Use of artificial intelligence

Last updated: 29 October 2026

The Qder.ai system (hereinafter the "System") contains five points at which a language model answers: the digital waiter at the table; the concierge on chat.qder.ai; the assistant in the business panels; the kitchen and bar screen assistant; and Qubi, in the website chat. This document sets out precisely what each of them receives, what it will not do, and when it ceases its attempts and hands the matter over to a person. In this document, "Qder" means the operator of the System, the "User" means any person using the System, and the "Restaurant" means the restaurant concerned in each case.

This English version is provided for convenience. The Hebrew version of this document is the governing version: שימוש בבינה מלאכותית.

1. Who answers the User

The User is communicating with a system, not with a person, and Qder does not represent otherwise: if the User asks the digital waiter who it is, the digital waiter will state that it is Qder.ai. In the background, Qder uses models supplied by an external AI model provider, through that provider's commercial API (the provider is named in the sub-processor table of the privacy policy). Under the provider's commercial terms, content sent through the API is not used to train the provider's models. Qder does not train models on the User's conversations. A scrubbed log of conversations is used to improve the digital waiter, first at the Restaurant at which the User was conversing; recurring failure patterns are also checked across restaurants, after the names have been replaced with a generic marker. See the provisions on the conversation log in the privacy policy.

Where the digital waiter cannot answer and states that it will check with the staff, the question (its wording only, scrubbed, without any name and without any link to an account) is retained so that the Restaurant can answer it once. The question is first checked, at the AI model provider, against the Restaurant's details. If the answer was already present there, the question does not reach the Restaurant: Qder corrects the digital waiter, and the question, without the names of the dish, the restaurant and the chain, automatically becomes a permanent test case which every version of the digital waiter must pass. This constitutes a test, not model training. The question itself is deleted 180 days after it was last asked.

Where a restaurant provides Qder with its website, Qder reads the public pages of that website (at most once a week) and, with the AI model provider, proposes answers to diners' questions and details about the venue, such as parking, kosher status and accessibility. Each proposal is accompanied by the wording on the website on which it rests, and no proposal reaches the digital waiter before the restaurant approves it.

2. The digital waiter at the table: information sent to the model

The following is sent to the model:

• the message written by the User, and the most recent messages in the current conversation (retained on the server for 24 hours; see the privacy policy);
• the menu of the branch at which the User is seated, with the prices and the allergen list as entered by the Restaurant, and the items that have run out;
• what has already been ordered at the table at which the User is seated, including any allergy note and how each dish was asked to be prepared, whether written by the User or by another diner at the same table;
• the questions that the kitchen asks about each dish before preparing it (how well done, how spicy, extras), as defined by the Restaurant or, where the Restaurant has not defined them, as inferred by the System from the name of the dish (for example, grilled meat prompts the question of how well done). The digital waiter asks the User a required question before it adds a dish, and passes the User's answer to the kitchen together with the dish. An answer that is not on the Restaurant's list is not accepted;
• the allergies and dietary preferences saved in the User's account, if the User has an account and has filled them in;
• the User's previous visit to that chain (what the User ordered and when), if the User has an account, so that the digital waiter can answer "what did I order last time?";
• if the User has turned on taste memory: the kinds of dishes the User tends to choose that are on this menu at present, together with the names of those dishes on the Restaurant's menu. No other restaurant's name, no dates and no counts are sent;
• the fact that the User is under 18, if the date of birth in the User's account so indicates, so that the digital waiter neither suggests nor adds alcoholic drinks. The date itself is not sent;
• the fact that today is the User's birthday, if the date of birth in the User's account so indicates, so that the digital waiter can wish the User a happy birthday. Neither the date itself nor the User's age is sent;
• the note written by the User, or by another member of the User's party, when booking the table at which they are seated, if any, so that the digital waiter knows, for example, that they are celebrating a birthday;
• how long this kitchen is taking to serve, based on its recent orders, so that the digital waiter can answer "how much longer?".

The following is not sent: the User's name, email address, phone number, date of birth or IP address, or the details of any visit earlier than the previous visit referred to above (taste memory, if the User has turned it on, sends only what is stated in the item above).

Allergies are sent so that the answer relates to the User rather than to an average diner: when the User asks "what do you recommend?", the digital waiter should know not to suggest anything to which the User is allergic. Any person ordering without an account, or who has not filled in those fields, sends none of this information. The User may delete them at any time on the account page, and from that moment they cease to be sent.

3. Much of what the User asks never reaches the model at all

"Menu", "how much is X", "what is there to drink", "call a waiter" and "the bill" are all answered directly from the Restaurant's own data, without recourse to the model. This is faster, less costly and, above all, more accurate, because filtering Qder's allergen list cannot invent a dish that does not exist.

4. What the model will not do

• The model will not give medical advice, and will not confirm that a dish is safe for the User. In the case of an allergy, or of any doubt, it calls a waiter.
• The model will not answer questions on matters unrelated to the meal. This is not a system for general questions.
• The model will not invent dishes, prices or ingredients that are not in the menu entered by the Restaurant; and even if it fails in that respect, what is binding is the Restaurant's menu, not what was written in the chat.
• The model will not send an order to the kitchen without the User confirming it on screen.
• The model will not display its internal reasoning: what appears in the chat is the answer only. A message that attempts to change its rules or to extract its reasoning, or that has nothing to do with the meal, is stopped, and the chat displays a notice to that effect; see why a message was stopped in the chat.

5. The concierge on chat.qder.ai

On chat.qder.ai the User may ask, without being seated at a table, where to eat, whether a particular restaurant is open and busy, and which times are available for booking. That conversation is available only to persons signed in to an account. The answer is compiled from the opening hours entered by the Restaurant, the number of tables occupied at that moment, and how busy the Restaurant has been in recent weeks. Only the User's question and that information are sent to the model, and not the User's name, email address or phone number. The System does not list which restaurants work with it unless the User has asked.

This is an estimate, not an undertaking: a free table is generally not a table held for the User. That is what a reservation is for.

6. The business assistant

The branch and chain panels include an assistant that takes instructions in plain language (for example, "the salad has run out", "the cola is 14", "here is a photo of the menu, type it in") and proposes changes. A few rules, which cannot be bypassed, are set out below:

• No change takes effect without the explicit approval of an employee. The assistant proposes; a person presses "confirm". Every proposal is signed by the server and expires if it is not approved.
• The assistant can do only what the account from which it was launched is permitted to do. A branch manager cannot, through the assistant, change the chain's menu.
• Messages, images and files sent to the assistant are passed to an external AI model provider for processing. Diners' details, financial documents and passwords should not be sent to the assistant, which does not need them.
• A menu imported from a photograph is a proposal made by a model reading an image. The business approves it, and the business is responsible for it, including the prices, the names and, above all, the allergens.

7. The kitchen and bar screen assistant

The kitchen screen and the bar screen include an assistant that takes instructions by voice or in writing, in whatever language is used to address it (for example, "table 7 is out", "we're out of salmon", "tell the floor table 9's steak needs five more minutes"). It performs only the actions that the screen's own buttons perform:

• Three actions only. Moving one of the screen's orders (started, served, back to the queue); marking a dish of that station as run out or as available again; and sending a short message to the shift manager and to the staff's phones. It has no access to prices, bills, bookings or diners' details.
• It acts immediately, without an approval step, unlike the business assistant: every action can be reversed with a single tap and is shown on the screen the moment it occurs, with an "undo" button. What the assistant heard is written above what it did, so that a mishearing is visible at once. The description of what occurred is generated by the System's own code, not by the model.
• Allergen questions are answered only from what the business has marked on the menu. If no allergen is marked for a dish, the assistant states that none is marked and refers the question to the manager. It does not know what is on the plate.
• What is sent to the model. What was said or typed; the station's menu, with the allergens marked; and the screen's open orders: table number, dishes, preparation notes and the allergy note, without a diner's name, phone number or email address. The recording itself is sent for transcription and is deleted at that moment; the screen records only after its microphone button has been pressed.
• Limits. Up to 3,000 requests a month per screen. When the ceiling is reached, the assistant says so, and the screen's buttons continue to work as usual.

8. Retention of answers

So as not to put the same question to the model a hundred times a day, Qder retains answers to general questions at branch level, subject to three important limits:

• No answer touching on ingredients, allergens or nutrition is ever retained. That is precisely where an outdated answer is dangerous, and such questions are therefore answered afresh every time.
• For a diner who has allergies saved in their account, or whose account indicates that they are under 18, no answer is retained and none is read. Such a diner's answers were written for that diner and are not suitable for anyone else; this holds in both directions.
• Any change to the menu (such as a price, a dish that has run out or a new dish) clears every retained answer for that branch.

9. Usage limits

Every diner has a ceiling on conversations with the model. When it is reached, the digital waiter stops answering that diner and calls a waiter to the table, while ordering from the menu, calling a waiter and the bill continue to work as usual. The Restaurant's monthly allowance does not stop the digital waiter; conversations beyond it are billed to the Restaurant, as set out in the pricing, billing and cancellation page (תמחור, חיוב וביטול, in Hebrew).

10. No automated decisions concerning the User

The System does not score the User, does not make decisions with legal significance concerning the User, and does not build a behavioural profile, save for taste memory if the User has personally turned it on: a list of the kinds of dishes the User likes, from which the digital waiter only makes suggestions, and which the User can view and delete on the account page. The System answers questions and passes orders to the kitchen. The sole exception is age verification, if the User chooses it (section 12): an automated check decides whether to add an "age verified" mark to the User's account. If the check fails, nothing changes compared with not verifying: the User orders as usual and the staff check identification as always. The User may try again, and may contact Qder.

11. Errors

Should the digital waiter have said something incorrect, Qder would welcome being informed of it, through the contact page.

12. Age verification (optional)

Where the User chooses to verify their age on the account page, the entire process takes place on Qder's own service (on Cloudflare's infrastructure, with no internet access) using open models, and not at an external AI model provider or any other company, namely: reading the document type, the date of birth and the expiry date from the document (a passport's machine-readable lines, checked against their check digits; an identity card's printed dates; the name and the document number are not retained); comparing the face in the User's selfie with the photograph in the document; checking that the User's head went round the circle as asked; and checking that it is a live face rather than a photograph or a screen. Qder deletes the images at the end of the check. If the User's account indicates that the User is under 18, the User cannot verify, and no image of the User is sent. The decision is automatic; if it fails, the User may try again or simply show identification at the venue, and may contact Qder. The check is not perfect and can be deceived, which is why the Restaurant may always ask for identification.

13. Qubi, the website chat

On the website's pages the User may ask Qubi, Qder's digital assistant, by topic: sales, getting started, technical support, billing, diners, privacy and security, and partnerships. Qubi plays a different role in each, under the same rules in all of them. Privacy and security requests are always referred to a person. Qubi answers only from what the website's public pages state (the product pages, pricing, the guides and the legal documents) and from the state of the System shown on the status page; as to anything not found there, Qubi states that it does not know and offers a person. Qubi has no tools: it does not enter any account and cannot make a refund, a discount, a plan or billing change, an account change or a deletion. At any time the User may tap "Talk to a person" or ask for one in words, whereupon Qubi stops answering and a member of the team continues. An answer from Qubi may be incorrect and does not constitute a commitment; what counts is the documents themselves and what a member of the team has confirmed. What is retained from the conversation, and for how long, is set out in the privacy policy.