// Privacy Policy

What we know and what we don't.

Last updated: 4 May 2026 · Effective: 4 May 2026

1. Who we are

[Fork Time Pty Ltd, ABN XXX XXX XXX] (Australia) and [Fork Time, Inc., a Delaware corporation] (United States) (together "Fork Time", "we", "us") are the controllers of personal data described in Sections 2–4 of this Policy.

For data we process on behalf of restaurants — primarily reservation guest data and call audio — restaurants are the data controllers and Fork Time is the data processor. The Data Processing Addendum (DPA) governs that relationship.

Contact us at privacy@forktime.ai. EU/UK customers may contact our representative at [representative address — TBD].

2. What data we collect

From restaurant operators (account data — Fork Time as controller)

From guests calling, chatting, or being booked (guest data — Fork Time as processor)

From the website itself (visitor data — Fork Time as controller)

3. How we use this data

Account data is used to provide the Service, bill you, support you, communicate product changes, and prevent fraud or abuse.

Guest data is used only to deliver the booking, confirm the reservation by SMS/email, hand off to your reservation system, and (in aggregated form) to improve voice quality and AI accuracy. We don't sell guest data, we don't use it for advertising, and we don't train third-party models on identifiable guest content.

Visitor data is used to understand which marketing pages convert and to improve the site. We don't run third-party advertising trackers.

4. Legal bases (GDPR / UK GDPR)

If you are in the EU or UK, our legal bases are:

For guest data we process on behalf of restaurants, the restaurant's lawful basis applies; ours is the processor relationship under the DPA.

5. Subprocessors & third parties

We use the following subprocessors to deliver the Service. The list is updated when material changes occur; we'll notify customers in advance of new categories of subprocessors.

We do not sell personal data and we don't share it with advertisers or data brokers.

6. International data transfers

Personal data may be transferred between Australia, the United States, and (depending on your hosting region) the EU. For EU/UK transfers we rely on the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, supplemented with our internal technical and organisational measures.

For Australian data, transfers comply with Australian Privacy Principle 8 (cross-border disclosure).

7. Retention

8. Security

We protect personal data with industry-standard measures: TLS 1.2+ in transit, AES-256 at rest, role-based access control, audit logging, MFA on all internal accounts, principle-of-least-privilege subprocessor access. We're working toward SOC 2 Type II and will publish the report when ready.

No system is perfectly secure. If we detect a breach affecting your personal data, we'll notify you without undue delay and (where required) within 72 hours per GDPR.

9. Your rights

Subject to your jurisdiction, you have the right to:

To exercise any right, email privacy@forktime.ai. We'll respond within 30 days. We may need to verify your identity.

If your data is held by Fork Time on behalf of a restaurant (e.g. you're a guest who made a booking), please contact the restaurant first; we'll cooperate with their response.

10. CCPA / CPRA notice (California residents)

In the past 12 months, Fork Time has collected the categories of personal information described in Section 2 from the sources described there, for the purposes described in Section 3. We do not sell or share personal information for cross-context behavioural advertising.

You have the right to know, delete, correct, and limit the use of sensitive personal information. We do not discriminate against you for exercising these rights. To submit a request, email privacy@forktime.ai or call [+1-XXX-XXX-XXXX].

11. Cookies & similar technologies

We use a small number of cookies:

You can clear cookies at any time via your browser settings. We don't currently set non-essential cookies that require explicit consent under the EU ePrivacy Directive — when we do, you'll see a banner.

12. Children's privacy

The Service is not intended for children under 16. We don't knowingly collect personal data from children. If a child's data has been collected (e.g. as a guest of a restaurant), parents/guardians may request deletion via privacy@forktime.ai.

13. AI & voice-specific notes

Calls answered by Fork Time are recorded and transcribed. Restaurants are responsible (under our Terms) for ensuring their call disclosures comply with local recording laws.

The synthetic voices used by the AI host are licensed from ElevenLabs and represent voice actors who consented to the cloning — they are not biometric data of your guests. Caller voice audio is processed for transcription and not used to identify or biometrically profile callers.

We don't share guest call recordings with the underlying LLM providers; we send only the transcript text needed to generate a response, via no-training enterprise endpoints.

14. Changes to this policy

We may update this Policy from time to time. Material changes will be announced by email and on the website at least 30 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.

15. Contact

Privacy questions: privacy@forktime.ai. General support: support@forktime.ai.

Postal:

— The Fork Time team · Brisbane & Seattle