AI builds the customer list Zomato won't give you

On April 23, 2026, Zomato quietly dropped the price-parity clause that used to fine restaurants up to 3x the differential for offering cheaper direct pricing. Three weeks later, 150 owners packed a hall in Kolkata for an NRAI-Reelo event with a name that stuck instantly: "Stop Renting Customers." The room's consensus, in NRAI's own framing: aggregators aren't the enemy — dependency on them is. What almost nobody in that room had was an actual list of their own customers to switch on. AI is what closes that gap, one owned touchpoint at a time.

The ownership gap: Zomato keeps the customer identity, you get the order ticket

Every Zomato delivery generates a customer. It just doesn't generate one you can reach tomorrow. The order ticket tells you what was cooked, what it cost, and what you were paid after commission. The identity behind it — phone number, address, order history, preferences — stays inside Zomato's systems. You served the biryani. Zomato owns the relationship.

This isn't a loophole AI should try to route around. Scraping or reverse-engineering Zomato's customer data would violate the platform's terms and, more seriously, the DPDP Act 2023 — you'd be processing personal data you never lawfully collected. AI doesn't attempt it. What AI does instead is turn its attention to the touchpoints where the restaurant is the data fiduciary already — the ones a small Indian restaurant already owns but rarely mines. It's the CRM most owners never realize they already have.

The four touchpoints AI mines to build the list you can own

Most owners think they have no customer data outside the aggregator apps. They usually have four sources sitting unused — the same four sources a curious owner could paste into ChatGPT or Claude by hand this weekend to spot the repeat numbers, though matching them across a month of exports is exactly the kind of repetitive cross-referencing an AI agent should be doing automatically, every week, without anyone opening a spreadsheet:

1. UPI tap logs. Every dine-in or takeaway payment through PhonePe, Paytm, or Razorpay leaves a partial phone number or UPI VPA in the settlement export. AI reads the daily UPI reconciliation file and matches repeat VPAs to returnable, identifiable customers — someone who has paid you directly at least once is a warmer lead than any Zomato order will ever surface.
2. Dine-in QR scans. The table QR code that opens your menu, or the WiFi-login form, or the feedback card at the end of a meal — each one is a first-party data capture moment the restaurant already runs, usually collecting nothing more than a scan count. AI treats every scan as an opportunity to capture a phone number with a one-line, low-friction ask.
3. Google reservation completions. Every booking made through Google Reserve sends the restaurant a name and phone number directly — no aggregator in between. Most owners let these sit in an email inbox. AI pulls them into the same list.
4. Magicpin check-ins. Opted-in Magicpin users generate partial profile data at check-in — smaller volume than the delivery aggregators, but still first-party and still yours to use once consent is in place.

None of these four sources requires touching Zomato's or Swiggy's backend. They're the exhaust from a restaurant's own operations, unread until AI starts reading it.

What the AI does with a partial phone number: DPDP consent capture before the first message

A phone number sitting in a UPI export is not, on its own, permission to send a WhatsApp broadcast. Under the DPDP Act 2023, a restaurant holding a customer's phone number is a Data Fiduciary, and consent for marketing has to be purpose-bound, unbundled, and explicit — not assumed because someone once paid you ₹640 for a thali.

So the first message AI ever sends to a newly captured number isn't a promotion. It's a consent ask — one line, plain language: "Hi, this is [restaurant name]. Can we WhatsApp you our weekly specials and a 10% welcome offer? Reply YES to opt in." Only the numbers that reply yes enter the marketing list. Everyone else stays in the operational record only, untouched for anything beyond order confirmations.

Here's the part that surprises owners: this consent step isn't a compliance tax dragging down the list. It's a filter that makes the list better. A customer who opts in twice — once by paying you directly, once by replying yes — has expressed intent twice before you've spent a rupee reaching them. That's the highest-value cohort AI ever builds, and DPDP is the reason it exists as a clean, provable segment rather than a spam list waiting to backfire.

The winback sequence AI runs on lapsed customers — and what actually moves them

Once the list exists, the compounding work starts with the customers who've gone quiet. Picture a single-outlet restaurant with 47 customers who haven't returned in 90 days or more — a number small enough to feel unimportant and large enough, at an average ticket of a few hundred rupees each, to be real revenue sitting idle.

AI segments those 47 by what they last did, not just when: anniversary or birthday bookings, high-ticket group tables, single-visit walk-ins. It drafts a different message for each segment, in the owner's own brand voice, and times the send for 7pm — after the lunch lull, before dinner covers arrive — with a 10% discount and a 7-day expiry to force a decision instead of a maybe.

To be transparent about what's modeled here versus proven: a segmented, consent-filtered winback broadcast is a validated mechanic, but a precise conversion rate for any single restaurant depends on cuisine, city, and offer strength — treat any specific percentage you see quoted online as directional, not a guarantee. What consistently holds across the pattern is which segment responds fastest: the anniversary and celebration-visit segment converts at meaningfully higher rates than the casual single-visit segment, because you're reminding someone of an occasion, not just a meal.

What the list looks like at 90 days: the compounding effect

Ninety days in, the list is not massive. A small restaurant running this consistently typically ends up with somewhere in the range of 150 to 400 owned, consented contacts — a fraction of the thousands of anonymous orders Zomato processed for the same restaurant in the same window. But every one of those contacts visited, paid, and said yes twice. Repeat-visit rate on this cohort is commonly reported as running two to three times higher than cold acquisition through a Zomato ad campaign, because you're not buying a stranger's attention — you're reactivating someone who already liked the food.

The number that matters isn't the list size in month one. It's the slope. Every UPI tap, every QR scan, every Google reservation adds one more name AI can mine, consent, and eventually message. Run the winback cohort monthly instead of once, and by month six a restaurant typically owns a direct-customer asset whose monthly contribution margin outweighs what it pays for a Zomato Pro subscription — and unlike a Zomato Pro listing, no algorithm change, commission hike, or app outage can take this list away. The aggregator can raise its cut tomorrow. It cannot retract a phone number that already said yes to you. That's the difference between renting reach and owning a retention channel.

So what now

Running this list-building loop by hand — checking UPI exports, chasing QR-scan opt-ins, remembering which lapsed customer gets which winback message — is exactly the kind of recurring, detail-heavy work that quietly stops happening after week three. SideKyk's ops agent runs the segmented winback sequence automatically for every lapsed cohort, with DPDP consent already checked before a single message goes out, inside the same WhatsApp thread you already use to run the kitchen. Join the restaurants waitlist at sidekyk.ai/restaurants and we'll message you the moment your slot opens.