Privacy
Last updated 24 July 2026
The short version. We use your restaurant's data to run your restaurant. We do not sell it, we do not share it with other restaurants, we do not use it to advise your competitors, and we do not use it to train AI models. You can disconnect any account or ask us to delete everything, at any time, by sending one message.
Who we are
Sufra is operated by UBU LLC, a company registered at Sharjah Media City, Sharjah, United Arab Emirates. UBU LLC contracts with restaurants in the UAE and Saudi Arabia, operates the platform, handles payment processing, and is the data controller for their information.
For anything in this policy, contact privacy@meetsufra.ai.
What we collect
From you, when you request a pilot: your name, restaurant name, WhatsApp number, email, number of locations, and which platforms you use.
From the platforms you connect, once you authorise them:
- Point of sale (e.g. Foodics): sales totals, order records, menu items, prices and costs, branch details.
- Delivery platforms (e.g. Deliveroo): menus, item availability, order and cancellation events, store status.
- Google Business Profile: your business listings and the reviews guests leave, including reviewer display names as Google provides them.
- Advertising accounts (Meta, Google, TikTok, Snapchat): campaign names, budgets, spend and performance metrics.
From your conversation with Sufra: the messages you and your team exchange with it on WhatsApp, including voice notes, which we transcribe in order to act on them.
Automatically: basic technical logs (IP address, browser, timestamps) needed to run and secure the service.
What we do not collect
- We never receive or store your passwords for any connected platform. Connections use each platform's official authorisation flow, and you approve them inside your own account.
- We do not collect payment card details from your guests.
- We do not access anything on a connected account beyond the permissions you granted.
How we use it
- To operate your account: monitoring your platforms, taking the actions you have permitted, and reporting to you.
- To write replies to reviews and messages in your voice.
- To produce your weekly reporting.
- To contact you about your account and about Sufra.
- To keep the service secure and to meet our legal obligations.
AI processing
Sufra is built on large language models provided by Anthropic. Your business data is sent to that provider solely to generate your responses, reports and actions. Your data is not used to train models.
Who we share it with
Only with the service providers required to run Sufra — our cloud hosting provider, our AI provider, and our WhatsApp messaging provider — each under contract and only for that purpose. We also share data where the law requires it.
We never sell your data. We never share one restaurant's data with another, and we never use your data to advise a competitor.
Google user data
Where you connect a Google Business Profile, our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. We use Google data only to display your reviews and listings to you and to publish replies you have approved or permitted. We do not transfer it to others except as required to provide the service, for security, or to comply with law, and we do not use it for advertising or to train models.
Where it is stored, and for how long
Data is stored on cloud infrastructure with encryption in transit and at rest. Access tokens for connected platforms are encrypted. We retain your data while your account is active and for up to 90 days after you cancel, after which it is deleted. Records we must keep for legal or accounting reasons are retained for as long as the law requires.
Where your data goes
Your data is processed on cloud infrastructure operated by our providers, which may be located outside the UAE and Saudi Arabia, including in the United States and Europe. Where personal data leaves the region, we rely on the transfer mechanisms permitted under UAE Federal Decree-Law No. 45 of 2021 and, where applicable, Saudi Arabia's Personal Data Protection Law, including contractual safeguards with each provider.
If your organisation requires data residency within the GCC, tell us before you connect any account and we will confirm whether we can meet that requirement for your deployment.
Your rights
You may ask us to give you a copy of your data, correct it, delete it, or stop a particular use. You can disconnect any platform at any time by messaging Sufra or emailing us, which stops all access to that platform immediately. To exercise any of these, write to privacy@meetsufra.ai and we will respond within 30 days.
These rights are provided in line with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and, where applicable, Saudi Arabia's Personal Data Protection Law.
Your guests' data
When Sufra replies to a review, it processes the reviewer's public display name and review text as made available by the platform. It does not build profiles of your guests, and it does not use their information for anything other than replying on your behalf.
Children
Sufra is a business tool and is not directed at anyone under 18.
Changes
If we change this policy in a way that materially affects you, we will tell you by email or WhatsApp before it takes effect.