Privacy information

1. Who we are

ezRegulars
Inhaberin: Kusuma Narasimhamurthy
Stockmannstraße 34, 81477 München, Germany
Email: ezregulars@gmail.com
Phone: +49 155 10614940

2. What this policy covers

This policy covers ezregulars.com (this marketing site and the business self-service portal) and the WhatsApp ordering bot used by our partner businesses’ customers — restaurants today, and other repeat-purchase local businesses (salons, grocers, cleaners, etc.) as the platform grows. Today, EZRegulars operates as the controller for the data described here. As individual businesses join the platform, EZRegulars acts as a processor on their behalf under a separate data-processing agreement, and the business becomes the controller for its own customers’ order data — we will update this policy as real businesses onboard.

3. Contact / enquiry form

The contact form on this site prepares an email in your own email application — it does not submit anything to our servers. We only receive your message, and process the contact details in it, if and when you actually choose to send that email.

4. Business portal (business owners and staff)

If you sign in to the self-service portal, we process your Google account email address to identify you and link you to your business, and the menu/order data you manage there. Legal basis: performance of our contract with your business (Art. 6(1)(b) GDPR).

5. WhatsApp ordering bot (customers of partner businesses)

When you message a business using EZRegulars on WhatsApp, we process: your phone number, first and last name, delivery address (if you give one), your order history (items, prices, fulfilment and payment method), your consent records (see §7), your chosen reply language, and a short-lived summary of the current conversation needed to keep track of your order. Legal basis: performance of our contract with you when you place an order (Art. 6(1)(b) GDPR), and your consent for anything beyond that (Art. 6(1)(a) GDPR) — see §7. Providing your phone number and the details needed to fulfil an order is necessary to use the ordering bot; without it, we cannot process your order.

6. How the AI assistant is used

Free-text messages you send while ordering (e.g. "2 butter chicken, no onions") are processed by an AI model (Google Gemini) to help figure out what you mean. The AI only ever classifies or extracts information from your message — every fact it identifies (items, prices, availability) is independently checked against the business’s real menu/catalog and your real order before anything happens. No decision with a legal or similarly significant effect on you (e.g. whether your order or payment is accepted) is ever made by the AI alone.

7. Consent

Before we can process your order, we ask for your consent to store and use your phone number and order details (a hard requirement — we cannot take orders without it). Separately, and never blocking your ability to order, we ask whether you’d like occasional offers and promotions on WhatsApp. We record the exact wording you agreed to, a timestamp, and which version of this policy applied. You can withdraw marketing consent at any time by telling us so on WhatsApp, or changing your reply language at any time the same way.

8. Who else sees your data

We use the following processors to run the service: Meta (WhatsApp message delivery), Google (Gemini for message understanding, and Google Sign-In for business portal login), Stripe (payment processing for online orders), Neon (database hosting), and Netlify (website/portal hosting). Some of these providers may process data outside the EU/EEA (e.g. the US); where that happens, we rely on the safeguards those providers offer, such as standard contractual clauses. We do not sell your data, and we do not share it with any business other than the one you’re actually ordering from.

9. How long we keep it

We keep order and consent records for as long as needed to fulfil orders, handle any dispute or complaint, and meet German statutory retention obligations (commercial/tax records can require retention of up to 10 years). Conversation-context data used only to keep track of an in-progress order is short-lived and cleared once it’s no longer needed for that purpose. We delete or anonymise data once none of these reasons still apply.

10. Your rights

Under GDPR you have the right to access, correct, or erase your data, restrict or object to our processing of it, receive a copy in a portable format, and withdraw any consent you’ve given, at any time. To exercise any of these, contact us using the details in §1. You also have the right to complain to a supervisory authority — in Bavaria, that’s the Bayerisches Landesamt für Datenschutzaufsicht.

11. Security

We restrict access to personal data to what’s needed to run the service, and rely on our processors’ own security measures (encryption in transit, access controls) in addition to our own. No system is perfectly secure, but we take reasonable, proportionate steps given the scale of the service today.

12. Changes to this policy

We’ll update this page as the service changes — for example, once real businesses onboard and the controller/processor arrangement in §2 becomes operative. Last updated: 21 August 2026.