Privacy Policy

1. What we collect

• Name and email address, when you create an account
• Your password, stored as a salted hash (scrypt) — we never store or can see your actual password
• Delivery addresses you save or enter at checkout, including approximate coordinates (geocoded from the address) used to check whether a restaurant delivers there
• Order history: what you ordered, when, from which restaurant, and the amount charged
• Reviews you write
• For restaurant owners: your restaurant's name, address, menu, and photos you upload

2. What we don't collect

We never see or store your full card number, expiry date, or CVC — card details go directly to Stripe. We don't track you across other websites, and we don't sell personal data to third parties.

3. Third parties we actually use

• Stripe — processes all payments and payouts; see Stripe's own privacy policy for what they hold
• Brevo — sends transactional emails (order updates) and, if you're a customer or restaurant owner, occasional broadcast emails from us
• Cloudinary — hosts photos uploaded for menu items and restaurant profiles
• Mapbox / OpenStreetMap (Nominatim) — converts addresses you enter into approximate coordinates, used only to check delivery range and show distance

4. Cookies

We use a single session cookie to keep you logged in. It contains a signed token identifying your account — it is not used for advertising or cross-site tracking, and we don't currently use any analytics or advertising cookies.

5. How long we keep data

Your account data is kept for as long as your account is active. If you delete your account, your name, email, and password are permanently removed. If you have order history, your account is anonymized rather than deleted outright — your personal details are scrubbed, but the order itself stays on record for the restaurant, since that's their real transaction history to keep, not just ours.

6. Your rights

Because we operate in the UK, you have rights under the UK GDPR, including the right to access the personal data we hold about you, correct inaccurate data, request deletion of your data (see "How long we keep data" above for how this actually works), restrict or object to certain processing, and receive your data in a portable format.

To exercise any of these, contact info@suftnet.com. If you're not satisfied with our response, you can complain to the UK's data protection regulator, the Information Commissioner's Office.

7. Restaurant owners

If you sign up a restaurant, your business name, address, and bank/payout details (handled directly by Stripe, not stored by us) are used to run your restaurant on the platform and pay you for orders. Customers can see your restaurant's name, menu, delivery area, and reviews.

8. Contact

Questions about this policy or your data: info@suftnet.com