What Zogu tells callers, and what it keeps from a call

01Every call starts by saying it's automated

The greeting is the first thing a caller hears, and it says what they're talking to. The standard one is:

"Thanks for calling (restaurant name), this is the automated ordering assistant. Is this for pickup or delivery?"

If Zogu recognises your number from an earlier phone order at that restaurant, you hear:

"Hi Sam, welcome back to (restaurant name), you're through to the automated ordering assistant. What can I get for you today?"

Restaurants can write their own greeting, but they can't take the disclosure out of it. That's done in code, not left to the restaurant or the AI. Before a greeting is used, Zogu checks it for the word "automated" or "AI". If neither is there, it adds a sentence. A greeting typed in as "Hiya, thanks for calling!" is spoken as:

"Hiya, thanks for calling! You're through to the automated ordering assistant."

The check looks for the word, not the meaning. A greeting that keeps the word but tells callers they're speaking to a member of staff, or hides what the assistant is in some other way, breaks our Acceptable Use Policy.

Ask for a person and the assistant tells you again: "I'm the automated ordering assistant, so I can't connect you to a person, but I can take your order." It does not transfer calls. There's no staff number behind it, and it never promises that someone will ring you back. On one test call the AI did offer to put the caller through to a member of staff, so Zogu now replaces any sentence like that before it's spoken. If you have a complaint, the assistant asks you to contact the restaurant directly.

02What Zogu keeps from a call, and why

No audio is recorded. Zogu has no code that records or saves the sound of a call. While you talk, your voice passes live through Twilio (the phone company we use) to a speech recogniser running on Cloudflare, which turns it into text as you speak. The only audio Zogu saves is the assistant's own voice. Its greeting and other set lines are made once and saved, so the next caller isn't left in silence while they're made again.

This is what Zogu writes down:

Hang up before ordering and nothing is sent to the restaurant. The transcript up to that point is still kept, with how far the call got.

The assistant never asks for card details on the call.

Who can read it

Today only Zogu's own team can read call records, through an internal console behind a team Google sign-in. Restaurants don't have their own login yet.

How long it's kept

Transcripts and call records are kept for [retention period] and then deleted. The order also becomes part of the restaurant's records in its own system, and the restaurant decides how long to keep that.

Training

We don't use your calls to train AI models. The review list only changes how Zogu matches words to one restaurant's menu. If staff link "cheeseburger" to their Mega Burger, the next caller who asks for a cheeseburger is offered the Mega Burger. The AI model itself doesn't change.

03The AI models and companies that handle a call

A call goes through three separate steps: hearing, deciding and speaking. Each one is a separate model. Because the AI's reply comes back as text before anything is spoken, Zogu can check it and change it first.

We chose GLM-4.7-Flash from the Workers AI models that Cloudflare lists as zero data retention. [Confirm against Cloudflare's current Workers AI terms before publishing.]

The language model doesn't set prices or build the order. Zogu's own code adds the items, works out prices and totals from the restaurant's POS menu, and reads the order back. Nothing is placed until you give a clear yes to that read-back. Before any reply is spoken, Zogu strips out the model's working notes and replaces any offer to transfer you or ring you back.

Zogu does not use Anthropic, OpenAI, Google Gemini, ElevenLabs or Cartesia to handle calls.

04Who is responsible for your data

The restaurant you ring decides why your details are collected: to take your order. Under UK data protection law it is the controller of your call data. Under US state privacy laws it is the business.

[Company name] ("Zogu", "we") runs the assistant on the restaurant's behalf, as its processor (in the US, its service provider). We use call data only to take and send the order, keep the call record and fix problems with the service, under a data processing agreement with the restaurant. [Decide with the solicitor whether reusing de-identified transcripts as test cases makes us a controller for that use, and say the same here, in the privacy policy and in terms 4.14.] Twilio and Cloudflare are our sub-processors. The restaurant's POS receives the order, through our POS integration platform, as the restaurant's own ordering system.

We don't sell call data, and we don't use it for advertising.

Company details: [Company name], [Registered address], company number [Company number] (UK); incorporated in [State of incorporation] (US). Contact: [Contact email].

The web demo on this website is different: there's no restaurant behind it, so we're the controller for what you type or say there. Our privacy policy covers it under "The web demo".

Restaurants agree to keep the disclosure in their greeting, to use the assistant only for their own orders, and to answer callers' data requests with our help. Those duties are in our Acceptable Use Policy and our terms (UK, US), which also cover liability. Our UK privacy policy and our US and California privacy policy cover everything else we do with personal data.

05Callers in the UK

UK GDPR (Articles 12 to 14) says people must be told, clearly and when their data is collected, who is collecting it, why, and what their rights are. Nobody can read a full privacy notice down the phone, so Zogu gives it in layers, each at the point it matters.

1. At the start of the call. The greeting tells you you're talking to the restaurant's automated ordering assistant. It doesn't yet say the call is transcribed. [If approved, the greeting will add: "Calls are transcribed so the restaurant can check your order."]
2. During the call, as each detail comes up. The assistant asks only for what the order needs, when it needs it. It asks for a name once you've finished choosing, and for a postcode and address only for delivery. It uses the number you're ringing from, and asks for a contact number only if yours is withheld. When it reads back a contact number that isn't the one you're ringing from, it says only the last three digits.
3. In full, in writing. This page and our UK privacy policy set out the controller, the purposes, the lawful bases, how long data is kept and your rights.

Lawful basis

[For review by a UK solicitor.] The order details are used to take and fulfil an order you asked for (contract, Article 6(1)(b)). The transcript, reply times and the returning-caller greeting rely on the restaurant's legitimate interests in checking orders and running its phone line (Article 6(1)(f)).

Health information

If you mention a health condition, for example when asking about allergens, it ends up in the transcript. The assistant only answers from the allergens listed in the restaurant's menu. When it gives them, it adds a reminder to check with the restaurant before ordering if you have a serious allergy. [Solicitor to advise on Article 9 handling.]

Automated decisions

The assistant doesn't make decisions about you that have legal or similarly significant effects (Article 22). It takes the order you confirm, and the restaurant accepts or rejects it.

Your rights

You can ask for a copy of your transcript, have something corrected, object, or ask for it to be deleted (see below). You can also complain to the Information Commissioner's Office at ico.org.uk.

06Callers in the US

Federal law and most states allow a call to be recorded with the consent of one person on it. Some states require everyone on the call to consent before it's recorded or listened to by someone else. These include California, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Pennsylvania and Washington. [Counsel to confirm the list.]

Zogu doesn't record call audio. But a live transcript made by a company working for the restaurant may still count as recording or listening in under these laws. California's Invasion of Privacy Act is one of them. So before Zogu takes live US calls, we plan to treat every US call as if all-party consent applies, whatever state the caller is in. Today the greeting says the assistant is automated but not that the call is transcribed, so none of this is in place yet:

• The notice would come first. The greeting saying it's an automated assistant plays as the call starts, before any order is taken. [If approved by counsel, the greeting will add: "This call is transcribed." To put to the user: make that line part of the disclosure the code enforces, as the "automated" line already is.]
• Once the greeting says the call is transcribed, staying on the line would be treated as consent. If you don't want that, hang up. Nothing is sent to the restaurant, and you can ask for anything you already said to be deleted.
• The transcript is used only for the restaurant's order and for fixing the service, as described above. We don't sell it, share it for advertising or use it to train AI models.
• Zogu only answers calls. The TCPA and the FCC's 2024 ruling that AI-generated voices count as "artificial or prerecorded" (FCC 24-17) govern outbound calls and texts; Zogu never places calls or sends marketing messages.

State privacy laws, including the California Consumer Privacy Act as amended by the CPRA, give you the right to know about, correct and delete your personal information. Our US and California privacy policy explains how to use them.

This section is a draft. Reviewed by: [Counsel name and firm], [date]. Zogu won't take live calls in the US until counsel has reviewed it.

07Asking for a transcript to be deleted or sent to you

Email [Contact email] or write to [Registered address]. You can also ask the restaurant you rang, and it can pass your request on to us. Please include:

• the restaurant number you rang;
• the number you rang from;
• the date and roughly what time you called.

We find your call by matching those details. Before we send or delete anything, we may ask you something about the call, such as what you ordered, to check it's yours. There's no self-serve option yet, and nothing deletes call records automatically: our team deletes them by hand. [Nothing deletes call records automatically yet: no retention job covers the database, the call's Durable Object storage, greeting clips that contain names, or Twilio's call logs. Until one is built, deletion is done by hand on request, and these periods are still being set. Tell the lawyer this before filling them in.]

Deleting a call removes its transcript, reply times, call record, and any review-list entries taken from it. If you ask, we also delete your earlier phone orders with that restaurant from Zogu's records, so the assistant won't greet you by name next time.

Three things sit outside what we can delete:

• The order in the restaurant's own system. That's the restaurant's record, so ask the restaurant.
• Twilio's own call logs. We'll pass your request to Twilio. [Confirm Twilio's process.]
• Anything we're required by law to keep. If that applies, we'll tell you what and why.

We reply within one month for UK requests and within 45 days for US requests. [Confirm timescales with counsel.]

08Changes to this page

We change this page only when what Zogu keeps, or who processes it, changes: a new AI model, a new sub-processor, or a set retention period. The "last updated" date at the top changes only when the text does.

To find out who builds Zogu, see About Zogu.