DishPatch, Inc. ("DishPatch," "we," "our," or "us") respects the privacy of our restaurant partners, their customers, and website visitors. This Privacy Policy describes how we collect, use, disclose, and safeguard information when you use our AI phone ordering platform and related services.

1. Information We Collect

Restaurant Account Data: When you sign up, we collect business name, contact details, billing information, and menu data you provide to configure your AI host.

Call & Conversation Data: We record and transcribe phone calls handled by the DishPatch AI for the purpose of order processing, quality assurance, and service improvement. Call recordings are retained for 90 days unless you request earlier deletion.

Order Data: We process and store order details — items, modifiers, pricing, and allergy flags — to fulfill kitchen ticket delivery and provide you with order history.

Usage Data: We automatically collect information about how you interact with our dashboard, including IP address, browser type, pages visited, and timestamps.

2. How We Use Your Information

• To operate, maintain, and improve the DishPatch platform
• To process orders and deliver kitchen tickets to your system
• To send transactional communications (receipts, service alerts)
• To provide customer support
• To train and improve our AI models using anonymized, aggregated data
• To detect fraud and ensure platform security

3. Data Sharing

We do not sell your personal information or your customers' information. We share data only with: (a) service providers necessary to operate our platform bound by confidentiality agreements; (b) law enforcement when required by valid legal process; (c) successors in connection with a merger or acquisition, with advance notice to you.

4. Data Retention

We retain restaurant account data for the duration of your subscription plus 2 years. Call recordings are kept for 90 days. Order data is retained for 3 years. You may request deletion of your data at any time by contacting [email protected].

5. Security

We implement TLS 1.3 encryption in transit, AES-256 encryption at rest, SOC 2 Type II compliance, and regular third-party penetration testing. See our Security page for full details.

6. Your Rights

Depending on your jurisdiction, you may have rights to access, correct, delete, or export your data. To exercise these rights, contact [email protected]. We respond to all requests within 30 days.

7. Cookies

Our website uses strictly necessary cookies for authentication and session management, and optional analytics cookies. You may disable optional cookies in your browser settings without affecting core functionality.

8. Changes to This Policy

We will notify you of material changes via email or dashboard notice at least 14 days before the change takes effect.

9. Contact

Questions? Contact our Data Protection Officer at [email protected].

These Terms of Service ("Terms") govern your access to and use of DishPatch, Inc.'s AI phone ordering platform and related services. By subscribing to or using the Service, you agree to be bound by these Terms.

1. Eligibility & Account Registration

You must be a legal business entity or sole proprietor operating a food service establishment. You are responsible for maintaining the confidentiality of your account credentials and for all activity under your account.

2. Description of Service

DishPatch provides an AI-powered voice agent that answers inbound phone calls for your restaurant, takes customer orders, provides menu and allergen information, and transmits order data to your designated kitchen system. The Service is provided on a subscription basis.

3. Subscription & Payment

Subscriptions are billed monthly in advance. A valid credit card is required. All fees are non-refundable except as expressly provided herein. You authorize DishPatch to charge your payment method on file at each billing cycle. Either party may cancel with 30 days' written notice. Prices may be adjusted with 30 days' notice.

4. Order Payment through Stripe

DishPatch offers an optional feature called Order Payment through Stripe, which enables restaurants to collect payment from customers at the time an order is placed over the phone.

How it works: When a customer calls to place an order and the restaurant has this feature enabled, DishPatch's AI host will inform the customer that a payment link will be sent to their mobile phone via SMS. The customer will receive a Stripe-powered payment link by text message. The customer must complete payment through that link before their order is confirmed and dispatched to the kitchen. Orders for which payment is not completed within the designated time window may be automatically cancelled.

Message & Data Rates: Standard message and data rates may apply depending on your mobile carrier and plan. DishPatch is not responsible for any charges imposed by your carrier in connection with receiving SMS messages.

Message Frequency: When this feature is active, customers will receive one (1) SMS message per order containing a Stripe payment link. Customers may also receive a follow-up message if payment is not completed within the designated window.

Opt-Out Instructions: Customers who no longer wish to receive SMS payment links may opt out at any time by replying STOP to any message received from DishPatch. Upon receipt of a STOP message, no further SMS messages will be sent to that number in connection with this program. To re-enable SMS messages, customers may reply START.

Help & Support: Customers who need assistance with the SMS payment program may reply HELP to any message for instructions, or contact us directly at [email protected].

Restaurant Responsibility: Restaurants enabling this feature are responsible for ensuring their customers are informed that a payment SMS will be sent as part of the ordering process. Restaurants must ensure their use of this feature complies with all applicable laws, including the Telephone Consumer Protection Act (TCPA) and any state-level equivalents.

Payment Processing: All payments are processed by Stripe, Inc. DishPatch does not store cardholder data. By using this feature, customers and restaurants also agree to Stripe's Terms of Service and Privacy Policy, available at stripe.com.

5. Acceptable Use

You agree not to: (a) use the Service for any purpose other than legitimate restaurant order-taking; (b) attempt to reverse-engineer or extract our AI models; (c) record conversations without required consent disclosures in your jurisdiction; (d) resell or sublicense access without written permission.

6. Your Responsibilities

• Maintaining accurate and current menu information in your dashboard
• Ensuring allergen information is correct — DishPatch surfaces what you provide
• Complying with call recording disclosure laws in your jurisdiction
• Maintaining a compatible kitchen display or ticketing system

7. Accuracy Disclaimer

While DishPatch achieves industry-leading order accuracy, we do not guarantee every order will be captured without error. DishPatch is not liable for losses arising from order inaccuracies.

8. Uptime & Service Levels

DishPatch targets 99.9% monthly uptime. In the event of downtime exceeding this threshold, Pro subscribers receive service credits as their sole remedy. Enterprise customers receive terms per their separate SLA agreement.

9. Intellectual Property

DishPatch retains all rights to the platform, AI models, and underlying technology. You retain ownership of your menu data and business information. You grant DishPatch a limited license to use your data to provide and improve the Service.

10. Limitation of Liability

To the maximum extent permitted by law, DishPatch's total liability shall not exceed the fees paid by you in the three months preceding the claim. DishPatch shall not be liable for indirect, incidental, or consequential damages.

11. Termination

Either party may terminate the subscription with 30 days' written notice. Upon termination, your access ceases at the end of the current billing period. We will provide an export of your menu data upon request within 30 days.

12. Governing Law

These Terms are governed by the laws of the State of California. Disputes shall be resolved through binding arbitration in Los Angeles, CA.

13. Contact

[email protected]

At DishPatch, security is foundational — not an afterthought. We handle sensitive voice conversations and order data for thousands of restaurants daily, and we take that responsibility seriously.

Infrastructure Security

DishPatch runs on SOC 2 Type II-certified cloud infrastructure. All services are deployed in isolated virtual private clouds with strict network segmentation. We conduct quarterly infrastructure audits and annual third-party penetration tests.

• Encryption in transit: All data in transit is protected by TLS 1.3 or higher
• Encryption at rest: All stored data is encrypted using AES-256
• Key management: Encryption keys are managed using a dedicated HSM-backed key management service
• Database security: Production databases are not publicly accessible and require MFA for administrative access

Voice & Call Security

All phone calls handled by DishPatch are transmitted over encrypted SRTP channels. Call recordings are stored in isolated, encrypted object storage accessible only by authenticated services. Access logs are retained for 1 year.

Application Security

• All code changes undergo peer review and automated security scanning before deployment
• We follow OWASP Top 10 guidelines for web application security
• Dependency vulnerability scanning runs on every build
• Admin access to production systems requires hardware MFA (FIDO2)

Access Controls

We operate on a principle of least privilege. Employees only have access to systems necessary for their role. All access is reviewed quarterly. Departing employees are immediately offboarded from all systems.

Compliance

• SOC 2 Type II: Annual audit — report available to Enterprise customers under NDA
• PCI DSS: We do not store cardholder data. Payment processing is handled by a PCI-certified third party (Stripe)
• CCPA / GDPR: We support data subject rights requests and maintain a Data Processing Agreement for applicable customers

Incident Response

In the event of a confirmed breach affecting your data, we will notify you within 72 hours of discovery as required by applicable law.

Responsible Disclosure

Report security vulnerabilities to [email protected]. We acknowledge receipt within 24 hours and do not pursue legal action against good-faith researchers.