Privacy Policy

Our commitment to your privacy

Cavnar AI LLC ("Cavnar AI", "we", "us", or "our") operates an AI-powered restaurant intelligence platform accessible at dashboard.cavnar.ai and through our services at cavnar.ai. This Privacy Policy describes how we collect, use, store, and protect information when you use our services.

We provide AI-powered tools to independent restaurant operators, including review response drafting, labor cost optimization, inventory analysis, and marketing content generation. In providing these services, we access certain data about your restaurant and its operations on your behalf.

By using Cavnar AI services, you agree to the collection and use of information as described in this policy. If you do not agree, please discontinue use of our services.

What information we collect

We collect information in three ways: information you provide directly, information collected automatically through your use of the service, and information obtained from third-party platforms you connect to our service.

Information you provide directly

• Restaurant name, address, and contact information
• Owner and GM name, email address, and phone number
• Mobile phone numbers given to us for text messages (account alerts, staff verification codes, schedule texts, inquiry replies), with a record of the consent given for each
• Dashboard login credentials (username and password — passwords are stored hashed and never readable)
• Restaurant profile information: neighborhood, vibe, brand voice notes, menu highlights
• Labor data: shift records, employee hours, sales figures uploaded by you or your operator
• Inventory data: item names, quantities, unit costs, par levels, and waste records uploaded by you or your operator
• Payment information: processed through Stripe — we do not store credit card numbers or financial account details

Information collected automatically

• Dashboard activity logs: which tabs you visit, when you last logged in, feature usage patterns
• System information: IP address, browser type, operating system (used for security and troubleshooting only)
• AI interaction logs: content generation requests and outputs (used to improve service quality)

Information from third-party platforms

When you connect third-party accounts to Cavnar AI — including Google Business Profile, Yelp, Instagram, or Facebook — we collect:

• Business profile information (name, address, category, hours)
• Review content: text, ratings, dates, and reviewer display names from Google and Yelp
• Social media content: posts, captions, and engagement metrics from connected Instagram and Facebook Business accounts
• OAuth access tokens required to retrieve and publish data on your behalf — stored encrypted

How we use your information

We use the information we collect exclusively to provide, maintain, and improve your Cavnar AI service. Specifically:

Service delivery

• Generating AI-drafted responses to your Google and Yelp reviews
• Analyzing your labor data to identify cost-saving opportunities and generate optimized schedules
• Analyzing your inventory data to identify waste, overstock, and ordering recommendations
• Generating marketing content — social media posts, emails, and promotional copy — in your restaurant's voice
• Publishing approved content to your connected Instagram and Facebook Business accounts
• Sending you weekly digest emails and urgent alert notifications

Service operations

• Processing payments through Stripe
• Sending transactional emails (welcome, payment confirmation, contract)
• Authenticating your account and maintaining security
• Troubleshooting technical issues

What we never do with your data

• Sell, rent, or trade your information to any third party
• Share your restaurant's identifiable data with other customers. Cavnar AI's benchmarks and recommendations use only de-identified ratios pooled across at least five restaurants, never figures that identify yours
• Use your information for advertising purposes
• Share your data with marketing companies or data brokers
• Share mobile phone numbers or text-message opt-in consent with third parties or affiliates for marketing or promotional purposes
• Aggregate your data into industry reports without explicit written consent

Third parties we work with

We share your data with a limited number of service providers strictly for the purpose of operating Cavnar AI. These providers are contractually prohibited from using your data for any other purpose.

We do not share your information with any other third parties except as required by law, to protect our rights, or in connection with a merger or acquisition (in which case you will be notified in advance).

Mobile information. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing to subcontractors in support services, such as customer service or text message delivery, is permitted. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

How we handle Meta and Instagram data

This section applies specifically to users who connect their Instagram Business or Creator accounts and Facebook Business Pages to Cavnar AI for the Marketing Autopilot module.

What Meta data we access

• Basic business profile information (name, about, category)
• Your published posts and their performance metrics (likes, comments, reach) — used only to inform content recommendations
• The ability to publish new posts to your Instagram Business account and Facebook Page on your behalf, only when you explicitly initiate a post from your Cavnar AI dashboard

What Meta permissions we request

• instagram_basic — Read basic profile information
• instagram_content_publish — Publish media to your Instagram Business account
• pages_manage_posts — Publish and manage posts on your connected Facebook Page
• pages_read_engagement — Read engagement metrics on your Page posts

How we store Meta credentials

• OAuth access tokens are stored encrypted in our database
• Tokens are never logged or transmitted to any third party except Meta's servers during API calls
• Long-lived tokens are refreshed automatically and securely
• We do not store your Facebook or Instagram password at any point

How to revoke Meta access

You can revoke Cavnar AI's access to your Instagram and Facebook accounts at any time by:

• Going to your Facebook Settings → Security and Login → Apps and Websites → removing Cavnar AI
• Contacting us at will@cavnar.ai and requesting disconnection

Revoking access will immediately disable the Marketing Autopilot module's ability to post to your accounts. Previously published content will not be affected.

Meta data use limitations

We strictly comply with Meta's Platform Terms and Developer Policies. Specifically:

• We do not use Meta data to build audience profiles or targeting data
• We do not share Meta data with advertisers or data brokers
• We do not use Meta data for any purpose other than operating your Cavnar AI marketing features
• We do not transfer Meta data to any third-party analytics platform
• We retain Meta-sourced data only as long as your account is active (see Data Retention section)

How we handle Google Business Profile data

This section applies specifically to users who connect their Google Business Profile to Cavnar AI for the Reviews and Intel modules.

What Google data we access

• Basic business profile information (name, address, category, hours)
• Review content: text, star ratings, dates, and reviewer display names left on your Google Business Profile
• The ability to publish review replies to your Google Business Profile on your behalf, only when you approve an AI-drafted response from your Cavnar AI dashboard

What Google permission we request

• https://www.googleapis.com/auth/business.manage — read your Business Profile's reviews and publish replies to them on your behalf

How we store Google credentials

• OAuth access and refresh tokens are stored encrypted in our database
• Tokens are never logged or transmitted to any third party except Google's servers during API calls
• Tokens are refreshed automatically and securely
• We do not store your Google account password at any point

How to revoke Google access

You can revoke Cavnar AI's access to your Google Business Profile at any time by:

• Going to your Google Account permissions and removing Cavnar AI
• Contacting us at will@cavnar.ai and requesting disconnection

Revoking access will immediately disable the ability to fetch new reviews or publish replies to your Google Business Profile. Previously published replies will not be affected.

Google API Services User Data Policy

Cavnar AI's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We do not use Google user data to build audience profiles or targeting data
• We do not sell Google user data or share it with advertisers or data brokers
• We do not use Google user data to train generalized AI/ML models — it is used only to draft and publish responses for the specific restaurant that authorized the connection
• We do not transfer Google user data to any third party except Anthropic, solely as needed to generate an AI-drafted reply on your behalf (see Third-Party Sharing above)
• Any human access to Google user data is limited to what is necessary for security, legal compliance, or with your consent to resolve a support request
• We retain Google-sourced data only as long as your account is active (see Data Retention below)

How long we keep your data

We retain your data for as long as your Cavnar AI account is active or as needed to provide services. Specifically:

Upon account cancellation, we will delete your operational data within 30 days, unless retention is required by law. Payment records and executed contracts are retained for 7 years as required by applicable law.

How we protect your data

We implement industry-standard security measures to protect your information against unauthorized access, alteration, disclosure, or destruction:

• All data is transmitted over HTTPS with TLS encryption
• Passwords are hashed using bcrypt — we cannot retrieve your plain-text password
• OAuth tokens and API keys are stored encrypted at rest
• Our application infrastructure is hosted on Railway, which provides enterprise-grade security and SOC 2 compliance
• Database access is restricted to application-level credentials with principle of least privilege
• We conduct regular reviews of access controls and security practices

While we take significant steps to protect your data, no method of internet transmission or electronic storage is 100% secure. If you believe your account security has been compromised, contact us immediately at will@cavnar.ai.

In the event of a data breach that affects your personal information, we will notify you within 72 hours of becoming aware of the breach, in accordance with applicable law.

Your rights and choices

You have the following rights with respect to your personal information:

Access and portability

You may request a copy of all personal data we hold about you and your restaurant. We will provide this in a machine-readable format within 30 days of your request.

Correction

You may update or correct your account information at any time through your dashboard settings, or by contacting us at will@cavnar.ai.

Deletion

You may request deletion of your personal data. See the Data Deletion section below for full instructions.

Restriction and objection

You may object to or request restriction of certain processing activities. We will honor these requests where technically feasible and not prohibited by law.

Withdraw consent

Where processing is based on consent (such as connecting Instagram), you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at will@cavnar.ai with the subject line "Privacy Request." We will respond within 30 days.

How to delete your data

You can request deletion of your Cavnar AI account and associated data at any time using any of the following methods:

Upon receiving a verified deletion request, we will:

1. Delete your dashboard account and login credentials
2. Delete all restaurant operational data (labor, inventory, reviews)
3. Delete all AI-generated content associated with your account
4. Revoke and delete all stored OAuth tokens for connected platforms
5. Remove your information from all active systems within 30 days
6. Confirm deletion by email once complete

Note: Payment records and executed service agreements are retained for 7 years as required by applicable tax and contract law, even after account deletion. These records do not contain sensitive operational data about your restaurant.

De-identified, pooled statistics that cannot identify your restaurant (no name, contact details or raw operational records) may remain in Cavnar AI's benchmarks after your account is deleted.

Instagram and Facebook data deletion

If you connect your Instagram or Facebook account to Cavnar AI and later request deletion, we will:

• Immediately revoke our access to your Instagram and Facebook accounts
• Delete all stored OAuth tokens associated with your Meta accounts
• Delete any cached social media data retrieved during your service period

You can also independently remove Cavnar AI's access at any time via Facebook Settings → Security and Login → Apps and Websites.

Cookies and tracking

Cavnar AI uses a minimal number of cookies necessary for the service to function. We do not use advertising cookies, tracking pixels, or third-party analytics services.

We do not use Google Analytics, Facebook Pixel, or any third-party tracking tools on dashboard.cavnar.ai. Our main website (cavnar.ai) may use basic analytics to understand visitor traffic — this data is never linked to your dashboard account.

Children's privacy

Cavnar AI is a business-to-business service intended solely for restaurant owners, operators, and their designated staff. Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If we become aware that we have inadvertently collected information from a minor, we will delete it promptly. Contact us at will@cavnar.ai if you believe this has occurred.

California residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know: You may request information about the personal data we collect, use, disclose, and sell (we do not sell personal data)
• Right to delete: You may request deletion of your personal data as described in the Data Deletion section above
• Right to opt-out of sale: We do not sell personal data. No opt-out is necessary.
• Right to non-discrimination: We will not discriminate against you for exercising your CCPA rights

To exercise your California privacy rights, email will@cavnar.ai with subject line "California Privacy Request."

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Send an email notification to all active account holders
• Post a notice in your dashboard for 30 days after the change takes effect

Your continued use of Cavnar AI services after a policy update constitutes acceptance of the updated policy. If you do not agree to the updated policy, you may cancel your account at any time.

SMS communications

You give consent to receive text messages directly to Cavnar AI (Cavnar AI LLC), separately for each program, by checking an unchecked box that names the program. We use a number only for the program it was given for. The programs are:

• Cavnar AI Staff Verification. A restaurant employee who enters their mobile number on the staff sign-up screen and checks the consent box gets a one-time verification code each time they ask for one, confirming the number belongs to them. The number is not added to any alert or marketing list.
• Cavnar AI Account Alerts. A restaurant owner or manager who opts in to text alerts with their own number in their account settings gets operational notifications about their restaurant (new and urgent reviews, issues assigned to them, staffing and labor alerts), and their two-step sign-in codes if they choose text delivery for those. Optional: every alert also arrives by email and in the app.
• Cavnar AI Schedule Texts. An employee who turns on the optional “Schedule texts” switch in the staff app gets texts about their own schedule and requests: their week posted or changed, and updates on swaps, open shifts and time off. Optional: everything also arrives in the app and by email.
• Inquiry replies. Someone who checks the SMS box on the cavnar.ai contact form gets texts about their inquiry and free audit.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing to subcontractors in support services, such as customer service or text message delivery, is permitted. All other categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes.

Guests of a restaurant. A restaurant that uses Cavnar AI can text guests who agreed to receive that restaurant’s texts. Those texts are the restaurant’s, sent in its name. A guest’s number and consent are held for that restaurant alone: never shared with another restaurant, never used for Cavnar AI’s own marketing, and never sold.

• Consent to receive texts is separate from, and not required for, use of the Cavnar AI platform or any purchase.
• To opt out at any time, reply STOP to any message. You will receive one confirmation and no further messages from that number.
• For help, reply HELP or contact will@cavnar.ai.
• Message & data rates may apply. Verification codes are sent only when requested (one per request); alert and schedule texts vary with activity.
• Full program terms: SMS terms.

Contact us

If you have questions, concerns, or requests related to this Privacy Policy or your personal data, please contact us:

We take privacy requests seriously and will respond within 30 days. For urgent security concerns, include "URGENT" in your subject line.

This Privacy Policy was written by Will Cavnar for Cavnar AI LLC. It is governed by the laws of the State of Illinois, United States.