Pinoli helps you find restaurants, bars, cafes and their daily specials. This policy explains what we collect, why, and what we'll never do with it — in plain language, because that's the only kind we trust ourselves to keep to.
Pinoli is made by Soufra AI Pty Ltd (ABN 88 700 592 203), based in Sydney, Australia. Our servers and database run in Google Cloud's Sydney region. Some of the services we rely on process data overseas — each one is named below. For anything in this policy: help@pinoli.app.
The front page of pinoli.app asks for your email address and whether you're on iPhone or Android, so the launch email can lead with the right store. Nothing else. We record that you agreed to be emailed, the wording you agreed to, and the date.
We use it for two emails at most: one when Pinoli launches, and maybe one before that with the date. Entries are stored in our database in Sydney, apart from the app's accounts, and a sign-up pings our own Slack without your address in the message. We delete your entry once the launch email has gone out, unless that email asks whether you'd like to keep hearing from us and you say yes. Sooner if you ask: email help@pinoli.app and it's done.
Pinoli is in beta, and pinoli.app/beta-signup is where you can put your name down. We ask for your name, your email address, and whether you're on iPhone or Android — and nothing else. No phone number, no address, no suburb. We ask about the phone because getting you into the beta is a different process on each. We also record that you agreed to be emailed, and the date you agreed.
We use it for one thing: to email you if there's a place for you, and to send the odd short survey while the beta runs. If you join, we may ask whether you'd like to be in a WhatsApp group for updates — that's optional, and we'd only ask for a mobile number at that point, never at sign-up.
Waiting-list entries are stored in our database in Sydney and are kept apart from the app's accounts — joining the list doesn't create one. When someone signs up we get a notification in our own Slack so we can act on it; we don't put your address in that message.
We delete your entry when Pinoli opens to everyone, or a year after you signed up — whichever comes first. Sooner if you ask: email help@pinoli.app and it's done. We won't use the list for anything else, and we won't add you to any other mailing list without asking.
When you first open Pinoli, we create a private account identified only by a random ID, so your shortlist and preferences work before you've told us anything about yourself. It contains no name, email, or anything that identifies you.
If you sign in with Apple or Google, we receive your name, email address and (from Google) profile photo from them, and link them to that same account so nothing you've saved is lost. Soon, you'll also be able to sign in with just your email address: we'll send a one-time sign-in link to it, and that will be the whole process. However you sign in, we never see or store a password — there are none in Pinoli. Sign-in is handled by Firebase Authentication, Google's identity service.
If you use the Concierge to book a table, you can add your first name, last name and mobile number so a venue can confirm the booking. That's the only reason we ask for a phone number, and it's always optional until you make a booking.
You can also tell us your tastes — preferred cuisines, dietary requirements, the kind of night you're usually after — and a home suburb. These shape your recommendations and are stored with your account.
Location is what makes Pinoli useful, and we've kept its footprint small:
You can use all of Pinoli by picking a suburb by hand instead — the app never requires your GPS location.
The Concierge is an AI assistant. When you use it, your typed or spoken message, along with the recent conversation, your selected suburb and the local time, is processed by Google's Gemini models (Vertex AI) and OpenAI's GPT models to produce an answer. If you speak, the audio recording itself is sent to Google for the AI to understand, and never to OpenAI; we never use your voice to identify you. What you said can reach OpenAI later as part of the recent conversation, as text.
We keep Concierge conversations and review them to make it better — what was asked, what it answered, and where it fell short. Conversations are kept unlinked from your name and email (they're tied to the same random account ID as our analytics), we don't use them to build a profile of you or to advertise, and they're never shared beyond the AI services that power the feature. Please don't put things in the chat you wouldn't want reviewed — it never needs your personal details except when you're making a booking.
Many venues take bookings through their own provider (for example GloriaFood or Obee). When you book that way, the form you fill in belongs to that provider — your name and contact details go directly from your device to them, not through our servers, and their privacy policy applies. We pass along only the date, time and party size you picked, to save you re-typing them.
Some venues only take bookings by phone. If you ask, the Concierge can call the venue on your behalf using an AI voice agent operated through ElevenLabs, a US-based service. To place that call we share your booking details with ElevenLabs and, through the call itself, with the venue: your name, your mobile number (so the venue can reach you), party size, date and time, and any dietary requirements or seating preferences you've given. We keep a record of the booking and a summary of how the call went, so you can see the outcome and we can fix it when something goes wrong. These records are kept for 3 months, then deleted.
If you snap a special and share it with us, the photo is stored in our cloud storage and analysed by AI to read the deal and add it to Pinoli for everyone. Please don't include people in these photos — they're for menus and specials boards.
We use PostHog, an analytics service hosted in the United States, to understand how Pinoli is used — which screens are opened, what gets starred, what people search for, where onboarding loses people. This is tied to your random account ID, never to your name or email.
We also record session replays — a reconstruction of taps and screens from a visit — to find confusing flows and bugs. Anything you type is masked before it leaves your device. Concierge conversations appear on screen as part of the app, and reviewing them is covered in "Talking to the Concierge" above.
We don't use advertising networks, tracking pixels, or cross-app identifiers, and nothing about you is ever sold or shared for advertising.
If you turn notifications on, we store a push token for your device — a random address for delivering notifications, issued by Expo's push service. Turn them off and we discard it. Pinoli currently sends no marketing email — we don't even have your email on a mailing list.
| Service | What they process | Where | Why |
|---|---|---|---|
| Firebase Auth (Google) | Sign-in identity: email, name | Global (Google) | Signing you in without passwords |
| Google Vertex AI (Gemini) | Concierge messages and voice audio | Global (Google) | Answering your Concierge requests |
| OpenAI (GPT) | Concierge messages and the recent conversation, as text; never voice audio | United States | Answering your Concierge requests |
| PostHog | Usage events, session replays, random account ID | United States | Improving the app |
| Mapbox | Approximate coordinates | United States | Maps and travel times |
| ElevenLabs | Booking details, only when you ask us to phone a venue | United States | Placing the call |
| Slack | Reports and feedback you send us, incl. Concierge conversations you choose to share; beta sign-up notifications (name only, not your address) | United States | Getting your reports in front of us so we act on them |
| Google Cloud | Everything above in transit; our database | Sydney, Australia | Hosting Pinoli |
Each of these processes data on our instructions to run a feature you can see. None of them may use your data for their own advertising, and we share nothing with data brokers — ever.
We keep your account data for as long as you have an account. You can delete your account any time in Profile → Delete account. That permanently erases your account, your shortlist and your taste preferences across every device, and removes your sign-in identity from Firebase. It takes effect immediately — there's no grace period and no "deactivated" state.
A few things live on briefly or separately:
To have anything else removed, email help@pinoli.app and we'll handle it.
When someone opens a Pinoli share link (pinoli.app), our server briefly logs the visitor's IP address to prevent abuse and count views. These logs aren't joined to app accounts.
The beta sign-up page counts sign-up attempts per IP address for an hour at a time, so the form can't be flooded. That count is a one-way fingerprint, not a stored address. The page also measures page views and whether the form was started, through PostHog — the same service named above, and with no name or email address attached.
Pinoli is made for adults deciding where to eat and drink, and isn't directed at children. It's not intended for use by anyone under 16.
You can ask us what we hold about you, ask us to correct it, or ask us to delete it — email help@pinoli.app and we'll respond within 30 days. We handle personal information in line with the Australian Privacy Principles. If you're not happy with our answer, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).
If we change what we collect or who we share it with, we'll update this page and change the date at the top before the change takes effect. We won't quietly widen anything.