1. Scope and who we are
OLOSO INC, a Delaware corporation with its principal place of business at 349 5th Ave Fl 3, New York, NY 10016 (“OLOSO”, “we”, “us”), provides beverage equipment on a rental basis, beverage concentrates and related supplies, and an associated cloud platform, to restaurants, retailers and other business venues in the United States.
This Policy describes how we handle personal information in connection with oloso.ai, our online shop, our customer accounts, our sales and support activities, and the equipment and cloud platform we make available to our business customers.
OLOSO is a business-to-business company. Our customers are business entities. We do not sell beverages to the public, we do not operate the point of sale in any venue, and we are not a party to the transaction between a venue and the person who buys a drink there. If you purchased a beverage at a venue that uses OLOSO equipment, that venue — not OLOSO — is the seller and is responsible for its own privacy practices. Please contact that venue directly.
This Policy does not apply to any third-party website or service, including the hosted payment pages and electronic signature services described in Section 5.
2. Information we collect
2.1 Information you provide
| Category | What it includes | When |
|---|---|---|
| Enquiry information | Name, company, email address, telephone number, venue type, stated requirements, and any further detail you choose to add | When you submit an enquiry or request a demonstration |
| Account information | Email address or United States mobile telephone number, and a one-time verification code; optionally a store name and your marketing preference | When you create an account |
| Profile and order information | Name, display name, business name, business address book entries, language preference, order history, and equipment plan selections | When you complete a profile or place an order |
| Agreement information | The signatory’s name and email address, and the status of documents sent for signature | When you enter into a rental or other agreement |
| Support information | Correspondence, service requests and records of work performed | When you contact us for support |
2.2 Information collected automatically
Our website does not use analytics services, advertising or social-media pixels, session-recording or heat-mapping tools, or A/B testing tools. We use only two cookies, both of which are necessary for the site to function:
| Cookie | Purpose | Duration |
|---|---|---|
| oloso_locale | Remembers your language selection | 12 months |
| oloso_token | Keeps you signed in; HttpOnly and, outside local development, Secure | 7 days |
Because we set no analytics or advertising cookies, we do not display a cookie consent banner. Our hosting provider records standard server and application logs, which include IP addresses, in order to operate and secure the service.
If we later introduce analytics, advertising or session-replay technologies, we will update this Policy and implement appropriate consent controls before those technologies are activated.
2.3 Information from equipment and the cloud platform
Equipment installed at a venue, and the associated cloud platform, generate operational records including beverage counts and product mix, timestamps, ingredient and consumable levels, cleaning and sanitation records, maintenance status, diagnostic and error codes, firmware and configuration versions, device identifiers and connection information.
These records concern equipment and beverage production, not identified individuals. They become personal information only where a venue configures its own platform accounts so that an action is attributable to a named member of its staff. Where that is the case, we handle those records on the venue’s behalf and under our agreement with the venue, and the venue is responsible for informing its own personnel.
2.4 Information we do not collect
We do not receive or store full payment card numbers or card security codes (CVV/CVC). Payments are processed through Stripe Checkout. We may receive and retain limited payment-related information from Stripe, such as payment identifiers, card brand, last four digits, expiration information, payment amount and status.
We do not maintain a points-based loyalty or rewards programme, including points balances, redemption catalogues or reward accounts. We may use internal membership tiers for account and order administration and may offer promotional discounts through Stripe.
We do not maintain user wishlists, saved favourites or browsing-history profiles for marketing purposes. We may collect limited technical and operational information, such as IP addresses, URLs, request information and device or browser information, for security, troubleshooting and system administration.
Our services are intended for restaurant, equipment, ingredient and business-purchasing customers and are not directed to children. We do not request age or date-of-birth information and do not intentionally solicit personal information from individuals under 18.
3. How we use information
To respond to enquiries, prepare proposals and quotations, and arrange demonstrations
To create and administer accounts, and to verify identity when you sign in
To process, fulfil, ship, invoice and support orders, rentals and service requests
To operate and maintain the equipment and cloud platform, including recipe distribution, food-safety and cleaning controls, diagnostics and maintenance scheduling
To send you messages necessary to operate your account and perform our agreements with you, including verification codes, order and shipment confirmations, invoices, signature requests, service notices, and product safety, withdrawal and recall notices
To send you information about the OLOSO products and services you buy or use, including new flavours and recipes, new or reformulated concentrates and consumables, menu recommendations, product and platform updates, supply changes and related offers
To send you promotional information about OLOSO, including equipment offers, campaigns, events and surveys
To detect, prevent and investigate fraud, abuse, security incidents and misuse of our services
To comply with law, respond to lawful requests, exercise or defend legal claims, and enforce our agreements
To operate, evaluate and improve our products, services, recipes and operations, including through analysis of aggregated and de-identified information
With your consent, to send marketing communications; you may withdraw that consent at any time
4. Our communications; you may withdraw that consent at any time with you
Where we rely on consent — currently, marketing communications only — you may withdraw it at any time by using the unsubscribe mechanism in the We send three kinds of message or by contacting us at the address in , and you control two of them. Section 11. Withdrawal does not affect communications9 explains how
Account and transactional messages. Messages necessary to operate your account orand perform an agreement, such as verification codes, order confirmations, invoices, signature requests,our agreements with you, and product safety, withdrawal and recall notices. These are not optional while you hold an account or while an agreement between us is in force.
Product and service notificationscommunications. Information about the OLOSO products and services you buy or use. We send these to customers by default because they relate directly to the products you use. You can switch them off at any time.
Promotional communications. Offers and campaigns about OLOSO more generally, including equipment promotions. You can switch these off at any time, separately from the category above.
We honour an opt-out within 10 business days, and we keep a record of your email address afterwards for the sole purpose of not contacting you in that category again.
Text messages. We send one-time verification codes to the mobile number you register, because you provided it for that purpose. We do not send marketing or promotional text messages unless you have separately given written consent specifically for that purpose, which is never a condition of purchase and which you may withdraw at any time.
5. Service providers and disclosures
We share personal information with service providers who process it on our behalf under contract and only to provide services to us:
| Provider | Purpose |
|---|---|
| Amazon Web Services | Hosting, storage, secrets management and application logging |
| MongoDB | Primary application database |
| Amazon ElastiCache | Temporary storage of email verification codes and rate limiting for email and SMS verification-code requests |
| SendGrid | Delivery of email verification codes and transactional email and the communications described in Section 4 |
| Twilio | Delivery of SMS verification codes to United States mobile numbers |
| Stripe | Payment processing |
| DocuSign | Electronic signature of agreements |
| Carriers and logistics providers | Shipment and delivery |
| Field service providers | Installation, maintenance and repair |
Payments. Online payments are completed on a payment page hosted by Stripe. Card numbers and security codes are submitted directly to Stripe and are not received, processed or stored by OLOSO. Stripe processes that information as a controller in its own right under its own terms and privacy policy.
Signature. Agreements sent for electronic signature are processed by DocuSign under its own terms and privacy policy.
Affiliates. OLOSO is a subsidiary of TEDIA Technology. TEDIA owns or controls the cloud platform, software and certain recipe and calibration technology used in our business. A limited number of authorised TEDIA technical personnel, including personnel located outside the United States, may access platform and equipment data, and in the course of that access may encounter personal information, for the purpose of operating, maintaining, troubleshooting and supporting the platform and equipment. Access is limited to designated authorised personnel, is subject to access controls and logging, and is governed by our arrangements with TEDIA. See Section 6.
Others. We may also disclose personal information to our professional advisers; to a counterparty, acquirer or successor in connection with a financing, merger, acquisition, reorganisation or sale of assets, subject to confidentiality; and where we believe disclosure is required by law, legal process or a governmental or regulatory request, or is necessary to protect the rights, property or safety of OLOSO, our customers or others.
We do not sell personal information, and we do not share personal information for cross-context behavioural advertising, as those terms are defined under United States state privacy laws.
6. International access and transfers
We host our website, shop and application data with cloud providers in the United States.
As described in Section 5, authorised technical personnel of our parent company located outside the United States, including in China, may access platform and equipment data for support and maintenance purposes. We do not maintain routine cross-border backups of that data.
7. Retention
We retain personal information for as long as it is needed for the purposes described in this Policy, and afterwards for so long as it is required to comply with legal, tax, accounting, food-safety, warranty, audit or recordkeeping obligations, to resolve disputes, and to establish, exercise or defend legal claims.
In practice this means:
Transaction records — orders, invoices, payments, shipping records and signed agreements — are retained for the period required by applicable tax, commercial and limitation rules, which is generally longer than the life of the account.
Account information is retained while the account is active and afterwards as described above.
Enquiry information is retained while we are in contact with you and for a reasonable period afterwards for business record purposes.
Communication preferences and opt-out records are retained indefinitely, so that we can continue to honour a request not to be contacted.
Verification codes expire within minutes. Sign-in sessions expire after 7 days.
Equipment and platform records, including cleaning and food-safety records, are retained under our arrangements with the platform operator and applicable food-safety recordkeeping expectations.
Closing an account does not delete records we are required or entitled to retain, including order, invoice, tax, agreement, food-safety and security records.
8. Security
We use administrative, technical and organisational measures appropriate to the nature of the information we hold. These currently include transport encryption for sign-in credentials and for connections to our cache layer; application-layer encryption of certain personal data fields at rest; management of credentials and connection strings through a dedicated secrets manager rather than in application code; role-based access separation between customer and administrative accounts; sign-in by one-time verification code rather than a reusable password; request rate limiting; and logging of administrative actions on orders and subscriptions.
No system is completely secure, and we do not guarantee that our security measures will prevent every unauthorised access, loss, misuse or alteration of information.
9. Your choices and rights
Communications. You can switch off product and service communications, and promotional communications, independently of each other, at any time. Use the unsubscribe link in any such message, or the communication preferences in your account, or contact us at the address in Section 11. We act on a request within 10 business days. You cannot switch off the account and transactional messages described in Section 4 while you hold an account or while an agreement between us is in force; if you do not wish to receive them, you may close your account.
Text message marketing. We do not send it without your separate written consent. If you have given that consent you may withdraw it at any time by replying STOP to any such message.
State privacy rights. Depending on your state of residence, you may have the right to confirm whether we process personal information about you, to obtain a copy of it, to correct inaccuracies, to request deletion, and to opt out of sale, sharing and targeted advertising. As stated in Section 5, we do not sell or share personal information for advertising purposes. You will not be treated differently for exercising a right.
Some rights are subject to exceptions. In particular, we may retain information we are required or permitted to retain under Section 7, and we may decline a request where we are unable to verify your identity.
How to make a request. Contact us at info@oloso.ai or at the postal address in Section 11. We will acknowledge your request and respond within the period required by applicable law. Where a law permits an extension and we require one, we will tell you.
Appeals. If we decline your request, you may appeal by writing to info@oloso.ai with the subject line “Privacy Appeal”. We will inform you of the outcome and, if we again decline, of how you may contact your state attorney general.
10. Changes to this Policy
We may update this Policy from time to time. We will post the updated version with a revised “last updated” date. Where a change is material, we will provide notice by a reasonable means, which may include notice on the website or, for account holders, by email.
11. Contact
OLOSO INC
349 5th Ave Fl 3, New York, NY 10016
Email: info@oloso.ai