Skip to main content
Thrill AI

Privacy Policy

Last updated: February 2026

1. Introduction

Thrill AI ("we", "our", "us") operates the Thrill AI platform, a voice-powered AI ordering system for restaurants. This Privacy Policy explains how we collect, use, and protect personal information when you use our services, in compliance with the Digital Personal Data Protection Act, 2023 (DPDPA) of India.

2. Information We Collect

We collect the following categories of personal data:

  • Restaurant Owners: Name, email, phone number, password (hashed), restaurant details, menu data.
  • Customers: Name, phone number (optional), table number, order details.
  • Voice Data: When using voice ordering features, audio is processed in real-time for speech-to-text conversion and is not stored permanently.
  • Usage Data: Pages visited, features used, device information, IP address.

3. How We Use Your Data

  • To provide AI-powered ordering services to restaurants and their customers.
  • To process orders and payments via Razorpay (our payment processor).
  • To improve our AI models and service quality.
  • To send transactional notifications (order confirmations, status updates).
  • To provide customer support and respond to inquiries.

4. Data Processing Partners

We work with the following third-party data processors:

  • Sarvam AI — Indian language speech-to-text, text-to-speech, and translation. Data processed on Indian servers.
  • Google Cloud — Infrastructure hosting (Cloud Run, Cloud SQL).
  • Razorpay — Payment processing. We never store card details.
  • Resend — Transactional email delivery.

5. Data Storage and Security

Your data is stored on servers located in India. We implement industry-standard security measures including encryption in transit (TLS 1.3), hashed passwords (bcrypt), and rate-limited API endpoints. Voice data is processed in real-time and not retained after transcription.

6. Your Rights Under DPDPA

As a data principal under the DPDPA, you have the right to:

  • Access your personal data and request a summary of processing activities.
  • Correct inaccurate or incomplete personal data.
  • Erase your personal data (right to be forgotten).
  • Withdraw consent for data processing at any time.
  • Nominate another person to exercise your rights in case of death or incapacity.
  • Lodge a grievance with the Data Protection Board of India.

7. Data Retention

We retain your personal data only as long as necessary for the purposes outlined above. Restaurant owner accounts are retained until deletion is requested. Customer order data is retained for 12 months for business analytics, then anonymized. Voice recordings are not retained.

8. Contact Us

For privacy-related inquiries, data access requests, or to exercise your DPDPA rights, contact our Data Protection Officer at: privacy@thrillai.com