Privacy Policy

1. Who we are and how to contact us

restoful is a software-as-a-service platform for independent restaurant owners. The platform is operated by:

For all privacy-related enquiries — including data access, correction, deletion, or complaints — please email privacy@restoful.com. We will respond within 30 days.

2. What personal data we collect and why

2a. Data you give us directly

2b. Data collected automatically

• Log data — IP address, browser type, pages visited, timestamps. Used to maintain security and diagnose errors. Retained for 90 days.
• Session cookies — authentication tokens that keep you signed in. These are strictly necessary and do not require consent. See our Cookie section below.

2c. Data about your customers (end-customer data)

When your customers place orders, make reservations, or join your loyalty program through restoful, we process their name, email address, phone number, birthday, and order details on your behalf. In GDPR terms, you are the data controller for your customers' data and we are the data processor. We process this data only to operate your restoful account and never use it for our own marketing. We share it with third parties solely to carry out the services you enable — for example, Stripe or Square to take payment, and Uber to fulfil a delivery — and never for any other purpose. Any marketing emails your customers receive are sent by you (through restoful), on the basis of the consent you collect from them.

3. Cookies

We use the following categories of cookies:

Advertising and analytics cookies (Google Analytics, loaded via Google Tag Manager, and the Meta Pixel) are loaded only after you consent by choosing “Accept all” in our cookie banner, and only on our marketing, sign-up, and checkout-confirmation pages — never on your restaurant's ordering pages, in your dashboard, or in our admin tools. If you choose “Decline optional,” no such cookies are set. You can withdraw consent at any time by clearing the restoful-cookie-consent preference (or all cookies) in your browser; clearing cookies will also sign you out.

4. Third-party processors

We share your data only with the vendors listed below, each engaged under a data processing agreement. All of these vendors are based in the United States.

We do not sell your data. Apart from the processors listed above — each engaged only to deliver a feature you use — we do not share your data with any other third parties.

5. International data transfers

Sycamore Management Consulting L.L.C. is based in the United Arab Emirates. Our service providers are based in the United States. If you are located in the European Economic Area (EEA), United Kingdom, or another jurisdiction with data transfer restrictions, your personal data is transferred internationally. We rely on the following safeguards:

• Standard Contractual Clauses (SCCs) — EU Commission-approved contractual terms are in place with our EEA-to-US data processors, including infrastructure, payment, email, hosting, AI processing, and analytics/advertising providers.
• UK IDTA — Where required for UK personal data, we use the UK International Data Transfer Addendum.
• Our AI processing providers maintain zero-data-retention arrangements for API calls — data sent to their APIs is not used to train models and is not retained after processing.

6. Data retention

• Account and restaurant data — retained for the life of your account plus 30 days after deletion, to allow account recovery.
• Menu and order data — retained for the life of your account. Deleted within 30 days of account deletion.
• Uploaded menu files (photos/PDFs for AI extraction) — processed and deleted within 24 hours.
• Payment records — retained for 7 years to comply with UAE commercial law and international accounting standards.
• Log data — retained for 90 days.
• Backup copies — may persist for up to 90 days after deletion from live systems.

7. Your rights

Depending on your jurisdiction, you may have the following rights regarding your personal data. To exercise any right, email privacy@restoful.com. We will respond within 30 days (or 45 days for complex requests).

All users

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate data.
• Deletion — ask us to delete your account and associated data (subject to legal retention obligations).
• Data portability — receive your data in a structured, machine-readable format.

EEA and UK residents (GDPR / UK GDPR)

• Restriction — ask us to restrict processing of your data in certain circumstances.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing.
• Lodge a complaint — you have the right to complain to your local supervisory authority. A list of EU authorities is at edpb.europa.eu. UK residents may contact the ICO at ico.org.uk.

California residents (CCPA / CPRA)

• Know — the categories of personal information we collect and how we use it (see Section 2).
• Delete — request deletion of your personal information.
• Correct — request correction of inaccurate personal information.
• Opt out of sale or sharing — we do not sell or share your personal information for cross-context behavioural advertising. No opt-out is needed.
• Non-discrimination — we will not discriminate against you for exercising your CCPA rights.
• To submit a CCPA request, email privacy@restoful.com with the subject line “CCPA Request”. We may need to verify your identity before responding.

UAE residents (Federal Decree-Law No. 45 of 2021 on Personal Data Protection)

• You have the right to access, correct, and request deletion of your personal data as described above.
• You may contact the UAE Data Office at tdra.gov.ae to file a complaint.

8. Public data

Your restaurant name, menu items, prices, descriptions, item images, and website content are publicly accessible to anyone who visits your menu URL, scans your QR code, or visits your restoful-hosted website. Do not include private, confidential, or sensitive personal information in your menu or website content.

9. Security

We implement appropriate technical and organisational measures to protect your data, including HTTPS encryption in transit, hashed password storage, database-level row security policies, and access controls. We conduct security reviews before deploying changes. However, no system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you as required by applicable law.

10. Children

restoful accounts are for business operators, who must be adults — we do not knowingly collect account data from anyone under 18. Where your customers interact with your restaurant's ordering, reservation, or loyalty pages, you (as the data controller) are responsible for any age-related obligations toward them under your local law. If you believe we have inadvertently collected data about a minor, please contact us immediately and we will delete it.

11. Changes to this policy

We may update this policy from time to time. If we make material changes we will notify you by email at least 14 days before the changes take effect (or as required by applicable law). The “Effective date” at the top will always show when the policy was last updated. Continued use of restoful after the effective date constitutes acceptance of the updated policy.

12. Contact and complaints

For any privacy-related questions or to exercise your rights, contact us at privacy@restoful.com. We will acknowledge your request within 5 business days and respond in full within 30 days.

If you are not satisfied with our response, you have the right to escalate to the relevant supervisory authority in your jurisdiction (see Section 7).