Privacy Policy

How Crave Up Inc., operating Nomly, collects, uses and shares personal information.

  1. 1. Scope and Who We Are

    This Privacy Policy describes how Crave Up Inc. (“Crave Up,” “Nomly,” “we,” “us,” or “our”) handles personal information when you visit nomly.ai, request information, book or use a demo, or use Nomly's restaurant software and related services.

    Nomly is a personal AI assistant for restaurant operators. Operators connect tools and provide information for their restaurant workspace. Where the restaurant determines why workspace information is processed, we process it on the restaurant’s behalf. Contact the restaurant first about information it has provided to Nomly.

    Our text messaging program works differently. We decide to offer it, we write the messages, we set the wording used to ask for consent, and we send from a number we control. For that program we act as the controller rather than on a restaurant's behalf. Section 7 describes it.

  2. 2. Information We Collect

    Depending on how you interact with Nomly, we may collect:

    • Contact and business information, such as name, work email, phone number, role, restaurant name, location count, and messages you submit.
    • Account and service information, such as credentials, workspace settings, menus, hours, integrations, support requests, and records of actions taken in the Service.
    • Assistant information, such as messages, uploaded documents, conversation history, and information retrieved from connected tools within the permissions you grant, including email and restaurant business records.
    • Messaging setup information, such as the mobile number you link, verification and consent timestamps, workspace association, and opt-out status.
    • Website and device information, such as pages viewed, referring URL, browser and device type, approximate region, and diagnostic or security events.
    • Campaign attribution, limited to standard UTM source, medium, campaign, term, and content values and the landing page for the current browser session.

  3. 3. How We Use Information

    • For content collected after this revised policy takes effect for your account, we may use eligible assistant conversations and feedback to evaluate, fine-tune, and train the models that power Nomly, unless you opt out. This permission does not apply to Google API data or content derived from it, data subject to another provider’s restrictions, or data collected under an earlier promise requiring explicit opt-in. Those restrictions continue to apply.
    • You may opt out of model training by emailing privacy@nomly.ai with the account and restaurant workspace concerned. An authorized workspace administrator may request a workspace-wide opt-out. Opting out applies to future training use of eligible content, including previously collected content not yet used for training. It does not undo training already completed. We may still use content-free operational telemetry and aggregated or de-identified metrics to improve reliability.
    • Even if you opt out, we may review content specifically flagged for suspected abuse or security incidents and, where permitted, use the minimum necessary eligible content to improve abuse-detection and security models. This exception does not permit general assistant training, override Google-data restrictions or earlier consent promises, or authorize third-party providers to train their own general-purpose models.
    • Provide, personalize, secure, troubleshoot, and support the Service and demos.
    • Answer inquiries, schedule sales conversations, and communicate about requested services.
    • Answer operator questions, summarize connected information, prepare drafts, and deliver configured briefs and alerts when those features are enabled.
    • Understand campaign performance and improve reliability and customer experience, subject to the training choices and data-source restrictions described in this Policy.
    • Detect misuse, enforce our terms, comply with law, and protect people, restaurants, Nomly, and others.

  4. 4. How We Share Information

    We may share personal information with these categories of recipients:

    • The restaurant or business that uses Nomly and its authorized users.
    • Service providers that help us host, secure, analyze, communicate, schedule meetings, operate AI or messaging, deliver support, and process information on our behalf.
    • Integration partners when you or a restaurant directs us to connect the Service to a third-party system.
    • Professional advisers, authorities, or other parties when reasonably necessary for legal compliance, safety, fraud prevention, or the protection of rights.
    • A buyer, investor, lender, or successor in connection with a financing, reorganization, merger, acquisition, or sale of assets, subject to appropriate safeguards.

    We do not sell personal information for money. We do not use the current Nomly marketing site for cross-context behavioral advertising. If those practices change, we will update this Policy and provide any choices required by law.

  5. 5. Analytics, UTM Parameters and Browser Signals

    We use Vercel Web Analytics to understand aggregate site use and custom conversion events. Our attribution feature stores standard UTM campaign values in session storage so they persist while you navigate this site, sends those values with a contact-form submission, and forwards them to Cal.com when you open our booking experience. We do not put names, email addresses, phone numbers, or free-form messages in analytics events.

    Browser “Do Not Track” signals are not governed by a uniform standard, and our site does not currently respond to them. You can limit storage through your browser settings. Where legally required, we will honor applicable opt-out preference signals for practices covered by those signals.

  6. 6. Connected Tools and Sensitive Information

    Connected-tool access depends on the integrations you enable, the permissions you grant, and your workspace access. Disconnect integrations you no longer want Nomly to use. Nomly’s current product does not provide voice calling or call recording.

    Please do not include full payment-card numbers, government identifiers, or other unnecessary sensitive information in messages, documents, or connected content.

    When you connect Gmail, Nomly requests read-only access to support the email features you enable. This connection does not authorize Nomly to send email or change your mailbox. Relevant message content and metadata may be processed by our AI and infrastructure service providers to answer your requests or provide configured features.

    Our use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy and the Google Workspace API User Data and Developer Policy, including their Limited Use requirements. We do not use raw or derived Google API data to train or fine-tune shared or general-purpose AI models, for advertising, or for sale to data brokers. We do not authorize AI providers to use this data for their own training or secondary purposes.

    Human access to Google API data is limited to the circumstances permitted by those policies, such as your affirmative agreement to view specific messages, necessary security investigations, legal obligations, or permitted aggregated and anonymized internal operations. The safety exception in Section 3 does not expand those permissions.

    You can disconnect Gmail in Nomly or revoke access through your Google account permissions. Disconnecting in Nomly stops that connection and triggers removal or redaction of connector-derived automation outputs and queued brief content. Disconnecting is not a request to delete your entire Nomly account or all conversation history. Contact privacy@nomly.ai to request deletion of other retained information, including copied content or conversation history.

  7. 7. Text Messages

    Nomly sends transactional text messages only. We do not send marketing or promotional text messages.

    When SMS is available for their workspace, operators can consent in the Nomly app and link their mobile number by sending a verification message. Linked operators can text the assistant about their restaurant’s connected tools. Operators may also enable supported briefs and alerts separately; linking a phone does not enable every automation.

    • We do not sell, rent, or share mobile phone numbers or text-message opt-in information with third parties for their own marketing purposes.
    • We share mobile numbers and necessary message information with service providers that deliver and support our messaging service.
    • Message frequency varies with your conversations and the briefs or alerts you enable.
    • Message and data rates may apply.
    • Reply STOP to opt out or HELP for help. STOP disconnects your linked phone and stops operator messages to that number. You can also contact us through nomly.ai/contact.

    We store phone-linking and messaging subscription records, including consent timestamps and opt-out status. We retain these records as needed to operate the service, evidence consent, and meet legal obligations.

  8. 8. Retention

    We retain personal information for as long as reasonably necessary to provide the Service, meet contractual commitments, maintain security and audit records, resolve disputes, and comply with law. Retention varies by information type, workspace settings, and legal requirements. Demo data may be shorter-lived than production account data. We may retain de-identified information that no longer reasonably identifies an individual.

  9. 9. Security and International Processing

    We use administrative, technical, and organizational safeguards designed to protect personal information. No system is completely secure, and we cannot guarantee absolute security.

    We and our service providers may process information in the United States and other countries. Where required, we use safeguards intended to support lawful transfers.

  10. 10. Your Choices and Privacy Rights

    Depending on where you live and subject to applicable exceptions, you may have rights to request access, correction, deletion, or a copy of personal information; to object to or restrict certain processing; or to appeal a request decision. You may opt out of marketing email by using the unsubscribe link in the message.

    • Email a request to privacy@nomly.ai
    • Describe your relationship with Nomly and the information involved so we can locate it.
    • We may verify your identity and authority before completing a request. Authorized agents may submit requests where applicable law permits.

  11. 11. Children

    Nomly is a business service and is not directed to children under 13. We do not knowingly collect personal information from children under 13 through the site. If you believe a child has provided such information, contact us so we can review and delete it as appropriate.

  12. 12. Changes to This Policy

    We may update this Policy as our practices or legal requirements change. We will post the revised Policy with a new last-updated date and provide additional notice when required by law.

  13. 13. Contact Us

    For privacy questions or requests, contact:

    Crave Up Inc. operates Nomly.