Who we are and what this policy covers
AskCogi ("AskCogi," "we," "us" or "our") runs Cogi, an AI business partner for restaurant and bar owners and their teams. Cogi reads your restaurant's systems, answers your questions in plain words, and sends daily briefings, alerts and weekly reports. AskCogi is a business service (B2B). It is not meant for consumers.
This Privacy Policy explains how we process personal information that we collect through the digital properties and activities that link to it (together, the "Service"), including:
- our website, askcogi.ai (askcogi.com and askcogi.net redirect to it), including the demo request form;
- the Cogi service and app, including the connections you make to your own systems;
- our emails, calls and messages with you; and
- the support and other services we provide to our customers.
In short: Cogi reads your business data so it can tell you where money is leaking. We do not sell your information, we do not show your data to other customers, and Cogi never pays, orders, disputes or changes anything without your approval.
When we act for a customer. For the business data that comes from the systems you connect (point of sale, accounting, inventory and the like), your business decides why and how it is processed. We process that data on your behalf, as your service provider (a "processor" under GDPR and LGPD), on your instructions and under our agreement with you. A data processing addendum is available on request. In that case your business is responsible for its own notices, including notices to your employees, and questions about that data should go to your business first.
Notices for specific regions. If you live in a US state with a privacy law, read the US state privacy rights notice below. If you are in the European Economic Area, the United Kingdom or Switzerland, read the Notice to European users. If you are in Brazil, read the Notice to users in Brazil (LGPD).
Personal information we collect
Information you give us. Depending on how you interact with us, this may include:
- Contact data, such as your name, email address, phone number, and restaurant or group name.
- Business and project data, such as the number of locations you run, the point of sale system you use, and anything you write in the free-text question on our demo form.
- Account data, such as the names, emails and roles of the people you invite to Cogi (for example owner, general manager or bookkeeper), and your settings.
- Communications data, such as what you send us by email, by phone or in the app, including the questions you ask Cogi.
- Billing records, such as the plan you choose, invoices and payment status. We do not collect payment card numbers.
Business data you connect. When you connect your systems, Cogi reads data from them with read-only access. Depending on what you connect, this can include:
- Point of sale (for example Toast): sales, checks, menu items, discounts, voids, cash and labor time entries.
- Accounting (for example QuickBooks): profit and loss, bills, payments, vendors and account balances.
- Inventory and purchasing (for example MarketMan): invoices, vendor prices, counts and waste.
- Bank, card and delivery app records, if you choose to connect them: transactions, deposits, payouts and refunds.
Labor data can include employee names, hours and pay rates. We limit who can see it by role, and Cogi does not show pay rates to people whose role does not allow it.
We do not collect payment card numbers. We do not request access to your guests' personal contact details.
Information collected automatically. Our website host and our website tools may automatically collect:
- Server logs: basic technical information when you visit, such as your IP address, browser type, the pages you request and the time of the request.
- Font requests: this website loads its fonts from Google Fonts, so your browser sends your IP address and browser details to Google when the page loads.
- Your cookie choice: the site stores your choice in a cookie called
ac_consent.
Analytics and advertising tools are not active on the website today. See our Cookie Notice.
Information about others. If you give us information about another person (for example, a team member you invite to Cogi), you confirm that you have the right to share it with us.
How we use personal information
We use personal information for these purposes, or as described when we collect it:
- Providing the Service: replying to your demo request, setting up your account and connections, and delivering daily briefings, answers to your questions, alerts and reports.
- Communicating with you: replying to you, sending service and billing messages, and sending security or policy updates.
- Support: helping you and fixing problems.
- Improving the Service: improving Cogi, for example by checking whether its answers were correct.
- Marketing: talking with you about AskCogi and sending marketing emails you have asked for. You can opt out at any time.
- Security and compliance: keeping accounts, connections and data secure, investigating misuse, keeping records the law requires, enforcing our terms, and responding to lawful requests.
- Aggregated and de-identified data: we may create aggregated or de-identified data that no longer identifies you or your business and use it for any lawful purpose. We will not try to re-identify it.
We do not use your business data to build products for other companies without your written permission. We never show one customer's data to another customer.
How Cogi uses AI. To answer a question or write a briefing, Cogi sends the question and the relevant parts of your business data to an AI model provider (currently Anthropic) through its commercial API. We use settings that keep this processing in the United States and that ask the provider not to keep the content after the answer is returned. Under these business terms, the provider does not use the content to train its models. Login credentials for your connected systems are encrypted and are never sent to an AI model.
Cogi's answers can be wrong. Each answer shows the numbers behind it and how sure Cogi is, so you can check before you act. We do not use AI to make decisions about you that have legal or similarly significant effects. Cogi does not pay, order, dispute or change anything without the approval of a person at your business.
How we share personal information
We do not sell personal information. We share it only with:
- Service providers that process it on our behalf, such as website hosting (Vercel), Google Fonts, an AI model provider (Anthropic), cloud database and hosting for the app, an email provider, and a CRM or form tool for demo requests. This list can change as our tools change. They may use the information only to provide their service to us. You can ask us for the current list at hello@askcogi.ai.
- The systems you connect, when you tell Cogi to read from them. Their own terms and privacy policies apply.
- Professional advisers, such as lawyers, accountants, auditors and insurers.
- Authorities and others, when we believe in good faith that the law requires it or that it is needed to protect the rights and safety of our customers, our team or the public.
- Business transfers, such as investors, buyers or successors in connection with a financing, merger, acquisition, reorganization or sale of assets, under the protections described in this policy.
- Other people, at your direction, for example the teammates you invite to your Cogi account.
Advertising and the sale or sharing of data
We do not sell personal information, and today we do not share it for targeted advertising. The analytics and advertising tools the site is set up to support are not active today. These are Google Analytics 4, the Meta Pixel and Google ads measurement.
If we turn them on, they will run only according to your choice, as described in our Cookie Notice. Some US state laws treat advertising tools like the Meta Pixel as "sharing" personal information for cross-context behavioral advertising, or as "selling" it for targeted advertising, even though no money changes hands.
If that ever applies, you can opt out at any time by choosing Reject or turning off advertising in Cookie settings or Your Privacy Choices (both linked at the bottom of every page of our site), by emailing us at hello@askcogi.ai, or by turning on the Global Privacy Control (GPC) signal in your browser. We treat a GPC signal as a valid request to opt out of advertising and of the sale or sharing of your personal information for that browser. Visitors from the European Economic Area, the United Kingdom, Switzerland and Brazil are asked for consent before these tools run.
Your choices
- Marketing emails. Use the unsubscribe link in any marketing email, or email us. You will still get service and billing messages.
- Cookies and advertising. Use Cookie settings or Your Privacy Choices on our site, your browser settings, or the opt-out tools listed in our Cookie Notice.
- Your account. You can review and update your account details in the app, or ask us to close your account.
- Do Not Track. Browsers' "Do Not Track" setting is not a standard, so we do not respond to it. We do honor GPC as described above.
- Not giving information. Some information is needed to provide the Service. If you do not provide it, we may not be able to answer your demo request or provide Cogi.
Retention
We keep personal information for as long as we need it for the purposes in this policy, then delete or anonymize it. As a guide:
- Demo requests: up to 24 months after our last contact, unless you ask us to delete them sooner.
- Customer data: for as long as your account is active. After your account ends, you can export your data, and we delete it within 30 days unless the law requires us to keep part of it.
- Server logs: for a short period, as set by our hosting provider.
Backups may keep copies for a limited time before they are overwritten.
Security
We use technical and organizational measures designed to protect personal information:
- Connections to your systems are read-only.
- Login credentials for your systems are encrypted and are never sent to an AI model.
- Each customer's data is kept separate from every other customer's data.
- Access inside your account follows the roles you set.
No system is completely secure, so we cannot guarantee absolute security. If we learn of a breach that affects you, we will notify you and the authorities as the law requires.
International transfers
AskCogi processes information in the United States. If you are in another country, your personal information will be transferred to, stored in and processed in the United States, where data protection laws may differ from yours. Where the law requires it, we protect these transfers with appropriate safeguards, such as adequacy decisions, the EU-US Data Privacy Framework for certified providers, standard contractual clauses approved by the European Commission, the UK International Data Transfer Addendum, or the standard contractual clauses approved by Brazil's data protection authority (ANPD).
Children
AskCogi is a business service for restaurant owners and their teams. It is not meant for anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.
Other sites and services
The Service links to and connects with sites and services we do not run, such as Toast, QuickBooks, MarketMan and the other systems you connect. Their own privacy policies apply, and we are not responsible for their practices.
Changes to this policy
We may update this policy from time to time. When we do, we change the date at the top of the page. If a change is significant, we will tell customers by email or in the app before it takes effect. Previous versions are available on request.
How to contact us
To ask a question or exercise a privacy right, contact us by email at hello@askcogi.ai, with "Privacy" in the subject line. This address also receives legal notices, appeals, and requests to our data protection contact under Brazil's LGPD. AskCogi has not formed its legal entity yet, so this policy names no company and gives no postal address.
US state privacy rights notice
This section applies to residents of US states with consumer privacy laws that apply to us, such as California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Iowa, Indiana, Tennessee, Delaware, New Hampshire, New Jersey, Nebraska, Minnesota, Maryland, Kentucky and Rhode Island (the "State Privacy Laws"). In this section, "personal information" and "sensitive personal information" have the meanings those laws give them. Not every right is available in every state, and rights have exceptions.
Your rights. Depending on your state, you may have the right to:
- Know and access: the categories of personal information we collected, the sources, our purposes, the categories of third parties we disclosed it to, and a copy of the personal information we hold about you;
- Correct inaccurate personal information;
- Delete personal information we collected from you;
- Portability: receive your personal information in a portable format;
- Opt out of the sale of personal information, the sharing of it for cross-context behavioral advertising, targeted advertising, and profiling that produces legal or similarly significant effects;
- Appeal our decision on your request, by replying to our decision email or writing to hello@askcogi.ai with "Appeal" in the subject line; and
- Non-discrimination: we will not treat you differently for exercising these rights.
What we do. In the past 12 months we have not sold personal information, and we have not shared it for cross-context behavioral advertising. As described in Advertising and the sale or sharing of data, the advertising tools the site supports are not active today. If we turn them on, that could count as "sharing," and the opt-out options above apply. We do not knowingly sell or share the personal information of consumers under 16. We do not use sensitive personal information to infer characteristics about you, and we do not engage in profiling that produces legal or similarly significant effects.
Customer data and employees. For business data from connected systems, including employee names, hours and pay rates, we act as your business's service provider. If you are an employee of one of our customers, your employer decides how that data is used. Please send your request to your employer. We will help the customer respond to it.
How to make a request. Email hello@askcogi.ai with "Privacy request" in the subject line, or, for opt-outs, use Cookie settings or Your Privacy Choices on our site or a GPC signal. To protect you, we verify requests by matching the email address and details you give us with our records, and may ask for more information. You may use an authorized agent. We may ask the agent for proof of authority and ask you to confirm your identity directly. We respond within the time the law requires (usually 45 days).
Categories of personal information. In the past 12 months we collected the following categories, for the purposes described in How we use personal information:
| Category (CCPA) | Examples | Disclosed for a business purpose to | Sold or shared with |
|---|---|---|---|
| Identifiers | Name, email, phone, IP address, online identifiers | Service providers (hosting, email, CRM or form tool), professional advisers, authorities | None |
| Customer records | Name, contact details, billing records | Service providers, professional advisers | None |
| Internet and network activity | Pages requested, browser type, time of request, cookie choice | Service providers (website hosting, Google Fonts) | None |
| Approximate geolocation | City or region from IP address | Service providers (website hosting) | None |
| Professional information | Restaurant or group name, role, number of locations, POS system | Service providers | None |
| Employee and labor data (customer data, processor role) | Employee names, hours, pay rates, time entries | Service providers (cloud database and hosting, AI model provider) | None |
| Commercial information (customer data, processor role) | Sales, checks, vendor invoices, bills and payments | Service providers (cloud database and hosting, AI model provider) | None |
| Sensitive personal information | Account login credentials | Service providers (hosting, authentication) | None |
California "Shine the Light". California residents may ask which third parties we disclosed personal information to for their own direct marketing in the prior year. We do not make such disclosures.
Notice to European users
This section applies if you are in the European Economic Area, the United Kingdom or Switzerland ("Europe"). AskCogi is a service for businesses in the United States and does not target people in Europe, but this notice applies to visitors from Europe.
Controller. AskCogi is the controller of the personal data described in this policy, except where we process it for a customer as described in Who we are and what this policy covers. Contact us at hello@askcogi.ai.
No representative appointed. We have not appointed a representative in the European Union or the United Kingdom. Write to hello@askcogi.ai for anything you would send to one.
Legal bases. We rely on:
| Purpose | Legal basis |
|---|---|
| Replying to demo requests and setting up Cogi | Performance of a contract, or steps you asked for before entering one |
| Providing Cogi from connected business data | On the customer's instructions, as a processor. For account data we hold ourselves: performance of a contract |
| Service and billing messages and support | Performance of a contract; legitimate interests in running the Service |
| Marketing emails | Consent; for existing customers, legitimate interests where the law allows, always with an easy opt-out |
| Analytics and advertising cookies (if turned on) | Consent |
| Security, fraud prevention and improving the Service | Legitimate interests in a secure, working and improving Service |
| Tax, accounting and legal obligations | Compliance with a legal obligation |
| Legal claims and corporate transactions | Legitimate interests in protecting our rights and running our business |
Your rights. You may ask us to give you access to your personal data, correct it, delete it, restrict its processing, give you a portable copy, or stop processing it based on legitimate interests. You can object to direct marketing at any time, and where we rely on consent you can withdraw it at any time without affecting earlier processing. Email hello@askcogi.ai. We reply within one month, which can be extended where the law allows.
Complaints. You can complain to the data protection authority where you live or work. In the UK this is the Information Commissioner's Office (ico.org.uk). EU authorities are listed at edpb.europa.eu. We would appreciate the chance to resolve your concern first.
Transfers. Your data is transferred outside Europe to the United States, protected as described in International transfers. You can ask us for a copy of the safeguards we use.
Automated decisions. We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.
Notice to users in Brazil (LGPD)
This section applies to the processing of personal data under Brazil's General Data Protection Law (Lei nº 13.709/2018, "LGPD").
Controller and contact. AskCogi is the controller of the personal data described in this policy, except where we process it for a customer as its operator. You can reach the person responsible for data protection (encarregado) at hello@askcogi.ai.
Legal bases. We process personal data on the bases in Article 7 of the LGPD, mainly: performance of a contract or preliminary steps at your request; compliance with legal or regulatory obligations; the regular exercise of rights; our legitimate interests, always respecting your fundamental rights; and your consent, for marketing and for analytics and advertising cookies.
Your rights. Under Article 18 of the LGPD you may request: confirmation that we process your data; access to it; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary or excessive data or data processed against the LGPD; portability; deletion of data processed with your consent; information about the public and private entities we share data with; information about the possibility of not giving consent and its consequences; and withdrawal of consent. You may also ask for a review of decisions made solely by automated processing. Send requests to hello@askcogi.ai.
International transfers. We transfer personal data to the United States, where AskCogi and its service providers process it, under Article 33 of the LGPD and the rules of the National Data Protection Authority (ANPD), including standard contractual clauses where required.
Complaints. You can file a complaint with the ANPD (www.gov.br/anpd).
Adapted from attorney-drafted templates by General Legal, PC, released under CC0 1.0. General Legal has not reviewed and takes no position on these adapted documents.