Sufra is a restaurant operating platform run in Egypt by Labidzs General Contracting (legal name in Egypt: لابيدزس للمقاولات العامة). The service may include menus, orders, POS, inventory, administration, accounting, messaging, integrations and AI-assisted tools. This Policy explains what data we process, why, who may receive it and what rights may apply.
1. Data roles
For Sufra account data, platform security, billing, fraud prevention, service communications and Sufra's own operational records, Labidzs General Contracting processes the data needed to operate the service. For restaurant-customer data entered or collected by a restaurant through Sufra, the restaurant generally controls the customer relationship and the purposes of use, while Sufra acts as a technology service provider or processor on the restaurant's instructions, except for security, legal and platform obligations that Sufra must handle for itself.
2. Data we may process
- Restaurant data: name, branches, country, currency, timezone, settings, tax and billing information and integration configuration.
- User and staff data: name, phone or email where used, role, permissions, account status, login and session records.
- Customer and order data: phone number where needed, orders, items, quantities, totals, table or fulfilment type, timestamps, payment status, loyalty and marketing consent where used.
- Operational data: inventory, purchasing, reports, sales, reservations, kitchen and support records.
- Device and technical data: IP address, browser or device type, application errors, security information, session identifiers and push-subscription data if enabled.
- Audit data: who performed an action, when and the result, to the extent needed for security, investigation and compliance.
3. Why we use data
We use data to provide and perform the service, authenticate users and permissions, process orders and billing, operate support, improve reliability, prevent misuse and fraud, protect accounts, run integrations enabled by authorised users, meet legal obligations and market our services where there is a lawful basis or required consent. We may use aggregated or de-identified information for product analysis and improvement without attempting to re-identify individuals.
4. Legal bases
Depending on the data and market, processing may rely on performance of a contract, legal obligations, legitimate interests in operating and securing the service and preventing fraud, or consent where required. In Egypt, applicable Egyptian laws apply, including Personal Data Protection Law No. 151 of 2020 where relevant. Mandatory local rules remain applicable in other supported markets.
5. Sensitive and unnecessary information
Sufra does not ask restaurants to enter sensitive information that is not needed for the service. Order or allergy notes may reveal health information; restaurants should collect only what is necessary and have an appropriate legal basis. Passwords, PINs, API keys and full card details must not be placed in menu fields, order notes or support messages.
6. Payment data
Sufra does not store full payment-card details. Card entry and processing are handled by the relevant payment provider. Sufra may receive transaction references, status, amount, currency and information needed for reconciliation and accounting. Payment providers are also subject to their own terms and privacy policies.
7. AI and ChatGPT connections
Connecting Sufra to ChatGPT or another approved AI workflow is optional and permission-controlled. Sufra uses OAuth and appropriate authentication to confirm the account and role. The public MCP URL is not a secret and does not identify or grant access to a restaurant by itself.
- Sufra re-checks current role and account status server-side before executing a tool.
- Only data needed for the requested tool or result is sent to the AI provider within the authorised scope.
- Audit logs may record the tool, role, time, result and selected parameters, with secret-like fields such as token, PIN, password or key redacted where detected.
- User conversations inside ChatGPT are governed by the user's OpenAI settings and policies; Sufra records the tool requests and results needed to operate the integration.
8. WhatsApp, SMS, email and push notifications
Sufra may use WhatsApp, SMS, email or push providers to send login codes, order status, receipts, service notifications or permitted marketing. The provider receives the minimum routing information and message content needed for delivery. Marketing opt-out does not stop transactional messages needed for an active order or account security.
9. Local storage, cookies and device data
The website and app may use local storage, cookies or similar technologies for sessions, baskets, language, display preferences, offline use and security. Some are necessary to provide the service. If we introduce non-essential technologies requiring consent in a particular market, we will request it where legally required.
11. International processing and transfers
Some hosting, messaging, payment or AI providers may process data outside the restaurant's country. We use providers and contractual or technical arrangements appropriate to the service and market and apply transfer safeguards or obtain approvals where required by law. Supporting a country does not mean every provider or feature is automatically available there.
12. Retention and deletion
We retain data for as long as needed to provide the service, perform contracts, secure accounts, resolve disputes, prevent fraud and meet accounting, tax and legal obligations. Periods differ by record type and market. When data is no longer needed it is deleted or de-identified where appropriate, although temporary copies may remain in backups until their normal deletion cycle completes. A deletion request does not require us to erase records that law requires us to retain.
13. Security
We use role-based access controls, tenant isolation, audit logging, authentication, secret protection, secure communications and operational safeguards appropriate to the service. No internet service can guarantee zero risk, so users must protect their devices and credentials and promptly report suspicious activity.
14. Data incidents
If a material security incident occurs, we work to contain it, investigate it and restore service, and notify the affected restaurant, individuals or competent authorities when and to the extent required by applicable law.
15. Data rights
Depending on applicable law and market, rights may include access, correction, updating, objection, restriction, withdrawal of consent, data portability or deletion where there is no lawful reason to retain the data. Restaurant customers should normally start with the restaurant because it controls the direct customer relationship, but requests may also be sent to support@sufraup.com. We may ask for enough information to verify identity and authority without asking for account secrets.
16. Children
Administrative and operating accounts are intended for adults or persons legally authorised by the restaurant. Sufra does not target children for administrative accounts. If a restaurant processes a minor's data in an order, reservation or family programme, the restaurant is responsible for the lawful basis and required consent, while Sufra limits processing to what is needed to provide the service.
17. Automated decision-making
Sufra's AI features are designed to assist analysis and operations and do not by default make final decisions with legal effect about individuals without user involvement. If materially significant automated decision-making is introduced later, we will provide the disclosures and safeguards required by applicable law.
18. Egypt and other markets
The current operator is based in Egypt. Support for Italy, France, Saudi Arabia or another market does not change the operator unless a market-specific legal notice says so. Mandatory rights under the law of the relevant country remain effective, including applicable European data-protection requirements where they apply.
19. Policy updates
We may update this Policy when the product, providers, legal requirements or processing practices change. The updated date appears at the top of this page, and additional notice will be given where law requires or a change is material.
20. Contact and complaints
For support, privacy requests or security reports: support@sufraup.com. A data subject may also contact the competent supervisory authority where applicable law provides that right.
Website visit analytics
We use random session and visitor identifiers to measure visits to Sufra pages, traffic sources, campaigns, and the visitor's approximate country. We do not request GPS location and we do not store the raw IP address in this log. Country may be estimated from the device timezone or language; when a restaurant account request is submitted, we link that request to the visit session to measure conversion. Visit logs are automatically deleted after 90 days.
WhatsApp contact
If you start a conversation with Sufra on the company WhatsApp number, we store the phone number, conversation content and attribution data such as campaign source as needed to reply, provide support and follow up on your request. The bot may reply automatically; you can ask for a person or stop messages at any time. Prospect conversations are automatically deleted after the operational retention period.
Ordering experience measurement
If you choose to share usage statistics in the menu, We measure order milestones with an anonymous session identifier, display language and restaurant country. This measurement excludes phone numbers, dish details and payment information. Its records are deleted after 30 days. We respect browser Do Not Track and Global Privacy Control settings.