Servestack Inc. (“Servestack”, “we”) operates the restaurant commerce platform at servestack.ai. This Privacy Policy explains what data we collect and how we use it.
What we collect
We collect data restaurants and their guests provide when ordering: name, email, phone, delivery address, order history, and payment metadata. Payment card numbers are tokenized by our payment processors and never stored on our servers.
How we use it
- To process and deliver orders.
- To power loyalty, marketing automation, and analytics for the restaurants we serve.
- To improve and secure the platform.
SMS & text messaging
If you provide your mobile number — by texting one of our restaurant ordering keywords, opting in on a restaurant’s ordering page, or placing an order — we use it to send order confirmations, preparation and pickup/delivery updates, and to power a conversational ordering assistant. Message frequency varies based on your activity.
We do not sell, rent, or share your mobile phone number or SMS opt-in data with third parties or affiliates for their own marketing purposes. Phone numbers are used only to deliver the messaging described above, and are shared only with the messaging service providers (such as our telecommunications carrier) strictly to transmit those messages on our behalf.
You can opt out at any time by replying STOP to any message, or reply HELP for assistance. Standard message and data rates may apply.
ServeStack in ChatGPT and other AI assistants
Restaurant owners can use ServeStack from AI assistants such as ChatGPT. What we receive and keep depends on what you use:
- Website check (no account): the web address you ask us to review. We load that one public page to check it and send the findings back to the assistant. We don’t keep the page.
- Studio dish photo (no account): the dish photo you share, the dish name and the style you pick, used to make one finished photo for you. We keep your photo and the result, and a one-way hashed form of the assistant’s anonymous user identifier so each person can make one photo. The link to your photo works for 30 days. Ask us to delete them at any time.
- Connecting your ServeStack account: you sign in on servestack.ai — the assistant never sees your password — and choose which restaurants and which permissions to share. The assistant then receives a token it can use only for those, until you disconnect.
- What a connected assistant can see: depending on the permissions you chose, your restaurants’ details and menus, sales totals and trends for online orders through ServeStack, and whether your connected services are working. Sales reports never include customers’ contact details.
- What it can do, only after you approve in the chat: change menu prices, descriptions and sold-out items, create Studio designs using your Studio credits, and draft, publish or schedule posts on your connected social accounts. We keep a record of each action — who approved it, from which connection, what changed and when.
The results of the tools you use are shared with the assistant you’re using so it can answer you; that provider handles them under its own privacy policy (for ChatGPT, OpenAI’s). You can disconnect an assistant at any time in ServeStack under Settings → Connected AI assistants, which ends its access immediately.
Who we share data with
We don’t sell personal data. We share it only with the service providers that run Servestack for us, and only what each needs to do its job:
- Payments (Stripe) to take card payments for orders and subscriptions.
- Kitchen and order systems (such as KitchenHub) to send an order to the restaurant.
- Email and text-message delivery to send receipts, order updates and sign-in codes.
- Hosting and databases that store and serve the platform.
- AI and image-generation providers that power Servestack Studio and our assistants, for the photos, menu details and requests you give them.
- Services you connect yourself — Google Business Profile, your social media accounts, or an AI assistant such as ChatGPT — receive what you choose to send them, under their own policies.
We may also disclose data when the law requires it.
How long we keep it
- Restaurant accounts and their data (menus, orders, guests) are kept while the account is active, and deleted when you ask us to — except records we must keep by law, such as payment and tax records.
- Website checks from an AI assistant are not stored.
- Studio dish photos made without an account (and the photos they were made from) are kept until you ask us to delete them; on servestack.ai they can also be claimed when you create an account.
- Connected AI assistants: access tokens expire after one hour and renewal tokens after 30 days unless used; disconnecting ends access immediately. We keep the record of actions an assistant took for as long as the restaurant’s account exists.
Data ownership
Guest data is owned by the restaurant. Servestack acts as a data processor. We don't resell or share data across restaurants.
Cookies & analytics
This website uses Google Analytics to understand aggregate traffic — pages visited, referral sources, and general geography. We don't use analytics data to identify individuals, and we don't run third-party advertising trackers on this site.
Your rights
You may request access, correction, or deletion of your data at any time by emailing privacy@servestack.ai. Restaurant owners can also disconnect AI assistants themselves in Settings → Connected AI assistants.