Privacy
Policy.

This Privacy Policy describes how personal data is collected, used, and protected in the GoAi.rest information system (the "Service") in accordance with applicable data protection laws, including Russian Federal Law No. 152-FZ "On Personal Data" and, where applicable, GDPR.

1. Definitions

• Personal data — any information relating to an identified or identifiable natural person.
• Operator / Controller — the entity processing personal data; see the "Operator Contacts" section.
• Processing — any operation performed on personal data, including collection, recording, storage, use, disclosure, or erasure.
• Service — the website goai.rest and related web applications providing SaaS analytics for restaurant chains.
• User — a natural person who submits data through the contact form or otherwise transmits their data to the Operator.

2. Operator Contacts

3. Personal Data We Collect

The Operator processes the following categories of personal data voluntarily provided by the User through contact forms:

• Name — for personalized communication
• Email address — for correspondence and responses
• Phone number / Telegram username — for prompt communication
• Chain / concept name — to understand context
• POS system — to determine technical fit
• Number of locations — to understand scale
• Comment field — if the User fills it in

When browsing the site, the following data is collected automatically:

• IP address and cookie files (see "Cookies" section)
• Browser, device, operating system information
• Referrer source, UTM parameters
• User behavior data (via web analytics)

4. Purposes of Processing

Personal data is processed exclusively for the following purposes:

• Responding to inquiries submitted via the contact form
• Providing access to the demo version of the Service
• Entering into and performing a service agreement
• Sending informational messages about the Service (with User consent)
• Improving Service quality through analysis of user behavior
• Fulfilling legal obligations imposed on the Operator

5. Legal Basis

Data processing is carried out on the following legal grounds:

• Consent of the data subject to personal data processing (Art. 6, 9 of 152-FZ) — given by checking the mandatory "I consent to processing of personal data under 152-FZ" checkbox before submitting the form. Without this consent, submitting the form is not possible.
• Separate consent for marketing communications (Art. 18 of 38-FZ "On Advertising") — given by checking the separate optional "I agree to receive product updates by email" checkbox. The form can be submitted without this consent — in that case, the Operator contacts the User only regarding the specific request and does not send marketing/promotional emails.
• Performance of a contract to which the User is a party
• Compliance with legal obligations of the Operator (including tax and accounting)

Each of the two consents (data processing and marketing) can be withdrawn at any time — simply send a request to hello@goai.rest. Withdrawal of marketing consent does not affect the Operator's ability to contact the User about an already submitted request.

6. Processing Methods and Security

Data processing is performed using both automated and non-automated means.

The Operator implements necessary organizational and technical measures to protect personal data from unauthorized or accidental access, destruction, modification, blocking, copying, distribution, or other unlawful actions:

• Data encryption in transit via HTTPS (TLS 1.2+)
• Restricted physical and logical access to servers and databases
• Password policies and two-factor authentication
• Regular data backups
• Staff training on data protection

7. Data Sharing with Third Parties

The Operator shares personal data with third parties only in the following cases:

• Web analytics providers — Yandex.Metrika (Yandex LLC, Russia), which processes anonymized user behavior data under Yandex.Metrika Terms of Use
• Telegram — Telegram Messenger Inc.: form data is sent to an internal Telegram chat for prompt receipt of inquiries
• Operator's partners and contractors engaged in performing contractual obligations, under confidentiality terms
• Government authorities — upon lawful requests, pursuant to applicable law

The Operator does not sell User personal data to third parties for marketing or advertising purposes without explicit User consent.

8. Cross-Border Data Transfers

User personal data is stored and processed on the territory of the Russian Federation in accordance with Article 18 of Federal Law 152-FZ.

Data sent via Telegram may be transmitted to Telegram servers located outside the Russian Federation. Such transfers are carried out with the User's consent given upon form submission.

9. Retention Periods

Personal data is retained only as long as necessary for the purposes of processing:

• Contact form data — until User withdraws consent, but no longer than 3 years from the last interaction
• Data necessary to perform a contract — for the duration of the contract and 5 years thereafter (for tax and accounting purposes)
• Anonymized analytics data — according to the policies of respective services

Upon expiry of the retention period, personal data is destroyed or anonymized.

10. User Rights

The User has the right to:

• Obtain information about the processing of their personal data
• Request correction, blocking, or deletion of their personal data if it is incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the stated purpose
• Withdraw previously given consent to data processing
• Lodge a complaint with the competent data protection authority (Roskomnadzor in Russia) or in a court of law

To exercise these rights, the User may send a request to hello@goai.rest specifying their name and the nature of the request. The Operator will respond within 30 calendar days.

11. Cookies

The site uses cookies to:

• Ensure proper site functionality
• Collect anonymized statistics via Yandex.Metrika
• Remember user preferences (language, theme)

By continuing to use the site, the User agrees to the use of cookies. You can disable cookies in your browser settings, which may limit site functionality.

12. Changes to This Policy

The Operator reserves the right to modify this Policy. The current version is always available at goai.rest/privacy-en.html.

Continued use of the Service after changes constitutes User acceptance of the updated Policy.

13. Governing Law

This Policy is governed by and shall be interpreted in accordance with the laws of the Russian Federation. Any disputes arising from this Policy shall be resolved in the courts of the Russian Federation.

Last updated: June 4, 2026
Version 1.1