Privacy policy for the Laayo AI connector

Applies to the Laayo connector for Claude, ChatGPT and other AI assistants ("the connector"). Last updated 1 November 2026. Laayo's main privacy policy covers your Laayo account in general; this page adds what is specific to the connector.

What we collect

• Sign-in: your mobile number and the one-time code (or password) you type on our sign-in page. They go only to Laayo's own sign-in service, the same one the Laayo app uses. We never see or store your AI assistant password.
• Connection: a Laayo session for the connector, stored encrypted, plus random access and refresh tokens that we keep only as one-way hashes.
• What the assistant asks for: the tool calls the assistant makes on your behalf, such as restaurant searches, cart changes, order previews, orders and tracking. These are handled as normal Laayo account activity.
• Technical logs: time, tool name, success or failure, your Laayo customer number and the requesting IP address, for security and debugging. We do not log your phone number, codes, passwords, tokens or what you typed in the chat.

We do not receive your chat conversation. The assistant sends us only the inputs of the tools it calls.

How we use it

Only to run the features you ask for: show restaurants and menus, keep your cart, price and place your orders, track and cancel them, and keep the service secure (rate limits, abuse prevention). We do not use connector data for advertising and do not sell it.

What the assistant receives

Tool results: restaurant and menu information, your cart, order totals and status, your saved address labels and lines, and the first name of your rider once assigned. We do not send your phone number, payment details or other customers' data. The AI provider (Anthropic or OpenAI) handles the conversation under its own privacy policy.

Sharing

When you place an order, the restaurant and the rider get what they need to deliver it, exactly as with an order from the Laayo app. We use service providers for hosting and security under contract. We share data with authorities only when Nepali law requires it.

Storage and retention

• Sign-in attempts: up to 20 minutes.
• Access tokens: 1 hour. Connections (refresh tokens and the encrypted Laayo session): 60 days after last use, or until you disconnect.
• Orders and account data: as in Laayo's main privacy policy.
• Technical logs: up to 90 days.

Data is stored on Laayo's servers. Sessions are encrypted with AES-256-GCM and all traffic uses HTTPS.

Your choices

Disconnect the connector in your assistant's settings at any time, or end its web session in the Laayo app. You can ask us to access, correct or delete your data, or delete your account from the Laayo app.

Contact

Laayo, Nepal. Email support@laayo.com.np.