Privacy Policy

Notanai ("we") provides an AI phone assistant, and optional online ordering, to Canadian businesses: restaurants, trades (plumbing, heating, electrical and similar) and clinics. This policy explains what personal information we handle when you call, order from or book with a business that uses Notanai, and your choices. We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial law.

Who is responsible

The business you call decides why your information is used (to prepare your order, send a technician, or book your visit). Notanai processes it on that business's behalf, as its service provider. For clinics, the clinic remains responsible for your health information (for example under Ontario's PHIPA) and we act as its agent. Notanai's Privacy Officer is accountable for how we handle personal information. Questions or requests: Privacy Officer, Notanai.ca Inc., 4 Keyworth Crescent, Brampton, Ontario L6R 4G3, privacy@notanai.ca.

What we collect and why

• Your request: for restaurants, the items, choices, notes, pickup time and total; for trades, the service address, the problem you describe, how urgent it is and the time booked; for clinics, the visit type, the time booked and a short reason for the visit if you give one. Used to pass your request to the business and to show you its status.
• Name and phone number: so the business can identify you and reach you, and so we can safely find your request if a call drops. If you call again from the same number, the assistant may recognise you and your recent requests to help faster.
• Allergy or dietary notes you choose to share (restaurants): passed to the restaurant so staff can check them.
• Call information: the number you called from (caller ID), call time and length, and a written transcript of the conversation, for accuracy, correct billing of the business, quality and abuse prevention.
• Feedback: star ratings and comments you choose to leave from your status link, shared with the business.
• Website use: basic technical logs (IP address, time) for security and rate limiting. We use a few first-party cookies and browser storage items, listed under "Cookies and storage" below. On our public website pages only (never the business dashboards, kitchen screens, ordering or order-status pages) we also use Google Analytics, which sets its own cookies. We count visits to our own website without cookies: your IP address and browser are mixed with a key that changes every day, so we can count visitors but can't recognise you on another day, and the IP address isn't stored for this. We also see which website sent you (its name only), any ad tags in the link, and whether you're on a phone or a computer.

We do not take payment card details on calls or from callers. You pay the business directly. The assistant never gives medical advice; in an emergency it tells you to call 911.

AI and call transcripts

Calls are answered by an AI assistant. For trades and clinics it says so at the start of every call; restaurants may choose to say it at the start or when asked. Whenever you ask whether you're speaking with a person, it tells you the truth, and you can ask for a person at any time. Calls are carried by Twilio. While a call is live, your voice is streamed to Google Cloud (Gemini on Vertex AI, in Iowa, United States), which converts it to text and produces the assistant's replies, so that your request can be taken and passed to the business. We do not keep audio recordings of calls: the conversation is converted to text as it happens, and the written transcript is stored in Toronto with your request and kept as described below. It is used to fulfil your request, check accuracy and quality, prevent fraud and abuse, and bill the business correctly. Our Terms of Use explain how orders, allergies, payments and calls work.

Text messages

When you place an order or book a visit, we text you about that request on the business's behalf: that it was received, confirmed or declined, that your order is ready, and (for bookings) a reminder the day before. These messages identify the business, relate only to your request, and aren't marketing. Reply STOP to any of them to stop texts from that number. Staff and owners of the business also receive text alerts about new requests.

The Notanai app

Business owners and their staff can use the Notanai app on iPhone and Android. When you use it, we handle:

• Your mobile number and one-time sign-in codes. You sign in with a code we text (or read out in a phone call) to your mobile. We keep the number with your login; a code works once, for a few minutes, and we store it only in scrambled form.
• Your device. The app's own random id for your phone, its name, whether it's iPhone or Android, the app version and its language, and a push token (the address Apple or Google gives us to send alerts to your phone). We use them to keep you signed in, to let you see and sign out your phones, and to alert you about new orders, bookings and callers who are waiting. Push alerts pass through Expo, Apple and Google to reach your phone.
• Menu photos and the description of your business you type. To set up Mira, the app sends them to Google's Gemini on Google Cloud, which reads them and suggests your menu and settings. You see and confirm every suggestion. We erase the description you typed within 30 days.
• Test calls. When you ask Mira to call your own phone to try her out, that call is transcribed like any other call, and the transcript is kept as described below.

Deleting your account. In the app, go to More > Account > Delete my account (or ask us at notanai.ca/delete-account). Mira stops answering your calls right away, and your account is deleted 14 days later unless you cancel in the app before then. We then delete your logins, your devices and push tokens, your contact details and your customers' details. We keep invoices, the signed agreement, the billing ledger and our security log, with contact details masked, for tax and legal records.

Business owners and people who contact us

If you ask us to call you back, request a demo or sign up on notanai.ca, we keep your name, business, phone, email and message to follow up with you, and, for businesses that sign up, the record of the signed Service Agreement (name, title, time, IP address and version). We only send marketing messages if you tick the consent box, and every message lets you unsubscribe.

Service providers

Our servers and database are in Toronto, Canada (hosted by Fly.io), and that's where call records, transcripts, orders and bookings are stored. To run the service we also use: Google (Gemini on Google Cloud: the AI that hears and speaks on calls as they happen, which runs in Google's data centre in Iowa, United States, and the AI that reads menus), OpenAI (the AI in some demo calls on our website, internal summaries for our team of sales leads, customer feedback and support issues, and a fallback for reading menus), xAI (the AI in some demo calls on our website only, never on calls to a business), Twilio (phone calls and text messages), Microsoft (email), Google Analytics (how visitors use our public website pages) and Stripe (payments by the businesses we serve, and, where a business turns it on, customers paying for their orders online: card details go only to Stripe, never to us or the business). These providers may process data outside Canada, including in the United States, where it may be accessible to authorities under local law. They may use it only to provide their service to us.

How long we keep it

• Orders and bookings: up to 2 years, for the business's records and billing disputes; after that your name, number, address, notes and allergy or visit details are removed. The amounts stay in the business's and our billing records.
• Call transcripts and call details, including the number you called from: up to 90 days, then deleted. Clinics keep them for less (30 days unless the clinic sets another period).
• Text messages we send: up to 90 days, then deleted.
• Unfinished requests from dropped calls: deleted after 24 hours.
• Feedback comments: removed after up to 2 years; star ratings stay, without your name or number.
• Demo and call-back requests: kept up to 2 years, then deleted. The IP address sent with a request is deleted after 30 days.
• Businesses that sign up: kept while we review the sign-up and while the account is open. 90 days after an account closes, or after we turn down a sign-up, we delete its logins, contact numbers and its customers' details, except what tax, billing and contract law make us keep (invoices, payments, prepaid credit and the signed agreement) and our security log of who changed what, in which email addresses and phone numbers are masked. We keep those at least as long as Canadian tax law requires, generally 6 years after the end of the tax year they relate to. To keep the free trial to one per business, we keep Stripe's fingerprint of the card you add (a code Stripe makes from the card number; it is not the number and can't be turned back into it) and your business phone number, and, after an account's data is deleted, only scrambled copies of them that can't be read back.
• Emails we send to businesses: 90 days after they're sent, then deleted.
• Website visit counts: 400 days.
• Backup copies of our database are kept in Canada (Google Cloud, Montreal) for up to 40 days and then deleted.

Cookies and storage

Except for Google Analytics (the last item), everything here is set by notanai.ca itself (first-party), and none of it is used for advertising or to follow you on other websites.

• nsess (cookie): keeps a business's owner or staff logged in. It ends after 12 hours or when they log out. On a kitchen screen signed in with the business code and kitchen PIN, it stays on while the screen is used and ends after 30 days unused, when it logs out, or when the owner changes the kitchen PIN.
• ndemo (cookie): opens our demo pages for 48 hours after you book a demo.
• nsdev (cookie): set only on a Notanai team member's own browser when they tick "Remember this device" at the admin login, so the admin's second step is skipped there; up to 30 days.
• ntn_preview (cookie): lets Notanai's team preview the site while it's behind the "launching soon" page; up to 90 days.
• ntn_src (stored in your browser): which ad or link first brought you to our website. It is sent with a demo request, call-back request or sign-up so we know which ads work, and stays on your device until you clear this site's data.
• Sign-up draft (stored in your browser): your unfinished sign-up form, never your password or PIN, so a refresh doesn't lose it. It is removed when you finish signing up.
• Kitchen business code (stored in your browser): the business code on a kitchen tablet, so staff don't have to type it again.
• Kitchen printer settings (stored in your browser): the paper width, when tickets print and whether the printer tip was shown, on that kitchen screen only.
• Counter kiosk pairing (stored in that tablet's browser): the key that lets a restaurant's own counter tablet or "Now serving" screen show its menu and send orders. It belongs to the restaurant, not to a guest; the owner can remove the tablet at any time, and the key is then useless. The kiosk asks a guest for a first name only, and nothing a guest types stays on the tablet.
• _ga and _ga_LQWJFPXG4R (cookies, Google Analytics): set on our public website pages only, to count visits and see how visitors use the site (pages viewed, how they arrived, device and rough location). Google processes this data, including in the United States. They last up to 2 years. You can block them in your browser's settings or with Google's opt-out add-on (tools.google.com/dlpage/gaoptout).

Your choices and rights

You can ask for a person instead of the AI, decline to share allergy or visit details (then tell the business directly), stop texts by replying STOP, and ask to see, correct or delete your information by emailing privacy@notanai.ca. We may need to pass the request to the business you contacted. You can also complain to the Office of the Privacy Commissioner of Canada.

Children

Notanai is not aimed at children. If a child calls a business that uses Notanai, the call is handled like any other call, and a parent or guardian can ask us to delete it at privacy@notanai.ca.

Security

Data is encrypted in transit (HTTPS) and at rest. Access is limited by role, password and PIN, each business sees only its own data, and changes are logged. If a breach creates a real risk of significant harm, we notify the people affected and the Privacy Commissioner as the law requires.