This policy covers the rewards and ordering apps that SousShift AI builds and runs for restaurants — the page you reach by scanning a QR code at the table, on a sticker or in the window. Each app is branded for one restaurant, and this one policy covers all of them.
The apps are operated by PROTECT US SECURITY LLC, doing business as SousShift AI ("we," "us"), on behalf of the restaurant whose name and logo you see in the app ("the restaurant"). You can reach us any time at secondshiftai@gmail.com. For anything about your account at a particular restaurant, you can also just ask that restaurant.
1. What the app collects
What you type in
- Your name, and a phone number or an email address (one of the two is required, so the restaurant has a way to send you your reward). You may give both.
- Your birthday — optional. Only used for a birthday reward.
- Marketing text consent — a separate tick box. If you tick it we keep a record of what the box said, when you ticked it, and which page you were on, because the law requires us to be able to show that you agreed. See section 6.
- A referral code, if a friend gave you one.
- Feedback or a star rating, if you leave one.
What the app records as you use it
- Your rewards account: points balance, points earned and used over time, visits, which rewards you earned and redeemed, your own referral code, who referred you, and how many friends you referred.
- A rewards-card ID (for example
MLD-4K7Q2) — a permanent code that staff can look up to find your account without needing your phone number. - Game scores and plays, if you play the in-app game.
- A random device token stored on your phone. It is not your phone number and it does not identify you anywhere else; it exists so that one phone cannot hold several memberships at the same restaurant, and so only your own phone can change your points.
- If you add a visit by photographing your receipt: the check number, the date, the total, and the photo itself. Photos are stored in the restaurant's Google Drive so the restaurant can confirm the visit.
Stored only on your own phone
Your member record, points and game progress are saved in your browser's local storage so the app still works with no signal. These are cleared if you clear your browser data — which is also why, if you are a member, the same record is kept on the restaurant's server, so losing or changing your phone does not lose your points.
Location
If you tap a feature that needs it (directions, or "how far away am I"), your browser asks your permission first. Those coordinates are used on your phone, to work out distance, and are not sent to us or stored by us. You can say no and the rest of the app works normally. Map and review panels are served by Google Maps, so Google receives the ordinary request data described below.
What the app never collects
No password (there is no password to create), no Social Security or government ID number, no card or bank details, no contacts, no photo library, and no cross-site advertising identifiers. There are no third-party ads in the app. If you pay for an order in the app, your card details go straight to Stripe, our payment processor — we never see or store your card number.
2. Why we use it
| What | Why |
|---|---|
| Name, phone or email | To create your rewards account and to send you a reward you have earned |
| Points, visits, rewards, referrals | To run the rewards program and show the restaurant how it is doing |
| Birthday | Only to give you a birthday reward |
| Rewards-card ID + device token | So staff can find your account, and so one person cannot open several accounts to farm rewards |
| Receipt number, date, total, photo | To confirm a visit you claimed, and to stop the same receipt being used twice |
| Game scores | To award game prizes and run the weekly leaderboard |
| Text consent record | To prove you agreed before any marketing text was sent (required by law) |
3. Who else sees it
- The restaurant whose app you joined — this is the point of the program. Your record appears in their member list and their staff can look up your card to apply a reward.
- Other restaurants get nothing. Joining one restaurant's app does not put you in another's list, even when we run both.
- Companies that run parts of the service for us, and may only use it to do that job: Google (the restaurant's Sheets and Drive, where member records and receipt photos are stored, and Google Maps), Twilio (sending texts, only if you opted in), Stripe (payment, only if you order and pay in the app), and GitHub (serving the app itself).
- If the law requires it — a subpoena, court order, or a genuine safety emergency.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have never done either. We also do not use what you give a restaurant to advertise anything else to you.
4. How long we keep it
- Your member record: while you are a member. If you ask us to delete it, we do — see section 5.
- Your text-consent record: kept at least four years even if you opt out, because it is the proof that you agreed at the time. It records the consent, not a reason to text you again.
- Receipt photos: kept until the restaurant has reviewed the claim, then no longer needed; removed on request at any time.
5. Your rights, and how to use them
California residents have specific rights under the California Consumer Privacy Act, as amended by the CPRA. We give the same rights to everybody, wherever you live:
- Know and access — ask what we hold about you and get a copy.
- Delete — ask us to delete it. We will, except anything we must keep by law (for example the consent record above, or a record of a sale).
- Correct — tell us something is wrong and we will fix it.
- Opt out of sale or sharing — there is nothing to opt out of, because we do neither.
- Limit the use of sensitive information — we do not collect sensitive personal information as the law defines it.
- No retaliation — using any of these rights will never cost you points, rewards, or a worse price. You keep what you earned.
To use any of them, email secondshiftai@gmail.com from the address you joined with, or tell the restaurant and they will pass it on. If you joined with a phone number and no email, say so and we will verify you another way. We reply within 45 days and will tell you if we need longer. You may use an authorised agent; we will ask for proof that you authorised them. We do not charge for this.
6. Marketing texts
Marketing texts are optional and separate. You can join the rewards program, earn points and redeem rewards without ever agreeing to texts, and we will not make you agree as a condition of anything.
- If you tick the box, you agree the restaurant may text you offers at the number you gave. Message frequency varies. Message and data rates may apply.
- Reply STOP to any message to stop them. Reply HELP for help. Stopping texts does not close your rewards account or cost you points.
- You can also turn texts off in the app, or ask the restaurant.
- Texts about something you asked for — a reward code you just earned, or an order you just placed — are not marketing and are sent whether or not you tick the box.
7. Children
These apps are for adults. We do not offer rewards accounts to children under 13 and we do not knowingly collect personal information from them. Where an app has a kids' game mode, it runs under a parent's or guardian's own account, behind a check that only the grown-up can pass, and no separate account, name, phone number or email is collected for the child. If you believe a child under 13 has given us information, email secondshiftai@gmail.com and we will delete it.
8. Alcohol
Where a restaurant serves alcohol, bar rewards are discounts or free non-alcoholic drinks. Points are never redeemable for free alcohol, and points are never earned on alcohol purchases, as California law requires. You must be 21 or over to use a bar reward and staff will check ID.
9. Keeping it safe
The apps are served over HTTPS. Member records sit in the restaurant's own Google account, reachable only by the restaurant and by us, and your record can only be changed from the phone that created it. No system is perfect: if a breach ever affects your information, we will tell you and the authorities as the law requires.
10. Changes to this policy
If we change this policy we will change the "Last updated" date above. If a change is significant — new information collected, or a new company receiving it — we will say so in the app before it takes effect.
11. Contact
SousShift AI — PROTECT US SECURITY LLC
secondshiftai@gmail.com
Prefer to ask in person? Ask the restaurant. They can reach us and we answer them the same way we answer you.