Privacy Policy

1. Scope and our role

This Policy applies to Moshi Moshi websites, customer accounts, AI Receptionist, booking management and related services. In many booking interactions, the restaurant decides why guest information is collected and Moshi Moshi processes it to provide the restaurant’s service. We also handle information for our own account, security, billing, support and legal purposes.

2. Information we collect

Depending on how you interact with us, we may collect:

• account and contact information, including name, email, mobile, role, business name and sign-in identifiers;
• restaurant configuration, including locations, hours, tables, booking rules, knowledge and staff transfer details;
• guest and booking information, including name, phone, email, party size, date, time, preferences, requests and booking history;
• call and conversation information, including transcripts, call timing, intent, outcomes and optional recordings where enabled;
• billing profile details and payment-provider references, but not a complete card number or CVC;
• website enquiries, consent choices and support correspondence; and
• device, browser, network, security, audit and diagnostic data.

A guest may choose to share allergy or accessibility information. This can be sensitive information. Restaurants should request only what is reasonably necessary and must not rely on AI as a substitute for trained staff on serious allergy or safety matters.

3. How we collect information

We may collect information directly through forms, accounts, website voice, telephone interactions and support requests; from a restaurant or its authorised staff; and from service providers used to operate the platform. Where required, a collection notice may be given on a form, at the start of a call or through a confirmation message.

4. Why we use information

We use personal information where reasonably necessary to:

• create and manage accounts, restaurants and authorised access;
• answer enquiries, check availability and create, find, modify or cancel bookings;
• operate waitlist, walk-in, table and staff-handoff workflows;
• provide confirmations, service messages and customer support;
• secure, troubleshoot, audit and improve the Services;
• manage billing, subscriptions, disputes and legal obligations; and
• send marketing only where permitted, with a working way to unsubscribe.

We do not sell personal information. We do not use customer call or booking content to train general-purpose AI models unless we first obtain appropriate permission and update this Policy.

5. AI, transcripts and optional recording

AI Phone and Web Voice may process speech and text to understand a guest’s request and complete permitted booking actions. Conversation transcripts may be available to authorised restaurant users according to the selected plan and retention settings.

Original call recording is off by default. If an eligible restaurant deliberately enables recording in a supported production environment, callers must receive an appropriate notice and recording will be retained only for the configured period or as otherwise required by law. Restaurants must not enable recording where it would be unlawful.

6. Who we disclose information to

We may disclose information to the restaurant receiving or managing a booking; its authorised OWNER, MANAGER and STAFF users; and providers supporting hosting, identity, AI processing, payment, email, telecommunications, messaging, security and professional advice.

Providers currently used or prepared for production may include Cloudflare/OpenAI Sites, OpenAI, Supabase, Stripe and Resend. A telecommunications or messaging provider will receive production data only after that integration is connected and activated. These providers may process information in Australia, the United States and other countries where they or their subprocessors operate. Contractual and technical controls are used where appropriate.

7. Security and retention

We use access controls, tenant separation, audit records and other reasonable safeguards appropriate to the information and service. Payment card details are collected by the payment provider rather than stored by Moshi Moshi.

We retain personal information only for as long as reasonably needed for the purpose collected, the restaurant’s configured retention settings, security and dispute handling, or applicable legal and accounting requirements. When it is no longer required, we take reasonable steps to delete or de-identify it. Backups and audit records may take additional time to expire securely.

8. Access, correction and choices

You may ask to access or correct personal information held by Moshi Moshi by emailing us. A restaurant guest may also contact the relevant restaurant, which may be best placed to manage the booking record. We may need to verify identity and may refuse a request where permitted by law, explaining the reason where required.

Marketing consent is optional and may be withdrawn at any time using the unsubscribe method in the message or by contacting us. Operational booking, security and billing messages are not marketing messages.

9. Complaints and data incidents

Privacy questions or complaints can be sent to moshimoshi.info@gmail.com. Please include enough information for us to investigate. We will acknowledge and respond within a reasonable time. If you are not satisfied, you may be able to contact the Office of the Australian Information Commissioner at oaic.gov.au. We will assess and notify eligible data breaches as required by law.

10. Changes to this Policy

We may update this Policy when our practices, providers or legal obligations change. The current version and effective date will remain available on this page. Material changes will be communicated where reasonably required.