Français
Your data, in plain words

Privacy Policy

What we process when you order over WhatsApp, why, and with whom. If a piece of data is not listed here, we do not collect it.

LAST UPDATED: 18 OCTOBER 2026

Axyora operates a service that lets a restaurant take orders over WhatsApp. When you message the WhatsApp number of a restaurant using our service, your messages are processed by our system to record, amend and pass on your order.

This page describes exactly what we process, why, and with whom. It describes nothing else: if a piece of data is not listed here, we do not collect it.

Who we are

Axyora French société par actions simplifiée (SAS), variable capital
SIREN990 021 024
Registered office200 rue de la Croix Nivert, 75015 Paris, France
Contactcontact@axyora.ai

Who is responsible for what

THE RESTAURANT

Data controller. It takes your order and decides what to do with it.

AXYORA

Processor. We provide the tool and process the data on the restaurant's behalf, on its instructions.

The providers listed below are Axyora's sub-processors: they act only to keep the service running. For the e-mail addresses of restaurant staff who sign in to their workspace, Axyora is the data controller.

What we process

DATAWHY
The content of your messagesTo understand your order, answer your questions, and keep track of the conversation from one message to the next.
Your WhatsApp phone numberTo reply to you, find your open order, and, for delivery, let the courier reach you.
Your WhatsApp first nameTo address you by name, and to identify the order at the counter or at the door.
Your delivery addressTo check the restaurant delivers to you, work out the fee, and pass it to the courier.
Your location, if you share itOnly to convert it into a postal address. The coordinates are not kept: only the resulting address is.
Your ordersTo prepare the order, charge the right amount, and let you reorder the same thing.
Your device's IP addressOnly if you open one of our links (a QR code, the page shown after payment): our server notes it in its technical connection log, for security and troubleshooting. This log is shortened every night, and its encrypted backups are kept for one week.

Our legal basis

Performance of the contract The contract between you and the restaurant, for everything needed to take, prepare, charge for and deliver your order.
Legitimate interest The restaurant's interest in keeping a record of an exchange, so it can handle a complaint and understand what happened.
Legal obligation For the data the restaurant's accounting requires it to keep.

Automated processing

Your messages are interpreted by an automated system, which composes the replies and records your order. It makes no decision producing legal effects concerning you: it grants nothing and refuses nothing.

No order is placed without you explicitly confirming a summary showing the items, the service type, the address and the total. You can ask to speak to the restaurant at any point.

Voice messages

If you send a voice note, it is transcribed into text so it can be understood. Only the resulting text is kept, exactly like a written message.

The audio file is never stored. It is passed to the transcription service and then leaves our memory.

Payment

Payments are handled by Stripe, on a page hosted by Stripe.

We never see, receive or store any card details. We only know that an order was paid, and for how much.

Who we share with

Only what is necessary for your order to happen. No data is sold, and none is used for advertising.

The restaurant Your order, your first name and phone number, and your address for a delivery.
Meta (WhatsApp) The messages and voice notes exchanged, and the ordering screens shown inside WhatsApp: it is the channel itself.
AI provider · OpenAI, United States The conversation text (with your first name, past orders and the address given), to understand it and compose replies. Voice notes, for transcription.
Langfuse · European Union Technical monitoring of the calls to the AI provider: the model used, duration, cost, and an internal identifier that does not name you. Never the text of your exchanges.
Sentry · European Union Reporting of the service's technical errors, so we can fix them. It is designed to contain no data about you: phone numbers and e-mail addresses that might slip in are masked before sending, and your IP address is not kept.
Stripe The amount and order details, for payment. You enter your card details with Stripe directly.
Uber Direct For deliveries only: your address, first name and phone number, so the courier can find you.
Base Adresse Nationale · French national address database The address you give, or the location you share, to verify it and convert it into a postal address.
Supabase Database hosting, within the European Union.
Hetzner Hosting for the server that processes the conversations, in Finland, within the European Union.
Cloudflare R2 · European Union The backup of our server's configuration, with its connection log. It is encrypted with a key only we hold.
Resend Sending the sign-in and invitation e-mails to restaurant staff, and our team's alerts. It does not receive the data of customers who order.
Vercel Hosting for the pages of this site. No order data passes through it.

What the AI provider does with your messages

Your messages are not used to train its models. OpenAI does not train on data sent through its programming interface, and we have enabled no option that would allow it.

OpenAI keeps the exchanges with its interface for up to 30 days, to detect abuse, then deletes them. We ask it to store nothing beyond that: our calls use neither its conversation memory nor its files.

Transfers outside the European Union

The database and the server are hosted within the European Union. However, processing messages with artificial intelligence and transcribing voice notes involve a provider established in the United States, which constitutes a transfer outside the Union. The same goes for other providers in the list above (Meta, Stripe, Uber, Resend, Langfuse, Sentry, Cloudflare), which may process data outside the Union. These transfers are governed by the European Commission's standard contractual clauses or by an adequacy decision.

How long

Open basketIs closed after a short period of inactivity.
ConversationsKept so the thread makes sense and so the restaurant can find an exchange if you raise a complaint.
OrdersKept for the restaurant's accounting obligations.

The exact retention periods, and the automatic deletion of data once they have passed, are being defined. This page will be updated when they are set. In the meantime, you can ask for your data to be deleted at any time.

Cookies

This site uses no cookies, no trackers and no analytics. The fonts and the single script on these pages are served from this domain: no request goes to a third party.

Security

Traffic to our servers is encrypted (HTTPS). Each restaurant's credentials and keys are encrypted at rest. Access to the data is limited to the people who need it to run the service.

Your rights

You have the right of access, rectification, erasure, restriction of processing, portability of your data, and objection to its processing.

Because the restaurant is the controller, we may pass your request on to the one you contacted.

A question about your data? Write to us: we reply within 30 days.
contact@axyora.ai Data deletion

If our answer does not satisfy you, you may lodge a complaint with the CNIL, the French supervisory authority: cnil.fr/en/plaintes.

Minors

The service is not intended for people under 15, and we do not knowingly collect their data.

Changes

This page changes as the service does. The date above is the last update; any new recipient appears here before it is used.