Privacy

Last updated 25 October 2026

A draft for our pilot, in plain English. If anything here is unclear, email us and we’ll explain.

Arno lets people and their AI assistants read a local business’s menu, opening hours and allergens, and order from it for collection. This notice explains what personal data we collect, why, and what you can do about it.

Who we are

Arno AI Ltd (company number 17534014, registered office Flat 3, Radcliffe Building, Portpool Lane, London EC1N 7SN) is the data controller for the data described here. Contact: hello@arnoai.org.

If you order from a business

The name and phone number you give, and your note for the kitchen, are shared with the business so they can make your order, hand it over or call you.
What you ordered, when, and whether it was paid, accepted or refunded.
Card details are entered on Stripe’s payment page and never reach us or the business.
If you give an email address for your receipt, it’s passed to Stripe, who send the receipt. We don’t keep it, and the business doesn’t see it.

If you run a business that uses Arno

Your name and email address, and your password and two-factor settings (stored only in a form that can’t be read back), so you can sign in.
Your business’s details: name, address, phone, website, opening hours, menu and allergens. When you search for your business while setting up, we look it up on the web (and on Google Maps) and read your website’s menu, or the photos of it you send (which we don’t keep), for you to check.
Your Stripe account’s ID and whether it can take payments. Stripe holds your bank and identity details, not us.
A record of important changes made in your account, and who made them.

Visits to business pages

When a person or an assistant reads a business page, we record which page, when, the browser or assistant it says it is, where the link came from (for example a QR code), and a scrambled form of the internet address that changes every day and can’t be turned back into the address. We use it to stop abuse and to show the business how people and assistants find it. Business pages set no cookies; the dashboard uses cookies only to keep you signed in. We don’t use advertising or tracking cookies.

Why we use it

To provide the service a business signed up for, or the order you placed (contract).
To keep Arno secure, prevent fraud and abuse, and improve it (our legitimate interests).
To keep order and payment records for tax and accounting (legal obligation).

How long we keep it

Your name and phone number on an order: Removed 90 days after the order. The order itself (what was bought, when and for how much) is kept for 6 years, for tax and accounting.
Visits to business pages: Deleted after 90 days.
Business searches and menu reading during set-up: Deleted after 12 months.
Business accounts: While the account is open, and up to 12 months after it closes. Sign-ups that never finish setting up are deleted after 12 months.

Who we share it with

The business you order from, and the companies that run Arno for us: Supabase (our database, in London), Vercel (hosting), Stripe (payments), Resend (sending our emails), Anthropic (finding business details and reading menus) and Google (business details from Google Maps). Some of them process data outside the UK; where they do, they rely on the UK’s adequacy regulations or its approved contract clauses. We don’t sell personal data.

Your rights

You can ask for a copy of your data, or ask us to correct it, delete it, restrict or object to how we use it, or move it elsewhere, by emailing hello@arnoai.org. We reply within one month. If you’re unhappy with how we’ve handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk.

Changes

If we change this notice we’ll update the date at the top, and tell businesses by email if the change matters to them.