Privacy, served plain.

Who this policy covers

This policy covers restaurant owners and staff who use Bukka, guests who browse a public menu or place an order or reservation, people who join our early-access list, and anyone who contacts us.

A restaurant may give you additional privacy information about its own use of your data. Where you are a staff member or guest, the restaurant may be responsible for deciding why your operational information is used.

Information we collect

Account and identity information

Your name, email address, phone number, password credential, account status, role, outlet memberships, and sign-in information. If you use Google or Apple sign-in, we receive the provider identifier and profile details the provider makes available, which may include your name and email address.

Restaurant and workforce information

Business and outlet details, branding, menu and recipe information, supplier contacts, staff records, assigned roles, salary information entered by authorised owners, workdays, attendance times, and manager corrections or excuse reasons.

Guest and transaction information

Guest name and contact details, table or fulfilment choice, delivery address, reservation details, allergies or notes you choose to provide, order items and modifiers, payment method, payment status, refund records, and restaurant service requests.

Device, usage, and security information

IP address, session and device information, timestamps, feature requests, security events, and diagnostic information needed to protect and operate the Service. Security rate-limit keys and logged event IP addresses may be stored as cryptographic hashes rather than raw values.

Content and communications

Menu images and other content uploaded to Bukka, AI recommendation prompts, support messages, feedback, and an email address submitted through the early-access form.

How and why we use information

• Provide the Service: create accounts, run restaurant workflows, process orders and reservations, maintain menus, support attendance, and generate operational reports.
• Perform our agreements: deliver the features requested by a restaurant or user and administer access to them.
• Keep Bukka secure: authenticate users, enforce role-based permissions, prevent abuse, investigate incidents, and maintain audit records.
• Communicate: send password resets, security notices, service messages, support replies, and early-access updates.
• Improve the Service: troubleshoot performance, understand feature use, and develop Bukka using aggregated or appropriately protected information where practical.
• Meet legal obligations: comply with lawful requests, keep records we are required to keep, and establish or defend legal claims.

Depending on the context, our lawful basis may be performance of a contract, consent, compliance with law, or our legitimate interests in running and securing Bukka. Where we rely on consent, you may withdraw it, although this does not affect earlier lawful processing.

When Bukka acts for a restaurant

For restaurant-controlled guest, staff, attendance, and operational data, the restaurant will often be the data controller and Bukka will process information on its instructions. Bukka remains responsible for the information it uses for its own account administration, security, product communications, and legal compliance.

If your request concerns information entered by a restaurant, we may direct the request to that restaurant or work with it to respond.

When we share information

We do not sell personal information. We disclose it only where needed to provide or protect the Service, including to:

• the restaurant and its authorised team members, subject to outlet and role permissions;
• hosting, database, file-storage, email-delivery, and security providers working for us;
• Google or Apple when you choose their sign-in services;
• weather and AI service providers when the relevant feature is enabled;
• professional advisers, a buyer or successor in a genuine corporate transaction, or authorities where required by law or necessary to protect rights and safety.

Some providers may process information outside Nigeria. Where personal data is transferred across borders, we use a legally recognised transfer basis and appropriate safeguards as required.

AI menu recommendations

When a guest asks for a recommendation, Bukka may send the prompt together with a limited set of eligible menu information, local time, and—where the restaurant has enabled it—general weather context to an AI service provider. Bukka then matches suggestions back to the restaurant’s current menu before showing them.

Do not include sensitive personal information in an AI prompt. Recommendations are for menu discovery and should not be treated as medical, nutritional, or allergy advice. Guests should confirm dietary or allergen needs directly with the restaurant.

Location, NFC, and attendance

If a restaurant enables attendance, Bukka asks a staff member for device location only when they choose to check in or out. The location is compared with the outlet’s configured location. Bukka stores the resulting distance and accuracy measurements with the attendance record; the current implementation does not store the staff member’s raw latitude and longitude in the attendance session.

NFC is used only when a staff member chooses to scan an outlet attendance board. A rotating code can be used where NFC is unavailable. Bukka does not use this feature for continuous or background location tracking.

Retention, deletion, and security

We keep personal information only for as long as needed for the purposes described here, including providing the Service, maintaining restaurant and transaction records, resolving disputes, protecting Bukka, and meeting legal or accounting duties. Different records may be retained for different periods.

When an account is deleted, Bukka revokes active sessions and linked sign-in identities, removes direct contact details from the user record, disables memberships, and marks the remaining record as a deleted account. Some operational, transaction, attendance, audit, backup, or legal records may remain where the restaurant or Bukka has a lawful need to retain them.

We use measures designed to protect information, including encrypted connections, secure mobile-device storage for session credentials, hashed passwords and certain security identifiers, access controls, time-limited file links for private content, and server-side role checks. No service can guarantee absolute security.

Cookies and similar technology

The application uses essential cookies or similar identifiers to keep users signed in, remember necessary session state, and protect account activity. The landing page does not currently use advertising or behavioural-analytics cookies. Third-party font and script hosts used by the public website may receive ordinary request information such as an IP address and browser details.

Your choices and rights

Subject to applicable law and appropriate verification, you may ask us to:

• confirm whether we process your personal data and provide access to it;
• correct inaccurate or incomplete information;
• delete information or restrict certain processing;
• provide portable information where the right applies;
• object to processing based on legitimate interests or withdraw consent;
• explain or review a qualifying automated decision.

You may also complain to the Nigeria Data Protection Commission or another regulator that has authority over your concern. We will not discriminate against you for exercising a privacy right.

Questions, requests, and changes

We may update this policy as Bukka develops, our providers change, or legal requirements evolve. If a change is material, we will take reasonable steps to provide notice. The effective date at the top shows when this version applies.