KitchenDrop
Privacy policy
Last updated: November 1, 2026
This policy explains what Bigyan Bashyal, doing business as KitchenDrop (“KitchenDrop”, “we”), collects when you use KitchenDrop, why, who else sees it, and how to delete it.
KitchenDrop makes social media posts and short videos for restaurants. Our customers are restaurants and the people who run them. We do not offer the service to children.
Who we are
Bigyan Bashyal, doing business as KitchenDrop, 11901 Wornall Road, Kansas City, MO 64145.
Questions about privacy: [email protected].
What we collect
Your account. Your name (optional), email address and password. We store the password only as a hash. If you verify a phone number, we keep that number. During the beta we also record which invite code let the account in. If a code was made for your address, we delete the address from the code once it has been used.
Asking for an invite. If you ask for an invite code, we keep the email address, name and restaurant name you give us, so we can answer and send the code. If you later make an account and then delete it, we delete the request with it.
Your restaurant. The name, address, city, cuisine, website, menu and prices, opening details and brand preferences you give us. We also keep what we find about your restaurant on public websites, review sites and your public Instagram account, so that your posts are accurate. The portal shows which details were found online, and saving them makes them yours.
What you send us. Photos, videos, voice notes and messages you send through the portal, WhatsApp, SMS or Telegram, plus the posts, videos and images we make from them.
Messaging numbers. The WhatsApp or phone number you give us to send and receive posts. We keep your agreement to receive messages: what you agreed to, and when. If you reply STOP, we keep a record of that so we keep honouring it.
Faces and voices (biometric data). If you or your staff choose to appear in videos, we collect a face photo and a recording of a short script read aloud. From the recording, our voice provider makes a synthetic voice used to narrate your videos. When a video shows them talking, our video provider animates the face photo, placed in your restaurant, to that voice for the few seconds they are on screen. We collect these only from someone who agrees in writing on the recording screen and confirms they are 18 or older. We use them only to make that restaurant's videos. We never sell them or use them to identify anyone. See “Faces and voices” below for how long we keep them.
Connected accounts. If you connect Instagram or TikTok, our publishing provider holds the connection; we keep its identifier. If you connect a Meta ad account for Boost, we keep the ad account ID, the page and Instagram IDs, and the access token you give us. The token is never shown back in the portal.
Billing. Stripe handles payment. We keep your plan, subscription status and Stripe's customer and subscription IDs. We never see or store your card number.
Usage. Which features you use, how many posts you make, and how many AI tokens they used, so we can enforce plan limits.
Service records. For each post we make and each message we answer, we keep a record of the steps it took: which AI and video providers were asked, how long each took, what it cost and whether it failed, with the first part (up to 2 KB) of what was sent to each AI model and what came back. We remove email addresses, phone numbers and keys from that text before we keep it. Only KitchenDrop staff can read these records, to find and fix what went wrong and to make posts better. We delete them after 30 days, and straight away if you delete the restaurant or the account. One exception: when a post went badly, staff may keep what was asked for, a summary of the plan and what went wrong (with email addresses and phone numbers removed) as a test case to check future changes against. A test case is kept until you delete the restaurant or the account.
How we use it
To make, schedule and publish your posts. To answer your messages. To bill you. To keep the service secure and working. To tell you when a post is ready or did well.
If we wrote to your restaurant before you signed up, we compare your account's email, phone number, Instagram handle and website with our record of that contact, so we know the conversation led to a signup. The match stays inside KitchenDrop, and deleting your restaurant removes the link.
We do not sell personal information, and we do not use it for advertising.
Who else sees it
We use these companies to run the service. Each sees only what its job needs.
| Company | What for | What it sees |
|---|---|---|
| Supabase | Database and file storage | Everything we store |
| Cloudflare | Connecting you to our site, delivering media, forwarding support email | Your IP address, the pages and files you load, email you send us |
| Stripe | Payments | Your email and billing details |
| Twilio | SMS, WhatsApp, phone verification, account email codes, and email to staff you invite | Phone numbers, email addresses and messages |
| Meta | WhatsApp, Instagram, Boost ads | Phone numbers, messages, posts, ad account |
| Telegram | Messaging | Chat IDs and messages |
| PostPeer | Publishing to Instagram and TikTok | Your connected accounts and posts |
| OpenAI | Writing captions and scripts, answering messages | Messages, menus, frames of footage |
| Generating video and images, and watching a public reel you send us so we can make one like it | Prompts and reference images, and the public reel you linked, which we delete once it has been watched | |
| ElevenLabs | Narration, synthetic voices and songs | Scripts, lyrics and voice recordings |
| fal.ai | Animating people in videos: lip-syncing a staff member's face photo, or a made-up character, to the video's own voice or song. Turning a photo of a dish into a short camera move around it. Cutting a dish out of its photo, when you ask for a new background behind it | A face photo placed in your restaurant, a few seconds of that voice or song, a photo of a dish, and a short description of the movement. It keeps no copy of the request, and the clip it makes expires within an hour; we keep our copy with your videos |
| Apify | Reading public Instagram pages | Public profile and posts |
| Serper | Finding restaurant locations and researching public words | Restaurant search queries and public words |
| Firecrawl, Exa | Reading public websites and menus | Public web pages |
| Google Fonts | Fonts on our pages | Your IP address when a page loads |
We may also share information if the law requires it, or as part of a sale or merger of the business, under this policy.
Cookies and browser storage
We set two cookies:
kd_session: keeps you signed in. It is required and can't be read by scripts.kd_admin_mode: used only by KitchenDrop staff.
The portal also stores your display choices in your browser's local storage: theme, filters, which panels are open, and whether you've seen the tour. These never leave your browser.
We use no analytics, advertising or tracking cookies. The trends page can embed an Instagram reel; Instagram may set its own cookies when it loads.
Faces and voices
- When they're deleted. The person can withdraw at any time from their invite link, and the restaurant can remove them from the portal. Either way, we delete the face photo, the recordings and the synthetic voice at our voice provider. Deleting the restaurant or the account deletes them too.
- How long we keep them. Until one of those happens. We keep them only while the restaurant uses KitchenDrop to make videos with that person in them.
- Consent record. We keep a record that consent was given and withdrawn, without the recording itself.
Deleting your data
You can delete your account yourself in the portal, at any time. This removes your restaurants and everything in them, your files, staff faces and voices, and your connected accounts. It also cancels your subscription. See Deleting your data for exactly what is and isn't removed.
To ask for a copy of your data, or for anything you can't do yourself, email [email protected]. We reply within 30 days.
Your rights
Depending on where you live, you may have the right to access, correct, delete or port your data, and to object to how we use it. California residents have these rights under the CCPA, and we do not sell or share personal information as that law defines it.
Security
Data is encrypted in transit. Access tokens are readable only by our servers. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.
Changes
If we change this policy, we'll update the date above. If the change is significant, we'll tell you in the portal or by email first.