Privacy Policy
Privacy practices for Penny business users and end customers · INCYTE WORKS L.L.C.
Effective date: October 4, 2026 · Version 2.0
1. Scope
This Privacy Policy explains how INCYTE WORKS L.L.C. ("Incyte Works," "we," "us," or "our") collects, uses, discloses, and protects personal information in connection with Penny, including https://penny.incyte.works/, related web pages, voice interactions, messaging, administrative tools, integrations, and support services (collectively, the "Service").
This Policy applies to: (a) owners, managers, staff, and other authorized users of businesses that use Penny ("Business Users" or "Clients"); and (b) individuals who interact with those businesses through Penny ("End Customers").
2. Roles and Responsibilities
For Client account and billing information, Incyte Works generally determines how and why that information is processed. For End Customer information processed through Penny on behalf of a Client, the Client generally determines the business purpose of the interaction and Incyte Works acts as a service provider or processor, subject to applicable law. In some circumstances, applicable law may characterize these roles differently.
3. Information We Collect
3.1 Business User and Account Information
- name, business name, role, email address, and phone number;
- login and authentication information, including verification records and device/session information;
- account preferences, language, time zone, notification settings, and support communications;
- billing status, subscription identifiers, Plan information, and transaction references received from payment processors; and
- technical information such as IP address, browser/device information, timestamps, login attempts, audit logs, and error logs.
3.2 Business and Configuration Information
- restaurant or food-service business name, location, phone number, hours, menu, prices, categories, modifiers, dietary or allergen tags, and operational notes;
- pickup/delivery configuration, delivery areas, fees, timing, reservation policies, handoff numbers, and AI Agent instructions;
- files voluntarily uploaded by the Client, such as menu photos or PDFs; and
- integration configuration and identifiers for supported point-of-sale, reservation, telephony, messaging, or other connected services.
3.3 End Customer Information
- phone number or other messaging identifier;
- name, if provided during the interaction;
- a text transcript of the conversation with Penny;
- order details, including items, modifiers, notes, price, pickup or delivery information, delivery address and postal code where applicable, and requested or promised time;
- reservation details, including party size, date, time, notes, and related information;
- customer-service requests, requested links, confirmations, reminders, and message content where messaging is enabled; and
- technical identifiers associated with a call, message, order, or reservation for security, support, and traceability.
3.4 Voice Calls and Transcription
Penny does not record or store audio recordings of voice calls as part of the Service.
During a call, audio is processed in real time by telecommunications, speech-recognition, speech-synthesis, and artificial-intelligence service providers as necessary to operate the voice interaction. Penny generates and stores a text transcript of the conversation.
Transcripts may be used to provide and operate the requested interaction; create or troubleshoot orders and reservations; provide Clients with summaries and interaction history; investigate customer-service issues or disputes; monitor and improve service quality; perform quality assurance; identify errors, failures, security issues, or misuse; and improve the accuracy, reliability, and performance of Penny.
Although Penny does not intentionally store call audio, audio may transit or be temporarily processed through third-party provider systems while the interaction is occurring. Those providers may maintain technical logs or other data under their own contracts and policies. We configure providers where reasonably available to minimize retention that is not needed to provide the Service.
3.5 Payment Information
Payment-card and sensitive payment-method information may be collected directly by Stripe or another authorized payment processor. Incyte Works generally receives customer, subscription, transaction, and payment-status identifiers rather than full card numbers.
4. How We Collect Information
- directly from Clients and Business Users when they register, configure, use, or support an Account;
- automatically during calls, messages, sign-ins, and use of the Service;
- from files or information a Client uploads or connects;
- from End Customers when they speak, text, order, reserve, or otherwise interact through Penny; and
- from service providers and integrations used to provide the Service.
5. How We Use Information
We may use personal information to:
- operate the AI Agent and provide calls, messages, orders, reservations, and related workflows;
- authenticate users, send security or verification codes, and protect Accounts;
- process billing and subscriptions;
- provide customer support and troubleshoot technical or operational issues;
- create call summaries, interaction history, and operational analytics for Clients;
- perform quality assurance, evaluate accuracy, detect failed interactions, and improve the Service;
- maintain security, prevent fraud and abuse, and enforce our Terms;
- comply with legal obligations and respond to lawful process;
- develop new features and improve models, workflows, prompts, or automation using information in a manner consistent with this Policy; and
- send Business Users product updates or marketing communications where permitted, subject to applicable opt-out rights.
We do not use End Customer mobile numbers or SMS opt-in information for third-party advertising, and we do not sell End Customer personal information.
6. SMS, Messaging, and Consent
6.1 Types of SMS Messages
Penny may send SMS messages for account authentication and security codes and, where enabled and appropriately consented to, requested links, customer-service interactions, order or reservation confirmations, status updates, reminders, or other transactional communications associated with a Client.
6.2 Message Frequency and Carrier Charges
Message frequency varies based on the user's activity, the applicable messaging program, and the communications requested or triggered by the interaction. Message and data rates may apply.
6.3 Mobile Information and Non-Sharing
Mobile phone numbers, SMS opt-in information, and messaging consent are not sold, rented, transferred, or shared with third parties or affiliates for their own marketing or promotional purposes.
We may disclose mobile information to telecommunications carriers, messaging providers, infrastructure providers, fraud-prevention providers, and other service providers solely as necessary to deliver, secure, support, or operate the messaging service, or as required by law. Those providers may not use SMS opt-in data or consent for their own marketing or promotional purposes on our behalf.
6.4 Consent Is Purpose-Specific
SMS consent is used only for the messaging program and purpose for which it was provided. Consent to receive transactional or service-related messages does not constitute consent to receive promotional or marketing messages. Marketing consent, where required, must be obtained separately. Consent is not a condition of purchasing goods or services.
6.5 STOP and HELP
Recipients may reply STOP to unsubscribe from applicable SMS messages and may reply HELP for assistance. After a valid STOP request, Penny may send one confirmation message. For additional assistance, contact info@incyte.works.
6.6 Verification / OTP Consent Records
When Penny sends a one-time password or verification code by SMS, the user must have requested or consented to receive that message as required by applicable rules. Penny or the applicable Client may retain evidence of the consent event, including the telephone number, timestamp, source, and consent language, for compliance, security, and audit purposes.
7. Cookies and Similar Technologies
Penny may use session cookies, security cookies, remembered-device identifiers, local storage, or similar technologies that are necessary to authenticate users, maintain sessions, remember preferences, prevent fraud, and operate the Service. Third-party authentication providers, such as Google, may set their own cookies when their sign-in services are used.
We also use Google Analytics, loaded through Google Tag Manager, on the Penny sign-in page and web application to understand how the Service is used and to improve it. These tools may set cookies or similar identifiers and collect information such as pages visited, interactions, approximate location derived from IP address, and browser and device information. This information is processed by Google under its own terms and privacy policy. We do not use it to advertise to End Customers. If we introduce other non-essential analytics or advertising technologies, we will update this Policy and provide any notice or consent required by applicable law.
8. How We Disclose Information
We may disclose personal information in the following circumstances:
- to service providers and subprocessors that perform telecommunications, messaging, speech recognition, speech synthesis, AI processing, hosting, email delivery, authentication, payments, support, security, or integration services;
- to the relevant Client, including its authorized Business Users, for interactions involving that Client;
- to connected point-of-sale, reservation, or other services at the Client's direction;
- to professional advisers, auditors, insurers, or financing sources subject to appropriate confidentiality obligations;
- in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of the business, subject to applicable law; and
- when required by law, subpoena, court order, governmental request, or when reasonably necessary to protect rights, safety, security, or prevent fraud or abuse.
We do not sell mobile phone numbers, SMS opt-in data, or SMS consent information, and we do not share them with third parties or affiliates for their own marketing or promotional purposes.
9. Service Providers and Subprocessors
Penny may use the following categories of service providers. Providers may change as the Service evolves.
| Provider / Category | Role | Typical Data Processed |
|---|---|---|
| Twilio / telecommunications and messaging | Inbound voice transport, call signaling, SMS delivery, and related communications | Phone numbers, call audio in transit, message content and metadata, technical communication identifiers |
| Speech recognition provider (e.g., Deepgram) | Convert speech to text in real time | Call audio in real time and resulting transcription data |
| Speech synthesis provider (e.g., ElevenLabs) | Convert Penny responses to spoken audio | Text of generated responses and related technical metadata |
| AI model provider (e.g., Anthropic) | Interpret conversations, generate responses, and assist with supported AI features | Conversation text/transcripts, prompts, relevant business context, and uploaded menu content when used |
| Stripe or other payment processor | Payment processing and subscription billing | Payment-method information, billing identifiers, transaction status |
| Google Analytics (through Google Tag Manager) | Usage analytics for the Penny sign-in page and web application | Pages visited, interactions, cookie identifiers, approximate location derived from IP address, browser and device information |
| Google Identity Services | Optional Google sign-in | Verified account identifier and email address |
| Email delivery provider | Authentication codes, notices, password recovery, and operational email | Email address and message content |
| Cloud infrastructure provider | Hosting, storage, databases, security, and application infrastructure | Information stored or processed by the Service |
| Connected POS / reservation / business integrations | Carry out Client-requested workflows | Order, reservation, business, and integration data as necessary |
10. Aggregated and De-Identified Information
We may create aggregated or de-identified information that cannot reasonably be used to identify a particular person. We may use such information for analytics, benchmarking, quality assurance, product development, service improvement, and business reporting. We will not attempt to re-identify information that we maintain as de-identified except as permitted by law for testing or validating de-identification methods.
11. Data Retention
We retain information for as long as reasonably necessary to provide the Service, maintain account and transaction records, perform quality assurance, support Clients, resolve disputes, prevent fraud, enforce agreements, comply with legal obligations, and maintain appropriate business and security records.
Retention periods vary by data type and context. Account and business information may be retained while an Account is active and for a reasonable period afterward. End Customer transcripts, order information, reservation information, and messaging content may be retained for the period necessary to support the Client relationship, quality assurance, dispute handling, legal compliance, and operational needs. Certain security records and verification codes may be retained for shorter periods. Backup copies may persist for a limited additional period before deletion or overwrite.
A Client may request deletion of data, subject to legal obligations, fraud prevention, security needs, contractual rights, backup cycles, and other lawful retention requirements.
12. Information Security
We use reasonable administrative, technical, and organizational safeguards designed to protect information, which may include encrypted network connections, access controls, authentication controls, password hashing, signed requests, logging, monitoring, and provider security controls. No security measure is perfect, and we cannot guarantee absolute security.
13. International Data Transfers
Penny and its service providers may process information in the United States and other countries. These locations may have data-protection laws different from those in the place where the Client or End Customer is located. Where required, we use appropriate contractual or legal mechanisms for cross-border data transfers.
14. Privacy Rights
Depending on applicable law and location, individuals may have rights to request access, correction, deletion, portability, restriction, or objection regarding personal information, or to appeal certain privacy decisions. Some rights are subject to exceptions.
Business Users may contact info@incyte.works to submit a privacy request. End Customers whose information Penny processes on behalf of a Client should generally contact the relevant restaurant or business first, because that Client may control the business purpose and context of the data. We may assist the Client in responding where required.
15. Children's Privacy
The Service is intended for business use and is not directed to children as account holders. We do not knowingly permit minors to create administrative Accounts. End Customers may include people of different ages, and Penny generally cannot verify a caller's or texter's age during a normal restaurant interaction. If we learn that information was collected in a manner prohibited by applicable children's privacy law, we will take appropriate steps.
16. Marketing to Business Users
We may send Business Users information about Penny products, features, or offers where permitted by law. Recipients may opt out of marketing communications through an unsubscribe mechanism where provided or by contacting us. Operational, billing, security, and account notices are not marketing messages and may continue as necessary to provide the Service.
17. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. If a change materially affects privacy practices, we will provide reasonable notice through the Service, by email, on our website, or another reasonable method. The "Effective date" above identifies when this version became effective.
18. Contact
Questions or privacy requests may be sent to info@incyte.works.
Privacy Policy:
https://penny.incyte.works/privacy-policy
Terms & Conditions:
https://penny.incyte.works/terms-and-conditions