JhaCommerce Privacy Policy

1. Who we are and what this policy covers

JhaCommerce is the food-ordering service operated by JhaX.AI ("we", "us"). It lets you find restaurants and order food from them by chatting with an AI assistant such as ChatGPT. The restaurants run their business on JhaOps, our restaurant management platform.

This policy explains what we collect when you order through JhaCommerce, why, and who we share it with. It applies to people ordering food. Restaurants and their staff using JhaOps are covered by the JhaOps Privacy Policy.

You do not need an account to order. We do not create a login or profile for you.

2. What we collect

We collect only what is needed to place, pay for and fulfil your order. The AI assistant asks you for these details in the conversation and passes them to us when you confirm the order.

3. How your information is shared with the restaurant

The restaurant sees your order in its point-of-sale system and kitchen display, and can see it later in its order history and reports. Your details are shared only with the restaurant you ordered from — never with other restaurants on the platform.

The restaurant is the seller of your food and is responsible for how it uses your details for its own purposes, such as contacting you about your order or keeping its business records. Contact the restaurant directly about anything it holds.

4. Payments

Orders are paid by credit or debit card on a secure JhaCommerce payment page. The link to this page is sent to you in the conversation and expires after 30 minutes.

• Your card number, expiry date, security code and ZIP code are sent over an encrypted connection to the restaurant's card processor, Netevia, to authorise the payment.
• We do not store your full card number or security code. We keep the card brand, the last four digits, the amount and the processor's transaction reference, so the payment can be refunded or looked into later.
• The payment goes to the restaurant's own merchant account, not to us.
• You never type card details into the chat, and the AI assistant never sees them.

5. Who else we share information with

We do not sell your personal information. We share it only as follows:

• The restaurant you order from, as described in section 3.
• Netevia, the card processor, to process your payment.
• Resend, our email provider, to send your receipt.
• Google Maps, only when you search by a place name: the place you typed is sent to Google to turn it into map coordinates. Your name and contact details are not sent.
• Hosting and database providers (Vercel and Supabase) that store and run our service.
• Authorities, when the law requires it, or to protect against fraud or harm.

6. ChatGPT and OpenAI

Your conversation with ChatGPT takes place on OpenAI's service and is governed by OpenAI's Privacy Policy. We receive only what the assistant sends us to search menus and place your order — not your wider chat history.

When the assistant checks on an order, we return your phone number masked (for example •••• 4567), not in full.

7. How long we keep it

• Completed orders are kept as part of the restaurant's sales and tax records, for as long as the restaurant uses JhaOps or the law requires.
• Unpaid orders: if you do not pay, no order is created and nothing is sent to the restaurant's kitchen. The unpaid checkout and the details you gave are kept as a record of the attempt.
• Place names you search with are remembered for about 30 days so repeat searches are faster. They are not linked to you.

8. Security

Data is encrypted in transit. Payment links use long random tokens that we store only in hashed form, expire after 30 minutes, and stop working after repeated declined cards. Access to order data inside the restaurant is limited to its own staff accounts. No system is completely secure, but we work to protect your information.

9. Your choices and rights

You can ask us for a copy of the information we hold about you, ask us to correct it, or ask us to delete it. Depending on where you live (for example California), you may have further rights under local law, and we will not treat you differently for using them.

Some information we must keep — for example, a paid order the restaurant needs for its tax records, or a payment record needed to handle a refund or dispute. We will tell you if that applies.

To make a request, email support@jhapay.com with the email address or phone number you used and, if you have it, your order number.

10. Children

JhaCommerce is for people aged 18 and over. We do not knowingly collect information from children.

11. Changes to this policy

We may update this policy. When we do, we will change the "Last Updated" date above. Using JhaCommerce after a change means the updated policy applies to your next order.

12. Contact us

See also the JhaCommerce Terms of Service.