Privacy policy

Last updated: October 19, 2026

This policy explains what information TORVEXA AI LLC ("Torvexa", "we") collects when you use Torvexa POS, the cloud point of sale for restaurants available at pos.torvexaai.com, including the WhatsApp ordering add-on. It also explains how we use it, who we share it with and what rights you have.

In short: we use data only so the restaurant can operate and serve its guests. We do not sell personal data or use the system's data for advertising. Torvexa POS (the system) does not use analytics or advertising cookies; the sales page torvexaai.com does use the Meta Pixel (see section 5).

1. Who this applies to

Restaurants and their staff (owners, managers, cashiers, servers, kitchen) who use Torvexa POS.
Restaurant guests who order from the QR menu or message the WhatsApp number of a restaurant that uses Torvexa.

For the data of a restaurant's guests, the restaurant decides how it is used and Torvexa processes it on the restaurant's behalf, as its service provider.

2. Information we collect

Restaurant accounts

Name, email address, role, location and preferred language of each user. Passwords are stored hashed and never in readable form.
Business data: name, locations, products, prices, recipes, inventory, tables, reservations, orders, sales and register closings.

Restaurant guests

Name, phone number and, if provided, email and delivery address.
The orders they place and their notes (for example, "no onions").

WhatsApp messages

If the restaurant turned on the WhatsApp add-on, when a guest messages its number we receive, through Meta's WhatsApp Business Platform, the phone number, profile name and content of the messages. We use them so the artificial intelligence assistant can take the order, send it to the restaurant for confirmation and keep the guest updated, in the language of the conversation.

Subscription payments

Plan payments are processed by Stripe. Torvexa never receives or stores full card numbers.

Technical data

IP address, browser type and technical logs needed for the security and operation of the system.

3. How we use the information

To provide the service: record sales, orders, tables, kitchen, register, inventory and reports.
To receive orders from the QR menu and WhatsApp, and to let the guest know when the restaurant confirms, rejects or finishes their order.
To charge the subscription and contact you about your account.
To provide support, protect the system against abuse and improve the service.
To meet legal obligations.

4. Providers that process data

We use these providers to deliver the service. Each one receives only the data it needs for its job and handles it under its own contract and privacy policy. Some of them process data in the United States or other countries.

Meta Platforms (WhatsApp Business Platform)

Only if the restaurant turned on the WhatsApp add-on. Receives: the guest's phone number and profile name, the messages the guest sends, the assistant's replies and the order notices (confirmed, ready, rejected or cancelled), and the restaurant's WhatsApp number. Purpose: delivering messages between the guest and the restaurant.

Meta Platforms (Meta Pixel)

Only on the sales page torvexaai.com, not in the system. Receives: the page visited, your IP address, browser data and its own cookies (for example _fbp). Purpose: measuring visits to the sales page and showing Torvexa POS ads on Facebook and Instagram.

OpenAI

Only if the restaurant turned on the WhatsApp add-on. Receives: the text of the WhatsApp conversation, the guest's profile name and phone number, and the restaurant's menu (products, prices, name and address of the location). It does not receive payment data. Purpose: letting the artificial intelligence assistant understand the order and write the replies. Under its API terms, OpenAI does not use this data to train its models.

Stripe

Receives: the restaurant's name, the account owner's email and an internal restaurant ID. Card and billing details are entered directly on Stripe's payment page: Torvexa never sees or stores them. Purpose: charging the subscription, issuing invoices and handling plan changes and cancellations.

Google

Sign in with Google: the login screen and My profile load Google's button from accounts.google.com, so Google receives your IP address and browser information. If you choose "Continue with Google", Google confirms your identity and sends us your email and an identifier for your Google account.
Google Fonts: the app and these pages load their fonts from Google's servers, which receive your IP address and browser information to deliver them.

Hetzner

Receives: it hosts the servers that run Torvexa POS (the database, the app, the backups and the service that connects WhatsApp to the assistant), so it stores the information described in section 2. Purpose: hosting and running the service.

Cloudflare

Receives: all traffic to pos.torvexaai.com and torvexaai.com goes through Cloudflare, which sees the IP address, browser information, the pages visited and the content of requests while they travel to our servers. Purpose: delivering the site over an encrypted connection and protecting it against attacks and abuse.

We may also share information if the law requires it or to protect people's rights and safety. We do not sell or rent personal data.

5. Cookies and local storage

Torvexa POS (the system) only uses the cookies and browser data needed for it to work securely or to remember your preferences on that device. The system does not use analytics or advertising cookies, or any third-party tracking tools. The sales page torvexaai.com does use the Meta Pixel, as explained below.

Cookies

Name	Set by	Purpose	Duration
`torvexa_rt`	Torvexa	Keeps you securely signed in: it renews your access without asking for your password. It cannot be read by JavaScript and is only sent to our site.	12 hours from your last activity. Deleted when you log out.
`__cf_bm`	Cloudflare	Tells people apart from bots to protect the site. It only appears if Cloudflare's protection needs it.	30 minutes.
`cf_clearance`	Cloudflare	Remembers that you passed a security check, if you were shown one.	The time set by the check (usually 30 minutes).
Google cookies	Google, on its own domains	On the login screen and My profile, where the Google button appears, Google may use its cookies to recognize your Google account. Torvexa does not read or control them.	As set by Google in its policy.

Browser local storage (localStorage)

It stays on that device until you clear it from your browser:

torvexa-locale: the language you chose.
torvexa-print-settings: the printer paper width and whether kitchen tickets print automatically.
torvexa-kitchen-station: the kitchen station chosen on that screen.
torvexa-ready-sound: whether "order ready" alerts play a sound.

Session storage (sessionStorage)

It is cleared automatically when you close the tab or the browser:

torvexa-auth: the access token (valid for 15 minutes) and basic details of your user and restaurant to display the app.
torvexa-branch: the selected location.
torvexa-pos-cart: the items you are adding at the point of sale.
torvexa-qr-…: on the table QR menu, the guest's cart and the requests already sent, in case the page is reloaded.

The sales page torvexaai.com uses the Meta Pixel (Meta Platforms) to measure visits and show Torvexa POS ads on Facebook and Instagram. Meta may set its cookies (for example _fbp) and receives the page visited, your IP address and browser data. Learn more in Meta's privacy policy; you can choose which ads you see in Meta's ad preferences and block these cookies in your browser settings. Cloudflare's security cookies may also appear.

You can delete cookies and storage from your browser settings. If you do, you will need to sign in again and choose your preferences on that device again.

6. How long we keep it

Restaurant and guest data is kept while the restaurant's account is active, or until deletion is requested.
The WhatsApp conversation history used by the assistant is temporary, and technical logs of those messages are deleted within 30 days at most.
Backups are kept for 14 days and then deleted automatically.
We may keep billing records for as long as the law requires.

7. Security

We use encrypted connections (HTTPS), hashed passwords, permissions by role and location, optional two-step verification and daily backups. No system is 100% secure, but we work to protect the information.

8. Your rights

You can ask to access, correct, receive a copy of or delete your data. Email us at [email protected]. If you are a restaurant guest, you can also ask the restaurant directly. We reply within 30 days at most. To delete data, follow the data deletion instructions.

9. Children

Torvexa POS is a service for businesses and is not directed to children under 13.

10. Changes to this policy

If we make important changes, we will let you know in the app or by email and update the date above.

11. Contact

TORVEXA AI LLC · [email protected] · pos.torvexaai.com