Version of 12 November 2026. Effective: on the day the cenaly.ge service opens for sign-up and data intake; the opening date will be published on this page.
Until the service opens, the cenaly.ge website and the admin.cenaly.ge interface work as an information showcase: sign-up, sign-in for new accounts and forms that collect personal data are closed. What the showcase processes today is described in section 2.
This Policy explains how Individual Entrepreneur ANDREI VERBITSKII (Identification Number 305573448) ("we", "us", "our") processes personal data when operating the Cenaly service under the cenaly.ge brand and domain — the website, the administrative and customer-facing interfaces, the API and the mobile apps when used with a cenaly.ge account (together, the "Service"). The platform's general Privacy Policy applies to the other brands of the platform (cenaly.com, meni.ge, cenaly.tr and others); for cenaly.ge this edition replaces it.
We process personal data in accordance with the Law of Georgia "On Personal Data Protection" of 14 June 2023, No. 3144 (the "Law"), and the regulations of the State Audit Office of Georgia.
Where the data is — in short. Data of cenaly.ge accounts is stored and processed in Germany, in the AWS eu-central-1 region (Frankfurt): storage, the API, sign-in, messaging, e-mail and all other processing. Germany is on the list of countries with appropriate data protection safeguards approved by Order No. 007 of the Auditor General of the State Audit Office of 14 April 2026. There are two exceptions. Artificial intelligence features (speech recognition, language models, generation): some AI providers are located in countries outside the list, including the United States; such features are enabled only after your separate written consent under Article 37(2)(d) of the Law, and only the minimum of data is sent to them (section 6a). Push notifications of mobile apps and browsers can only be delivered through the notification services of the device or browser maker (Apple, Google and others) located in the United States; they are sent only after you allow notifications and give a separate written consent under the same article, and contain the minimum of data (section 6b). Without these consents no data leaves Germany (section 7).
Language: the primary language of the website is Georgian; the English, Russian, Turkish, Chinese and Arabic translations are provided for convenience. If you notice a discrepancy between the language versions, please tell us and we will fix it; a discrepancy is interpreted in favour of the data subject.
Individual Entrepreneur ANDREI VERBITSKII
Registered in Georgia
Identification Number: 305573448
Registered address: Georgia, Tbilisi, Vake district, s. Chikovani street, N 24a, hall 2, flat N36a
Data protection e-mail: info@meni.ge
When we are the controller. We determine the purposes and means of processing the data needed to run cenaly.ge accounts, our relationship with owners and users of business accounts, billing, support, the security of the Service, and to comply with our obligations under Georgian law. For these purposes we are the "controller" (the person responsible for processing) within the meaning of the Law.
When we are the processor. Businesses (restaurants, shops, salons, hotels and other customers) keep in the Service the data of their customers and guests, staff, orders, bookings, calls, correspondence and documents. The business determines the purposes and means of that processing: it is the controller, and we are its processor under Article 36 of the Law, acting on its documented instructions under the cenaly.ge Data Processing Agreement (published at cenaly.ge/legal/dpa and forming part of the Terms of Service).
If your question concerns data kept by a business (for example, your data as a restaurant guest or as an employee), please contact that business first. You may also contact us: we will help identify the responsible person and help them respond.
Until the service opens, on cenaly.ge and admin.cenaly.ge:
If you write to us at the address in section 1, we process your message in order to reply (Article 5(1)(k) of the Law).
What we process depends on the features used by you or by the business.
We do not ask for and do not knowingly collect special category data (Article 6 of the Law), except where a business itself keeps such data in the Service (for example, a medical clinic) — in that case the business is responsible for having a basis under Article 6.
| Purpose | Basis (Article 5(1) of the Law) |
|---|---|
| Creating and running the account, providing the Service under the Terms of Service | (b) — performance of a contract with the data subject or entering into it at their request |
| Billing, bookkeeping and tax records | (c)/(d) — processing provided for by law / performing duties imposed by Georgian legislation |
| Security of the Service, abuse prevention, logs, error diagnostics | (i) — significant legitimate interest; we take your rights into account and limit the data |
| Replying to requests, including data protection requests | (k) — handling the data subject's application (providing a service to them) |
| Optional newsletters and product news | (a) — consent, which can be withdrawn at any time |
| AI features (section 6a) | (b) or on behalf of the business — for the processing itself; transfer to a provider outside the list — only separate written consent under Article 37(2)(d) of the Law |
| Push notifications about events in the account (section 6b) | (b) — informing the user about events as part of the Service, or on behalf of the business; transfer to a notification service outside the list — only separate written consent under Article 37(2)(d) of the Law |
| Processing data of the business's customers, guests and staff | on behalf of the business; the business as controller provides the legal basis |
Call recording is audio monitoring within the meaning of Article 11 of the Law. When enabling recording, the business as controller must determine its purposes, scope and retention in writing in advance and warn the other party at the start of the recording; the Service provides the tools for this (a voice notice, retention settings) but does not replace the business's own decision.
We do not sell personal data and do not use the data of businesses' customers, guests or staff for our own advertising. No third-party advertising or web analytics tools are connected on cenaly.ge. If we decide to connect any, we will do so only after updating this Policy, with your prior consent, and only with providers processing data in the countries on the list referred to in section 7.
A business and its authorised staff see data within the permissions granted to them. The business's own use of that data is governed by its own obligations and privacy notice.
Apart from AI providers (section 6a) and push notification services (section 6b), we engage only processors that process cenaly.ge data in Germany or in another country on the list referred to in section 7, under a written agreement containing the obligations required by Article 36 of the Law:
| Processor | What it does | Where the data is processed |
|---|---|---|
| Amazon Web Services (AWS) | Hosting, file and database storage, computing, the API and WebSockets, authentication (Amazon Cognito), e-mail sending (Amazon SES), backups and logs | Germany, eu-central-1 region (Frankfurt) |
| Amazon CloudFront | Delivery of the website's pages and public files | The delivery network location nearest to the visitor |
Until the service opens (section 2), two things are still in the United States: the program files of the admin interface admin.cenaly.ge (without personal data) and the Amazon Cognito sign-in service, to which the admin application sends an anonymous technical request (IP address, time, browser information) when the legal documents are opened on admin.cenaly.ge. Both are to move to Germany before the service opens for data intake; cenaly.ge account data is not accepted until then.
The current list of processors is kept in the annex to the Data Processing Agreement (cenaly.ge/legal/dpa). AI providers are listed separately, in section 6a, and push notification services in section 6b.
We disclose data to public authorities only in the cases and in the manner provided by Georgian legislation, and to professional advisers only to the extent necessary to protect our rights and under a duty of confidentiality.
| Feature | Data sent to the provider |
|---|---|
| Transcription of recorded calls, real-time speech recognition, call assistant | Call audio or its fragments, language, technical job details; the voice and words of all call participants |
| Call summaries, tags, scores, suggestions | Transcript fragments, the necessary business context |
| Knowledge base: text recognition, vector representations, answers from documents | Fragments of uploaded documents, images for recognition, queries and answers |
| Voice commands and the assistant in the admin interface | The recording of the voice command, its text and the screen context |
| Guest AI assistant (menu, questions about the venue) | The guest's messages and menu/venue information |
We send only what is needed for the result of a specific request and do not send the rest of the account's data. The result (transcript, summary, answer) is stored in Germany.
| Provider | Features | Country of processing | On SAO list No. 007 |
|---|---|---|---|
| OpenAI, L.L.C. | Speech recognition, call assistant, summaries and suggestions, knowledge base | United States | no |
| Google LLC (Gemini, Cloud Speech-to-Text) | Guest AI assistant; speech recognition, if this engine is selected | United States | no |
| Microsoft Corporation (Azure AI Speech) | Speech recognition, if this engine is selected | United States or another country of the service region | may not be |
| Amazon Web Services (Amazon Transcribe, Amazon Bedrock) | Transcription and language models, where used | Germany (eu-central-1) — no consent required; another region — stated in the consent window | Germany — yes |
| polza.ai (gateway routing requests to models) | Passing the request to the chosen model provider, if the request goes through the gateway | Russia | no |
The specific feature and its provider are shown in the consent window before the feature is enabled. A new provider or a new country — only after this section is updated and new consent is given.
The United States, Russia and some other countries of AI providers are not on the list of countries with appropriate personal data protection safeguards (Order No. 007 of the State Audit Office of 14 April 2026). This means in particular that:
We reduce the risks: we send the minimum of data, under our agreements with the providers business data is not used to train their models, and connections are encrypted. These measures do not replace appropriate safeguards within the meaning of the Law.
The consent text is published at cenaly.ge/legal/ai-consent.
The Cenaly mobile apps (for example Cenaly Phone, the business app, kitchen, POS and courier apps), the Windows apps and browsers can show notifications about events: an incoming or missed call, a voicemail, a new order or booking, a task, a message. Such a notification cannot be delivered to a device directly: the device's operating system or the browser accepts it only through the notification service of its maker. These services are not on the list referred to in section 7:
| Service | When it is used | Country of processing | On SAO list No. 007 |
|---|---|---|---|
| Apple Push Notification service (Apple Inc.) | Apps on iPhone, iPad and Mac; Safari | United States | no |
| Firebase Cloud Messaging (Google LLC) | Android apps on devices with Google services; Chrome and browsers based on it | United States | no |
| Windows Push Notification Services (Microsoft Corporation) | Windows apps; Microsoft Edge | United States | no |
| Mozilla push service (Mozilla Corporation) | Firefox | United States | no |
| Huawei Push Kit (Huawei); RuStore push (VK) | Only if the Android app is installed from that store on a device without Google services | The provider's service region, including China or Russia | no |
The service is determined by your device or browser; we do not choose another one for it. We store the device's push address and the notification texts ourselves — in Germany (section 7).
We minimise the content. We compose notifications so that they do not contain personal data of guests, customers or callers wherever the event allows it. For example, a missed call notification says "Open Cenaly Phone to see who called" without the number, and the wake-up of an incoming call carries only technical identifiers and the name of the business's line — the caller's details are loaded by the app from the server in Germany. Where an event by its nature needs a detail (for example, the name of a task or the number of an order), the notification contains the minimum, and the rest opens in the app. Browser notifications (Web Push) are end-to-end encrypted under the Web Push standard: the browser's service delivers them but cannot read their content. Notifications to apps through Apple, Google and Microsoft are protected in transit, but the service technically receives their title and text.
The United States and the other countries of these services are not on the list of countries with appropriate personal data protection safeguards (Order No. 007 of the State Audit Office of 14 April 2026). This means in particular that:
We reduce the risks by minimising the content (section 6b.2) and by using encrypted connections. These measures do not replace appropriate safeguards within the meaning of the Law.
The consent text is published at cenaly.ge/legal/push-consent.
Under Chapter III of the Law you have the right to: receive information about the processing and a copy of your data; request correction, updating and completion; request that processing be stopped and the data deleted or destroyed; request blocking; receive data in a portable format where applicable; withdraw consent, including consent to AI processing outside the list (section 6a.4) and consent to push notifications (section 6b.4); and not to be subject to a decision based solely on automated processing in the cases provided by the Law. Withdrawing consent does not affect the lawfulness of processing before withdrawal.
Write to info@meni.ge. We may ask for proportionate verification of identity and reply within the time limits set by the Law. If you believe your rights have been infringed, you may apply to the State Audit Office of Georgia (sao.ge), a court or a higher administrative body (Article 22 of the Law).
An account owner may request closure of the account and deletion of data in the settings or by e-mail to the address in section 1. Staff accounts are created and deleted by the business; signing out of an app or uninstalling it does not delete data on the server. You control device permissions (microphone, camera, contacts, notifications) in your operating system settings; switching notifications off withdraws the consent in section 6b.4.
We apply organisational and technical measures: encrypted connections, access control and separation of permissions, activity logging and backups. We notify the State Audit Office of an incident that may cause harm no later than 72 hours after discovering it (Article 29 of the Law), and the affected people in the cases provided by Article 30 of the Law. If an incident concerns data we process on behalf of a business, we notify the business without delay.
The Service is intended for businesses and is not designed for children. Data of a person under 16 is processed on the basis of consent only with the consent of a parent or other legal representative (Article 7 of the Law). If a child has given us data without such consent, please tell us and we will delete it.
We update this Policy when processing, processors or the law change. The version date is shown at the top. We notify account owners of material changes (a new processor, a new country, a new purpose) in advance — by e-mail or in the interface.
For cenaly.ge accounts and visitors this edition replaces the platform's general Privacy Policy. References in the Terms of Service to sections 6, 6a and 7 of the Privacy Policy mean, for cenaly.ge, the corresponding sections of this edition (section 6b on push notifications is specific to cenaly.ge).