Privacy Policy

Who this policy covers

This policy covers (a) users of the Kutlerri platform, including restaurant operators and their authorized team members who connect third-party accounts (such as Google/Gmail) or use a Kutlerri-provisioned mailbox to enable specific agents, and (b) prospects and business contacts whose information we process in order to provide outreach services on behalf of our restaurant clients (see "Prospect and business contact data" below).

Where we process business data on behalf of a restaurant client, we generally act as a service provider or processor under the client's instructions, and our agreement with that client governs. For data about your own Kutlerri account and website use, we act as the controller.

Information we collect

Information you provide

• Account and profile information - name, business name, email address, phone number, and role, provided when you register or request a demo.
• Restaurant/business data - information you enter or upload to operate the agents, such as menus, locations, catering pricing, prospect lists, and similar operating data.
• Communications - messages you send to our support team.
• Billing information - billing is currently handled through direct invoicing. We do not store full payment card numbers. If we introduce self-serve card payments, we will update this policy to identify the payment processor.

Email data accessed by the Catering Agent

The Catering Agent finds catering leads, conducts email outreach, and manages replies on your behalf. It connects to email in one of two ways:

(a) Connected Google account. When you connect your Google account, you authorize Kutlerri to access Gmail data through Google APIs via the Google consent screen. The scope requested is gmail.send(https://www.googleapis.com/auth/gmail.send) and gmail.readonly(https://www.googleapis.com/auth/gmail.readonly) . We request this scope because the agent must send outreach, detect and read replies across threads, and manage campaign email in the connected mailbox.

• Gmail data we access and store: email message metadata (sender, recipient, subject, timestamps), the message content of outreach threads and their replies, and the email addresses of leads contacted.
• Why we access it: to send catering outreach emails, to detect and read replies so the agent can track responses and continue the conversation, and to surface results to you in the platform.

(b) Kutlerri-provisioned email address. We can set up and manage a dedicated outreach mailbox for your business. In this mode we do not access your Google account; the mailbox and its contents are hosted and processed by Kutlerri and used solely to operate the Catering Agent for you. The categories of data processed are the same as above.

SMS and call data processed by the Catering Agent

Where you enable SMS or calling, the Catering Agent sends and receives text messages on your behalf, and phone calls are placed and received by a person using the platform's calling feature.

• SMS data we process and store: the phone numbers involved, the content of outreach messages and replies, delivery status, and timestamps.
• Call data we process and store: the phone numbers involved, call time and duration, call status and outcome, and, where enabled and permitted by law, call recordings and transcripts.
• Why we process it: to send and receive outreach messages, to enable and record the calls placed through the platform, to track responses so the Catering Agent can continue the conversation, and to surface results to you in the platform.
• Consent and opt-out: recipients can opt out of further messages by replying STOP or any recognized opt-out keyword, and can ask to be removed during a call. Opt-outs are added to the same suppression list described in "Prospect and business contact data."

Where calls are recorded or transcribed, we announce at the beginning of the call that it is being recorded, before any recording begins. Continuing the call after that notice constitutes consent to the recording. If you do not consent, you may end the call, or ask that the recording be stopped or deleted by contacting support@kutlerri.ai.

Information collected automatically

• Usage data - pages viewed, features used, actions taken in the platform.
• Device and log data - IP address, browser type, operating system, and timestamps.
• Cookies and similar technologies - see "Cookies and tracking" below.

Prospect and business contact data

To operate outreach on behalf of our restaurant clients, we process limited business contact information about individuals at prospective catering customers ("prospects"), including people who have no direct relationship with Kutlerri. If you received an email sent through the Services, this section applies to you.

• What we collect: name, job title, business email address, business phone number, and company details such as name, size, industry, and location.
• Communications records: the content and metadata of outreach emails, text messages, and calls exchanged with you through the Services, including recordings or transcripts where call recording is enabled and lawful.
• Where it comes from: licensed third-party business contact databases, publicly available business information (for example, Google business listings), and lists provided by our restaurant clients.
• Why we process it: to identify businesses likely to have catering needs, to send and personalize business-to-business outreach on behalf of a restaurant client, and to track responses.
• Your choices as a prospect: you may opt out of further outreach at any time by replying to any message or contacting support@kutlerri.ai. Opt-outs are added to a suppression list so you are not contacted again through the Services. You may also exercise the rights described in "Your rights" below.

How we use information

We use the information we collect to:

• Provide, operate, and maintain the Services and the agents you enable;
• Execute the Catering Agent's functions (lead outreach across email and SMS; sending and reading replies) and support calls placed and received through the platform;
• Authenticate you and secure your account;
• Communicate with you about your account, support requests, and service updates;
• Process payments and manage subscriptions;
• Improve and develop our Services; and
• Comply with legal obligations.

We do not use Google user data to train generalized artificial intelligence or machine-learning models.

Google API Services - Limited Use disclosure

Kutlerri's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, regarding data obtained through Gmail/Google APIs, Kutlerri:

• Only uses the data to provide and improve the user-facing features (the Catering Agent) that are prominent in our application;
• Does not transfer or sell this data to third parties except as necessary to provide or improve the features, to comply with applicable law, or as part of a merger/acquisition with appropriate notice;
• Does not use this data for serving advertisements;
• Does not use this data to train generalized artificial intelligence or machine-learning models; and
• Does not allow humans to read this data unless: (a) we obtain your affirmative consent, including where you engage Kutlerri for a managed service under an agreement that expressly authorizes our team to read and manage messages on your behalf as part of that service; (b) it is necessary for security purposes (for example, investigating abuse); (c) it is necessary to comply with applicable law; or (d) the data is aggregated and anonymized and used for internal operations.

"Kutlerri's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements."

How we share information

We do not sell your personal information or Google user data. We may share information only with:

• Service providers / sub-processors who help us operate the Services, under contractual confidentiality and data-protection obligations. Current sub-processors: Neon (managed Postgres database; AWS us-east-1, United States), Google Cloud Platform / Cloud Run (application hosting, United States), and licensed business contact data providers. We will update this list if we add sub-processors, such as a payment processor.
• Legal and safety - when required by law, regulation, or legal process, or to protect the rights, safety, and property of Kutlerri, our users, or the public.
• Business transfers - in connection with a merger, acquisition, or asset sale, with notice consistent with this policy and Google's Limited Use requirements.

Data storage, security, and location

Your data, including email data processed by the Catering Agent, is stored in our primary database (Neon; AWS us-east-1, United States) and processed on our application infrastructure (Google Cloud Run, United States).

We protect data with: encryption in transit (TLS) and at rest; encryption of OAuth tokens; secrets stored in a managed secret store (not in code); least-privilege access controls; per-user data isolation; and security logging and monitoring.

No method of transmission or storage is 100% secure; we work to protect your data but cannot guarantee absolute security.

Data retention and deletion

• Retention: We retain personal data and communications data processed by the Catering Agent - email, SMS, and call records, including recordings and transcripts where applicable - while your account is active. Communications-derived data is deleted within 45 days after you disconnect the relevant account or phone number, or close your Kutlerri account, except where retention is legally required.
• Deletion requests: You can request deletion of your data using the in-app deletion control, which routes your request to our support team, or by emailing support@kutlerri.ai. Verified requests are completed within 45 days, except where retention is legally required.
• Disconnecting: You can disconnect your Google account at any time, which stops further Gmail access. You can also revoke Kutlerri's access directly from your Google Account at https://myaccount.google.com/permissions.

Cookies and tracking

We currently use only essential cookies needed to operate the site and remember your preferences. We do not use third-party analytics or advertising cookies. If that changes, we will update this policy and obtain any required consents. You can control cookies through your browser settings.

We do not sell or share personal information for cross-context behavioral advertising, so there is no such activity to opt out of via browser privacy signals such as the Global Privacy Control; where such signals apply to us, we honor them as required by law.

We do not currently respond to browser Do-Not-Track (DNT) signals.

Your rights

Depending on your location, you may have rights to access, correct, delete, or port your personal data, and to object to or restrict certain processing. These rights are available to platform users and to prospects (see "Prospect and business contact data").

• EEA/UK (GDPR): rights of access, rectification, erasure, restriction, portability, and objection; right to lodge a complaint with a supervisory authority.
• United States: under the California CCPA/CPRA, the Texas Data Privacy and Security Act, and similar state privacy laws, rights to know/access, delete, correct, and opt out of "sale"/"sharing" (we do not sell personal information).

To exercise any right, contact support@kutlerri.ai.

Children's privacy

The Services are not directed to individuals under 18, and we do not knowingly collect their personal information.

International data transfers

Our Services are hosted in the United States. If you access the Services from outside the United States, your information may be transferred to and processed in the United States.

Personnel of our subsidiary, Kutlerri Technologies Private Limited (India), may access client and user data to provide engineering, support, and analytics services, under intra-group agreements and the same confidentiality and access controls described in "Data storage, security, and location."

If we serve users in the EEA/UK, we will rely on appropriate safeguards, such as standard contractual clauses, for those transfers.

Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version with a new "Last updated" date and, where required, notify you.

Contact us

Questions about this policy or your data: