Tavra Privacy Policy

At Tavra Technologies, LLC ("Tavra," "we," "us," or "our"), we take privacy seriously. This Privacy Policy explains how we collect, use, disclose, retain, and protect Personal Data when you access or use our Services.

"Services" means Tavra's websites, web pages, mobile applications, web portals, AI phone answering services, voice services, call handling tools, call logs, voicemail tools, menu knowledge tools, ordering workflows, reservation workflows, wait status tools, operational dashboards, demo services, Pilot Program checkout and signup flows, integrations, software, communications, and related products and services.

By accessing or using the Services, you acknowledge that you have read this Privacy Policy and understand that we collect, use, disclose, and otherwise process Personal Data as described below. Where required by law, we will ask for your consent before collecting or using certain Personal Data.

Your use of the Services is also subject to Tavra's Terms of Service, which incorporates this Privacy Policy. Any capitalized terms used but not defined in this Privacy Policy have the meanings given to them in the Terms of Service.

We may update this Privacy Policy from time to time as our Services, business, legal obligations, or privacy practices change. When we make changes, we will update the "Last Updated" date above and may provide notice by posting the updated Privacy Policy on our website, sending an email, providing an in-product notice, or using another reasonable method. If you continue to use the Services after the updated Privacy Policy becomes effective, you agree to the updated Privacy Policy to the extent permitted by law.

SMS Messaging Program and Mobile Information

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Mobile information includes mobile phone numbers, text messaging originator opt-in data, and messaging consent information. We do not sell, rent, or otherwise provide this information for marketing or promotional purposes.

All categories in this Privacy Policy exclude text messaging originator opt-in data and consent from disclosure to third parties or affiliates for marketing or promotional purposes. We may disclose mobile information to subcontractors that support the Services, such as messaging and telephony providers, mobile carriers, and customer-support providers, only as necessary to deliver and administer requested messages, provide support, honor communication choices, prevent fraud or abuse, or comply with law. These providers may not use mobile information for their own marketing or promotional purposes.

Tavra and Tavra customers may use the Services to send transactional or operational text messages to a mobile number when the recipient requests the message, opts in, or otherwise provides the consent required for that messaging. Messages may include reservation confirmations or updates, order receipts or status updates, wait-status updates, requested callback information, support responses, account or service alerts, and similar communications related to the recipient's interaction with Tavra or the relevant Tavra customer.

We collect and use mobile phone numbers, SMS opt-in or consent information, messaging preferences, message content and replies, timestamps, and delivery or opt-out status to deliver requested messages, respond to recipients, maintain messaging preferences, troubleshoot delivery, prevent fraud or abuse, and comply with legal and carrier requirements.

Message frequency varies based on your interactions and the services you request. Message and data rates may apply. Consent to receive text messages is not a condition of purchasing Tavra's Services or a Tavra customer's products or services.

Reply STOP to unsubscribe from text messages from the sending number. Reply HELP for help, or contact Tavra at legal@tavraOS.com or (512) 630-2700. After an opt-out request, we may send one confirmation message and will not send additional messages from that messaging program unless you opt in again. Mobile carriers are not liable for delayed or undelivered messages.

What this Privacy Policy Covers

This Privacy Policy describes how Tavra treats Personal Data that we collect when you access or use the Services, communicate with us, request a demo, create an account, use Tavra's AI phone operations platform, interact with a Tavra-powered phone agent, use a Tavra website or portal, or otherwise engage with Tavra.

"Personal Data" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked with a particular individual or household. Personal Data includes information referred to as "personal information," "personally identifiable information," or similar terms under applicable privacy laws.

This Privacy Policy applies to Personal Data about:

• Tavra customers, including restaurant, coffee shop, food truck, and hospitality business owners, operators, managers, team members, and representatives.
• Authorized Users who access Tavra accounts, dashboards, portals, or mobile applications.
• Prospective customers, demo requesters, website visitors, and sales leads.
• Callers, guests, restaurant customers, and other end users who interact with a business through Tavra-powered phone, ordering, reservation, voicemail, or related workflows.
• Individuals who contact us for support, sales, billing, legal, privacy, or other reasons.

This Privacy Policy does not apply to the privacy practices of companies, organizations, or individuals that Tavra does not own or control. For example, when a restaurant, coffee shop, food truck, or other Tavra customer uses the Services to interact with its own guests or callers, that business may have its own privacy practices and legal obligations. If we process your Personal Data on behalf of one of our customers as a service provider or processor, you may need to contact that customer directly to exercise certain privacy rights.

Personal Data

Categories of Personal Data We Collect

The table below describes the categories of Personal Data that we collect and have collected during the past 12 months.

We may also collect, generate, or receive aggregated, de-identified, or anonymized information that does not identify you and is not treated as Personal Data under this Privacy Policy.

Categories of Sources of Personal Data

We collect Personal Data from the following categories of sources:

You

• When you provide information directly to us, create an account, log in to the Services, request a demo, or sign up for a pilot, trial, or paid offering.
• When you use our mobile app, website, portal, dashboard, demo tools, or other interactive Services.
• When you configure a business profile, menu, reservation workflow, handoff route, wait status, voicemail setting, POS integration, or other operational setting.
• When you submit information through forms, surveys, support tickets, questionnaires, email, text, calls, or other communications.
• Through Cookies, log files, device data, analytics tools, security tools, app events, portal events, website events, and dashboard usage events.

Tavra Customers and Authorized Users

We collect Personal Data when a restaurant, coffee shop, food truck, or other business uses Tavra to interact with callers, guests, employees, contractors, or team members, and when a Tavra customer or Authorized User reviews, edits, exports, or acts on operational records generated through the Services.

End Users and Callers

We collect Personal Data when you call or interact with a business using Tavra-powered AI phone answering, voicemail, ordering, reservation, wait status, or related workflows. This may include your name, phone number, order, reservation, dietary request, allergy information, accessibility request, voicemail, question, call metadata, transcript, recording, summary, or related operational record.

Third Parties

We may collect Personal Data from service providers, payment processors, telephony, speech, and AI providers, POS, reservation, and integration providers, public sources, social networks, and third-party accounts, according to their own settings and privacy policies.

Our Commercial or Business Purposes for Collecting or Disclosing Personal Data

Providing, Customizing, and Improving the Services

• Creating, authenticating, and managing accounts, profiles, team roles, permissions, invites, and business access.
• Operating AI phone answering, call routing, voicemail, call logs, transcription, voice workflows, ordering, reservations, wait status, handoff, menu knowledge, and operational workflows.
• Processing orders, payments, refunds, invoices, billing, subscriptions, pilot fees, or other transactions.
• Providing dashboards, app screens, web portals, reports, logs, notifications, and operational records.
• Connecting and maintaining integrations, including POS, payment, telephony, speech, AI, reservation, notification, and analytics integrations.
• Providing support, troubleshooting, debugging, maintenance, customer success, testing, monitoring, analysis, personalization, product development, and security services.

AI, Voice, and Automation Operations

We use Personal Data to operate automated phone interactions and related AI workflows, generate and process call transcripts, call summaries, voicemail records, order records, reservation records, and related operational outputs, monitor and improve speech recognition, text-to-speech, call routing, prompt behavior, and call handling quality, evaluate call outcomes, feature performance, and workflow reliability, and train, test, improve, or evaluate systems where permitted by law and customer agreements.

Marketing the Services

We may use business contact information to respond to demo requests, create and manage first-party sales leads and customer relationships, communicate about Tavra's own Services, and measure the effectiveness of Tavra's website pages and direct outreach. Tavra does not use third-party behavioral advertising or sell Personal Data for advertising.

We do not use a person's SMS opt-in or messaging consent to authorize marketing or promotional text messages. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes.

Corresponding with You

We may use Personal Data to respond to communications, send administrative, legal, security, billing, account, support, product, service, operational, and feature communications, contact you when necessary or requested, and provide content that we think may interest you, subject to communication preferences and applicable law.

Meeting Legal Requirements and Enforcing Legal Terms

We may use Personal Data to comply with applicable law, regulation, subpoena, court order, government request, legal process, or contractual obligation, prevent, detect, investigate, and respond to security incidents, fraud, abuse, unlawful activity, or prohibited activity, protect rights, property, privacy, security, or safety, enforce our Terms of Service, Order Forms, agreements, policies, and other legal terms, resolve disputes, collect amounts owed to us, and respond to claims.

We will not collect additional categories of Personal Data or use Personal Data for materially different, unrelated, or incompatible purposes without providing notice where required by law.

How We Disclose Your Personal Data

We disclose Personal Data only to the categories of service providers and other parties described below for operational, customer-directed, authorized, legal, or transaction-related purposes. Tavra does not sell Personal Data or share Personal Data for cross-context behavioral advertising.

Notwithstanding any other provision of this Privacy Policy, no mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All categories below exclude text messaging originator opt-in data and consent from marketing or promotional disclosure.

Service Providers

These parties help us provide the Services or perform business functions on our behalf. They may include hosting, database, infrastructure, cloud, telephony, call routing, communications, messaging, speech-to-text, text-to-speech, voice, audio processing, AI model, automation, software, analytics, security, fraud prevention, monitoring, logging, debugging, customer support, sales, customer success, email, notification, product fulfillment, implementation, onboarding, payment, billing, invoicing, accounting, tax, collections, and professional advisor providers.

Payment Processors

Payment processors may collect payment card or payment account information directly from you or from a Tavra customer as needed to process payment. Tavra generally receives limited payment metadata, such as payment status, transaction IDs, invoice IDs, processor customer IDs, payment method type, last four digits where provided, or refund status. Your payment processor's own terms and privacy policy govern its use of payment information.

Telephony, Speech, and AI Providers

These parties help us route calls, answer calls, record calls where enabled, transcribe speech, generate audio responses, detect call events, process voicemail, and operate AI phone workflows. These providers may process caller numbers, called numbers, call metadata, audio, transcripts, prompts, responses, and related operational information as necessary to provide the Services.

POS, Reservation, Payment, and Business Integration Providers

If you or a Tavra customer connects a third-party service, we may disclose Personal Data to that provider or receive Personal Data from that provider as necessary to provide the integration. These providers may include POS systems, payment providers, reservation systems, printer providers, messaging providers, calendar providers, and other business systems. Their own terms and privacy policies govern their independent processing of Personal Data.

Operational Providers, Tavra Customers, and Authorized Users

We may disclose Personal Data to operational Service Providers, the relevant Tavra customer, and its Authorized Users as needed to provide the Services. For example, a business may be able to view call logs, transcripts, voicemail records, order records, reservation records, wait status records, caller information, and related operational records generated for that business. These operational disclosures do not authorize any recipient to use mobile information, SMS opt-in data, or messaging consent for marketing or promotional purposes.

Parties You Authorize, Access, or Authenticate

These parties may include third-party services you choose to connect, social media services, POS, reservation, payment, telephony, calendar, or messaging providers you authorize, or other parties you direct us to share information with.

Legal Obligations and Business Transfers

We may disclose any Personal Data we collect to third parties when we believe disclosure is necessary or appropriate for legal, compliance, safety, security, fraud-prevention, or dispute-resolution matters. If Tavra is involved in a merger, acquisition, financing, reorganization, bankruptcy, receivership, sale of company assets, due diligence process, or similar transaction, Personal Data may be disclosed to or transferred as part of that transaction.

Data that is Not Personal Data

We may create aggregated, de-identified, or anonymized data from Personal Data by removing or modifying information that could identify a particular individual or household. We may use and disclose aggregated, de-identified, or anonymized data for lawful business purposes, including analytics, benchmarking, security, product development, AI and workflow improvement, performance measurement, research, marketing, and improving the Services. We will not attempt to re-identify de-identified data except as permitted by law.

Cookies, Local Storage, and Website Data

The Services may use cookies, local storage, JavaScript, and similar essential technologies to provide login and session behavior, remember settings, route requests, prevent fraud, maintain security, diagnose errors, and operate requested features. Hosting and infrastructure providers may also receive standard request information such as IP address, browser type, requested page, and request time as needed to deliver and secure the Services.

The public Tavra marketing website does not currently use third-party advertising pixels, retargeting cookies, or Google Analytics. Tavra does not serve interest-based advertisements and does not share Personal Data for cross-context behavioral advertising.

Types of Technologies We Use

• Essential technologies. Required to provide login, secure sessions, authentication status, request routing, fraud prevention, and protected areas of the Services.
• Functional technologies. Used to remember choices and settings and maintain preferences.
• Operational diagnostics. Used to understand errors, load times, security events, and general feature reliability.

You can manage cookies and local storage through your browser settings. If you block or delete essential technologies, you may need to manually adjust preferences and some features may not work properly.

Tavra does not currently provide a standalone cookie settings page because the public website does not use advertising or retargeting cookies. To submit a privacy request, email legal@tavraOS.com.

To learn more about Cookies generally, including how to manage and delete Cookies, visit https://www.allaboutcookies.org/.

Data Security

We use reasonable administrative, technical, organizational, and physical safeguards designed to protect Personal Data from unauthorized access, loss, misuse, disclosure, alteration, and destruction. These safeguards are selected based on the type of Personal Data, the nature of the processing, and the risks involved.

You can help protect your account by using a strong password, protecting your login credentials, limiting access to your devices and browsers, signing out after using shared devices, and promptly notifying us if you believe your account or credentials have been compromised.

No method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee that Personal Data will never be accessed, used, disclosed, altered, or destroyed without authorization.

Data Retention

We retain Personal Data for as long as reasonably necessary to provide the Services, operate our business, comply with legal obligations, resolve disputes, enforce agreements, collect fees, maintain security, prevent fraud, support customer operations, and fulfill the purposes described in this Privacy Policy.

When determining retention periods, we consider factors such as the type and sensitivity of the Personal Data, collection purposes, active account, business, call, order, reservation, integration, billing record, or legal obligation status, Tavra customer expectations and instructions, security, fraud prevention, audit, tax, accounting, and compliance needs, and applicable legal, contractual, and operational requirements.

For example, we retain account profile and authentication information while your account is active or as needed for legal, security, or operational purposes; business profile, menu, configuration, integration, and operational data for as long as needed to provide the Services to the relevant Tavra customer; call logs, call recordings, transcripts, voicemail records, order records, reservation records, and related operational records for as long as needed to provide the Services, support the relevant business, comply with law, resolve disputes, and improve Service reliability; payment and billing records as needed for payment processing, accounting, tax, audit, fraud prevention, dispute resolution, and legal compliance; device, IP, web analytics, log, and security data as needed to operate, secure, debug, analyze, and improve the Services; and aggregated, de-identified, or anonymized data indefinitely where permitted by law.

When Personal Data is no longer needed, we may delete, de-identify, aggregate, or anonymize it, subject to our backup, legal, security, and operational retention practices.

Personal Data of Children

The Services are not directed to children under 13 years of age, and we do not knowingly collect or solicit Personal Data from children under 13 for account registration or direct use of the Services. If you are under 13, do not create an account, use the Services, or send Personal Data to us.

Because Tavra provides phone and operational tools to businesses, it is possible that a child may call or interact with a Tavra customer, such as a restaurant, coffee shop, food truck, or hospitality business. In that situation, we process the interaction as part of providing Services to the Tavra customer.

If we learn that we have collected Personal Data from a child under 13 in a manner not permitted by law, we will take reasonable steps to delete it as quickly as possible. If you believe a child under 13 has provided Personal Data to Tavra, contact us at legal@tavraOS.com.

California Resident Rights

If you are a California resident, you may have the rights described in this section under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"). Please see the "Exercising Your Rights under CCPA and VCDPA" section below for instructions on submitting requests.

Please note that we may process Personal Data of our customers' end users, callers, guests, employees, contractors, or representatives in connection with providing Services to our customers. If we process your Personal Data as a service provider or processor for a Tavra customer, you should contact that customer directly to exercise rights with respect to that data.

If there is a conflict between this California section and another part of this Privacy Policy, the portion that is more protective of Personal Data will control for California residents to the extent of the conflict. If you have questions about this section or whether these rights apply to you, contact us at legal@tavraOS.com.

Access, Deletion, and Correction

You may have the right to request that we disclose certain information about our collection, use, disclosure, sale, and sharing of your Personal Data, request deletion of Personal Data we collected from you, subject to exceptions under the CCPA, and request correction of inaccurate Personal Data we maintain about you, subject to exceptions under the CCPA.

Processing of Sensitive Personal Information Opt-Out

California residents have certain rights relating to Sensitive Personal Information. We do not use or disclose Sensitive Personal Information for purposes that require a right to limit under the CCPA. We may process limited sensitive information if you or a Tavra customer voluntarily provides it in connection with the Services, such as allergy, dietary, accessibility, or similar information during an order, reservation, voicemail, or support interaction.

Personal Data Selling and Sharing Opt-Out

Tavra does not sell Personal Data and does not share Personal Data for cross-context behavioral advertising. Tavra has not sold Personal Data or shared Personal Data for cross-context behavioral advertising during the past 12 months. No mobile information, SMS opt-in data, or messaging consent is shared with third parties or affiliates for marketing or promotional purposes.

You may still submit a request concerning sale or sharing by emailing legal@tavraOS.com with the subject line "Do Not Sell or Share My Personal Information," or by enabling a Global Privacy Control or similar legally recognized opt-out preference signal in your browser or device where required by applicable law.

We Will Not Discriminate Against You for Exercising Your Rights Under the CCPA

We will not discriminate against you for exercising your CCPA rights. However, we may offer different service plans, features, prices, rates, or levels of service where permitted by applicable law, including where the difference is reasonably related to the value of Personal Data or the features provided.

Virginia Resident Rights

If you are a Virginia resident, you may have the rights described in this section under the Virginia Consumer Data Protection Act ("VCDPA"). Please see the "Exercising Your Rights under CCPA and VCDPA" section below for instructions on submitting requests.

Please note that we may process Personal Data of our customers' end users, callers, guests, employees, contractors, or representatives in connection with providing Services to our customers. If we process your Personal Data as a processor for a Tavra customer, you should contact that customer directly to exercise rights with respect to that data.

These rights are subject to conditions, limitations, and exceptions under applicable law, which may permit or require us to deny a request. If there is a conflict between this Virginia section and another part of this Privacy Policy, the portion that is more protective of Personal Data will control for Virginia residents to the extent of the conflict. If you have questions about this section or whether these rights apply to you, contact us at legal@tavraOS.com.

Access, Correction, Portability, and Deletion

You may have the right to confirm whether we are processing your Personal Data, access your Personal Data, correct inaccuracies, obtain a copy of Personal Data that you previously provided to us in a portable and readily usable format where technically feasible and where the processing is carried out by automated means, and request deletion of Personal Data provided by or obtained about you, subject to applicable law.

Opt-Out of Certain Processing Activities

You may have the right to opt out of targeted advertising, sale of Personal Data, and profiling in furtherance of decisions that produce legal or similarly significant effects concerning you, if applicable. Tavra does not currently sell Personal Data, process Personal Data for targeted advertising, or use Personal Data to make automated decisions that produce legal or similarly significant effects concerning individuals.

Verified customers may submit a request concerning any of these activities by emailing legal@tavraOS.com with the subject line "Privacy Opt-Out Request." Please include your name, business name, account email, state of residence, and a short description of your request so Tavra can verify and process it.

Appealing a Denial

If we decline to take action on your request, you may appeal our decision by emailing legal@tavraOS.com with the subject line "VCDPA Appeal." Include enough information for us to verify your identity, identify the original request, and understand why you believe the denial should be reconsidered. If we deny your appeal, you may contact the Virginia Attorney General using the methods described at https://www.oag.state.va.us/consumer-protection/index.php/file-a-complaint.

Exercising Your Rights under CCPA and VCDPA

To exercise the rights described in this Privacy Policy, you or, if you are a California resident, your Authorized Agent, must submit a request that provides sufficient information for us to reasonably verify that you are the person about whom we collected Personal Data, or that you are authorized to act on that person's behalf, and describes your request with enough detail for us to understand, evaluate, and respond to it. A request that meets these requirements is a "Valid Request."

We may not respond to requests that do not meet these requirements. We will use Personal Data provided in a Valid Request only to verify identity, evaluate the request, respond to the request, and maintain records of the request as required or permitted by law. You do not need to create an account to submit a Valid Request. However, if you already have an account, we may require you to submit the request through your account or verify your identity through account-related information.

You may submit a Valid Request using the following methods:

• Email: legal@tavraOS.com
• Phone: (512) 630-2700

Tavra does not currently provide a separate privacy request form. If you are a California resident, you may authorize another person or business entity to submit a request on your behalf (an "Authorized Agent"). We may request proof that you authorized the agent to act on your behalf, and we may require you to verify your identity directly with us or confirm that you provided the agent permission to submit the request.

Other State Law Privacy Rights

California "Shine the Light" Rights

California Civil Code Sections 1798.83 through 1798.84 may permit California residents to request certain information regarding our disclosure of Personal Data to third parties for their direct marketing purposes. To submit a request, contact us at legal@tavraOS.com with the subject line "California Shine the Light Request."

Do Not Track

Your browser may offer a "Do Not Track" option that allows you to signal to website operators that you do not want certain online activity tracked over time and across different websites. Because there is not currently a uniform industry standard for responding to Do Not Track signals, the Services do not respond to Do Not Track signals at this time. To learn more about Do Not Track, visit https://www.allaboutdnt.com/.

Nevada Resident Rights

If you are a Nevada resident, you may have the right to opt out of the sale of certain covered information to third parties. We do not currently sell Personal Data as "sale" is defined under Nevada Revised Statutes Chapter 603A. If you are a Nevada resident and would like to submit a request, email us at legal@tavraOS.com with the subject line "Nevada Do Not Sell Request" and include your name and the email address associated with your account, if applicable.

Other U.S. State Privacy Rights

Residents of other U.S. states may have additional privacy rights under applicable state privacy laws. Depending on where you live and whether a particular law applies to Tavra or to a Tavra customer, those rights may include the right to access, correct, delete, or obtain a copy of Personal Data, or to opt out of targeted advertising, sale, or certain profiling.

You may submit a request using the methods listed in the "Exercising Your Rights under CCPA and VCDPA" section above. We will evaluate and respond to requests as required by applicable law. If we process your Personal Data on behalf of a Tavra customer, we may direct you to contact that customer to exercise your rights.

Contact Information

If you have questions or comments about this Privacy Policy, our privacy practices, or your choices and rights regarding Personal Data, contact us at: