ARADI · PRE-LAUNCH

Your shop details stay yours.

Aradi’s public website accepts shop registration and setup requests. Signing in is required to save or view account information. This page describes how the current service uses that information.

What is saved

Aradi saves your signed-in account name and email, owner contacts, shop address, selected modules, logo, setup requests and manual payment records. After activation it can also save menu items, order details and the customer contact or delivery details you enter. Browser preferences remember only your language.

Who can access it

Each signed-in shop account can access its own shop records. The Aradi owner can review customer and shop setup, access grants, coupons, invoices and payment reports through the protected owner console. Owner actions are recorded in an activity log. Uploaded logos are available to authorised shop users and, when Aradi enables its QR ordering link, to visitors of that ordering page.

Ordering through a shop QR

Food customers verify a UK mobile number through Twilio Verify before accessing a shop menu. A permanent five-digit customer reference identifies the same mobile across Aradi shops; it is not a password. Name and delivery address are stored separately for each shop. A secure HTTP-only cookie remembers the verified customer for up to 30 days, unless they sign out. Recovery requires a new SMS verification and returns the same reference. QR orders are saved in the selected shop and may enter its connected print queue. The shop logo becomes public through an enabled ordering link. Verification requests are rate-limited; pending registration details expire after ten minutes and are removed during later requests. Optional AI ordering sends microphone audio to OpenAI after consent; the QR voice flow does not save a transcript. Aradi stores order details and call status for the shop workflow. Contact the shop or Aradi to request corrections or deletion.

Payment information

Aradi does not collect card credentials. Revolut payment happens on the external owner-provided link. Aradi stores the requested amount, code discount, reference, customer payment report and owner review result. It has no automatic connection to the owner’s bank balance or Revolut transactions.

Storage and sign-in

Customers can register a username and password with their shop request, or use an existing customer account. Passwords are stored as one-way salted verifiers, never as readable text. Customer sign-in uses a secure HTTP-only cookie lasting up to 90 days unless signed out or revoked. New registrations remain pending until activation. Contact email is not automatically verified and email delivery is not yet connected. Existing Sites-managed ChatGPT sign-in remains available for authorised accounts. Structured information is stored in Cloudflare D1 and logos in R2. Invitations do not send email automatically. Contact Aradi about corrections or data requests before entering real customer information.

Shop teams and voice conversations

Activated shops store their own menu, orders, agent rules and selected-module records separately. Authorised staff can access only the shop and functions granted by their role. Team invitation codes do not send email automatically and can be claimed only by the named signed-in email.

When you start a browser voice test and allow the microphone, audio is sent to OpenAI to provide the conversation. The agent receives this shop’s menu, public shop identity and conversation rules. Customer history is available to the agent only when that module is selected and the customer details are verified during the call. Aradi does not store raw audio. Call time, status and a limited operational summary are stored. Saving conversation text requires both the shop setting and permission for that call; retained text is limited to 30 days and older text is cleared when call records are next used.

Windows Print Bridge

A shop owner or authorised manager can create separate print-device credentials and revoke a device from the print queue. These credentials give access only to that shop’s print jobs; they are not a customer or administrator password. The server stores one-way verifiers and connection records such as the device name, printer name, app version and last contact time. The Windows application uses the Windows account’s encrypted storage for its connection token. Receipts sent to the selected printer include the order and the customer details needed for fulfilment. The bridge keeps a limited local delivery ledger to recover interrupted work without automatically printing a second copy. A Windows submission confirms submission to the print system, not that paper came out.

Android Print Bridge

The Android app uses the same shop-scoped print credentials and server connection records. Its connection data and delivery ledger are encrypted with Android Keystore-backed storage, with application backup disabled. Automatic thermal or supported direct IPP printing sends receipt data to the local printer address you choose and uses a visible, user-started foreground service. No location permission is needed. The separate A4 test opens Android’s print dialog; the selected print service handles that synthetic document. A transport submission does not confirm physical paper output.

Driver shifts and location

The separate Aradi Driver app registers a driver name, mobile, vehicle and optional plate with a shop. Approved drivers consent to location sharing when scanning the shop QR to start a shift. During that shift, the shop can see reported GPS position, accuracy, approximate speed, routes, delivery times and mileage. Sharing is rejected by the server after the driver or manager ends the shift or its daily cutoff is reached. Ending a shift stops tracking, not the phone app process.

Only the customer for an outbound delivery can see that driver’s current position. It is not shared with customers after delivery or while returning to the shop. Map tiles come from OpenStreetMap: the tile service receives requested map areas and connection information, while driver names, order receipts and route overlays remain in Aradi. Raw GPS routes and last coordinates use the shop’s retention period (default 30 days) and are purged when the driver or manager service is next used. Aggregated delivery, shift and pay records remain for reporting.

Android protects its driver connection with Android Keystore; iPhone uses device-only Keychain. Device backups are disabled for the Android app. Driver QR camera images are processed on the phone and are not uploaded. The optional browser test stores its connection in local browser storage and needs a visible page for GPS. Native background location and notifications depend on phone permissions, reception, battery settings and the configured delivery service.

Owner sign-in

The owner console requires the authorised owner account and a separate administrator password. A salted password verifier and expiring session records are stored server-side. Your chosen password is not stored as plain text.

Owner access report

On an unremembered browser, administrator sign-in offers either an explicit location check or an explicit choice to remember a personal browser after verification of the owner account and current admin password. A remembered browser skips location only; the owner account and password remain required. The access report records the server-observed connection IP when available, attempt time and outcome. If location permission is granted, it also records the browser-reported latitude, longitude, accuracy and capture time. Denied or unavailable location is recorded without coordinates.

Remembering a personal browser stores a secure, HTTP-only random token in that browser for a fixed 30 days and a hashed verifier with its optional name and dates on the server. It does not identify hardware or rely on a fixed IP. Remembered browsers can be removed under Security, which ends their linked admin sessions. Changing the admin password removes all remembered browsers. Signing out ends the admin session but keeps the browser remembered until expiry or removal.

Only the verified Aradi owner with an authenticated administrator session can view this report. The report covers up to 30 days and the latest 5,000 entries; older records are cleaned up when access logging or the report is used. IP addresses may reflect a VPN or intermediary, and browser coordinates are not verified proof of identity. Passwords are never included in the access log. There is no continuous location tracking or automatic sharing with a map provider.

Google Maps display

When Google Maps is enabled by Aradi, delivery maps use Google Maps to display shop pins and driver positions during an active shift. Google receives the information needed to provide the map, including the map area and normal browser connection information. Route calculations, traffic estimates, geocoding and in-app Google navigation are not connected in this version. Recorded driver distances remain based on Aradi GPS records.

Google Maps Additional Terms · Google Privacy Policy

Customer destination pins

When address pins are used, the delivery address and postcode are sent to Google Geocoding to find a map position. Customer names and telephone numbers are not included in that lookup. Approximate results require staff confirmation. The shop can correct a destination pin manually. Google-derived coordinate cache entries expire after 30 days; active delivery views remain limited to the assigned shop and driver.