a commonly used format.
- Opt out of sale or sharing (CCPA/CPRA): we don’t sell personal data or share it for targeted advertising.
- Withdraw consent: where we rely on consent, withdraw it at any time.
- Object to processing: object to, or ask us to limit, how we use your data, including where we rely on legitimate interests.
To use any of these rights, email support@brainsai.net. We may need to confirm who you are first. If your request concerns a restaurant’s customer records, we may work with that restaurant to answer it. You can also complain to your data protection authority.
How to delete your data
- Email support@brainsai.net with the subject “Delete my data”.
- Tell us the restaurant’s name, the channel you used, and your phone number or account name, so we can find your data.
- We may ask you to confirm that the data is yours.
- We’ll email you when the deletion is complete.
Deletion removes your customer profile and channel identifiers, and anonymises your messages. Your orders stay in the restaurant’s records with their amounts, but your name, phone number and address are removed from them.
10. Security measures
- Encryption: connections to the app are encrypted. Passwords are stored only as secure hashes, and the keys that connect a restaurant’s channels are encrypted.
- Access controls: each restaurant’s data is kept separate from every other restaurant’s. Staff see only what their role allows, and sensitive actions are recorded.
11. Contact us
| Company | Brainsai |
|---|---|
| support@brainsai.net | |
| Address | Fayoum, Egypt |