1. Who we are

Sufra is a hospitality operations product provided by Qaris. For privacy questions about this website, setup inquiries, owner account administration, security logs, and the Sufra Assistant, the data controller is Qaris.

Postal and electronic contact: contact@qaris.dev (subject line “Privacy request”). Telephone: +995 959 504 0823. Website: qaris.dev.

2. Scope and territorial application

This Policy covers automated and non-automated processing of personal data carried out in connection with the Service. Under the Law, those rules apply to processing carried out in Georgia and to foreign controllers that offer goods or services to, or otherwise target, individuals in Georgia.

The Law does not apply to personal data processed by a natural person strictly for personal or household activities; processing for national security, defence, state border security, and criminal-law enforcement as provided by law; or processing exclusively for journalistic, artistic, literary, or academic purposes under legal and professional ethical standards.

3. Controller and processor roles

When a restaurant or hotel (“Venue”) uses Sufra, the Venue is the controller of guest, staff, menu, table, order, and related operational data in its workspace. Qaris acts as processor on the Venue’s documented instructions for that data.

Qaris remains controller of data we process for our own purposes: website and contact inquiries, owner and platform account administration, billing and contract records, security and abuse prevention, service reliability, and the Sufra Assistant.

Guests and staff should first contact the Venue for operational data the Venue controls. Contact contact@qaris.dev for data we control directly or if you are unsure who is responsible.

Sufra stores every Venue’s operational data on a shared Qaris database. Each Venue is a classified tenant. Technical access controls keep one Venue from reading or writing another Venue’s data. Venues do not receive a separate database project in their name and do not enter a database URL or API key in Settings.

4. Principles we follow

We process personal data lawfully, fairly, and transparently, and in a manner that does not harm human dignity. Processing is limited to specified, explicit, and legitimate purposes. We collect only what is necessary, keep data accurate, store it no longer than needed, and protect it with appropriate security. When the purpose ends we delete or anonymise the data, unless a longer period is required by law.

5. Personal data we process

Depending on how you interact with us, we may process:

• Identity and contact data — name, email address, phone number, restaurant or business name, city or neighbourhood, and the content of messages when you email or call us.
• Account data — owner and staff login identifiers, role (owner, waiter, kitchen), business ID, authentication metadata, and optional email sign-in codes.
• Venue configuration — menus, categories, tags, tables, QR settings, branding, language preferences, and business-day settings entered into the Service.
• Operational data — table sessions, orders, status history, optional guest notes, in-app checkout totals, and related timestamps.
• Assistant data — questions you send to the Sufra Assistant and the replies generated to help you use the product. Do not include secrets or special-category data in those messages.
• Technical and security data — IP address (often stored as a hash for rate limiting), device or browser type, approximate location derived from IP, necessary cookies or similar identifiers, and logs of access, changes, transfers, and deletions.
• Communications — emails, support messages, and verification codes related to contact or account flows.

6. Guest ordering

Guests who scan a table QR code may create a temporary table session and submit orders. We process session tokens, table identifiers, ordered items, optional notes, and timestamps so the Venue’s staff and kitchen can fulfil the order. Guests do not create a Sufra account.

Sufra does not process guest card payments. Payment collection remains the Venue’s responsibility through its own cash or card process. Never send payment card numbers, CVVs, or full card data to us or through the Service.

Order notes should be operational (for example “no onions”). Do not put health diagnoses, biometric data, or other special-category data in notes unless the Venue has a lawful basis and has told you so.

7. Sufra Assistant

The marketing site and the staff dashboard may offer an optional help assistant. If you submit a question, we process the conversation to generate a product answer. Messages are sent to our AI provider (OpenAI) which typically processes them outside Georgia, often in the United States. Submitting a question is optional; you can use the Service without the Assistant.

The Assistant is product help, not legal, medical, or financial advice. Do not paste passwords, API keys, PINs, payment data, or special-category data. We apply rate limits and do not use Assistant chats for direct marketing.

8. Legal grounds for processing

We process personal data only where at least one ground under the Law applies. For the Service those grounds are typically:

• Contract — to provide, configure, authenticate, and support Sufra for Venues under our Terms of Service or a setup agreement.
• Pre-contractual steps — to respond to setup and sales inquiries you send us.
• Legitimate interests — to secure the Service, prevent spam and abuse, keep sessions tenant-isolated, measure reliability, and improve the product, balanced against your rights.
• Consent — where you choose to use the Assistant, or if we later enable optional marketing or non-essential cookies (you may withdraw consent at any time; withdrawal is as easy as giving consent).
• Legal obligation — where Georgian tax, accounting, or other law requires retention, disclosure, or cooperation with competent authorities.

9. Special category data

Health, biometric, genetic, racial or ethnic origin, political, religious or philosophical, trade-union, sex-life, and certain criminal-record data are prohibited unless explicit written or digital consent is given, or a specific labour, healthcare, or other statutory exemption applies.

Sufra is not designed to collect special-category data. Venues must not instruct us to process such data unless they have a valid ground and appropriate safeguards. We do not use biometric identification, health profiling, or political or ethnic classification.

10. How we use data

• Provide and operate Sufra workspaces, menus, tables, kitchen boards, guest ordering, and related features.
• Authenticate users, manage staff roles, and protect accounts (including optional owner email codes).
• Respond to setup inquiries and support requests sent to contact@qaris.dev or by phone.
• Filter abusive, incomplete, or automated contact messages and protect systems from spam and attacks.
• Operate the optional Sufra Assistant for product help.
• Monitor availability, diagnose faults, keep audit logs required by law, and improve the Service.
• Comply with law and enforce our Terms of Service.

11. Cookies and similar technologies

Cookies, session tokens, and similar identifiers are personal data under Georgian law. We currently use only cookies and storage that are necessary to provide the Service you requested:

• Authentication cookies — to keep owners and staff signed in securely.
• Language preference (sufra_locale) — to remember English or Georgian (and guest-menu languages the Venue enables).
• Guest table session (httpOnly cookie, about 12 hours) — to bind a phone to an open table so orders cannot be placed remotely.
• Settings unlock and owner sign-in-code reminders — short-lived security cookies for sensitive dashboard actions.
• Local device storage — offline kitchen/table caches and Assistant panel size on your device.

These are required for the Service to function. We do not currently use non-essential analytics or marketing cookies. If we later do, we will update this Policy and obtain consent before enabling them.

12. Hosting and tenant isolation

Venue operational data is stored on a shared Qaris database (Supabase), not on a separate database set up in the Venue’s name. Each Venue is classified as its own tenant. Isolation measures include row-level security, signed-in tenant scope taken from authentication metadata that users cannot edit themselves, role-based staff access inside that tenant, and guest procedures that only work for a bound table session at that Venue.

Venues do not paste, store, or email their own database URL or API key through Sufra. Qaris operates the shared database as processor for Venue workspace data and as controller for Qaris account, security, and product-operation data as described in section 3.

This isolation is a security measure. It does not change who is controller of workspace data (the Venue) or who is processor (Qaris). Attempts to access another Venue’s data are prohibited.

13. Sharing and processors

We do not sell personal data. We share data only with processors who help us run the Service, under contracts that require confidentiality, appropriate security, and processing only on our (or the Venue’s) instructions. Typical categories:

• Hosting and content delivery — the application is hosted on infrastructure such as Vercel.
• Database, authentication, and realtime — Supabase (shared Qaris project; venue data is tenant-isolated).
• Transactional email — providers such as Resend for verification codes, owner invites, and sign-in codes. Automated messages are sent from no-reply@qaris.dev. That mailbox is not monitored and we do not send or read replies to it. For a person, write to contact@qaris.dev or use in-app Support.
• AI processing — OpenAI for the optional Sufra Assistant.

We may disclose data if required by law, court order, or to protect the rights, safety, and integrity of Qaris, Venues, users, or the public. Venue owners control staff accounts; staff see operational data according to roles the Venue assigns. Subsequent transfers by a processor are allowed only if compatible with the original purpose and the Law.

14. International transfers

Some processors store or process data outside Georgia. Transfers are permitted only where the Law is met and adequate safeguards exist in the recipient country or organisation, including: an adequacy finding (EU/EEA states typically qualify); contractual safeguards such as standard contractual clauses or an equivalent written contract; an international treaty; explicit written consent after you are informed that adequate safeguards may be absent; or another ground listed in the Law (for example vital interests).

Assistant conversations sent to OpenAI are an international transfer. You can avoid that transfer by not using the Assistant. We apply organisational and technical measures (access control, encryption in transit, minimisation, rate limiting) to transfers we make.

15. Retention

We keep personal data only as long as needed for the purposes above, then delete or anonymise it. In practice:

• Active account and Venue workspace data — for the life of the subscription plus a short wind-down so the Venue can export what it needs.
• Contact inquiries and verification challenges — as needed to handle the request, prevent abuse, and defend legal claims.
• Security, abuse, and automated system logs (access, alteration, disclosure/transfer, linking, deletion) — a limited period, and not longer than 3 years where the Law allows system-operation logs to be kept for auditability.
• Tax and accounting records — where Georgian tax or accounting rules require 3 to 6 years, those rules override earlier deletion.
• Direct-marketing consent records — if we ever run marketing, consent and withdrawal records for the campaign plus one year, as the Law requires.

Venues may delete or request deletion of workspace content subject to technical limits and legal retention duties. After account closure we delete or anonymise data we control within a reasonable time unless law requires longer retention.

16. Security, logging, and incidents

We use organisational and technical measures appropriate to the categories, volume, purposes, and risks of the data: access control by role, encrypted transport (HTTPS), tenant isolation on the shared Qaris database (including row-level security so one Venue cannot read another Venue’s rows), authentication protections (including optional owner email codes), minimisation, and periodic review of those measures. Staff and processors who handle data must keep it confidential, including after their engagement ends. No method of transmission or storage is 100% secure; you must keep passwords and staff credentials confidential.

Where personal data is processed electronically, we keep records needed to audit lawfulness: security and authentication events, rate-limiting, incidents, and provider infrastructure logs. Application-level records of access, alteration, disclosure/transfer, and deletion are maintained where the Service and its processors support them, for no longer than 3 years when kept for auditability.

If a personal-data incident occurs that is likely to cause significant harm or pose a significant threat to rights and freedoms, we record the incident, its effects, and the measures taken, and we notify the State Audit Office of Georgia within 72 hours of becoming aware, unless the Law says notification is not required. Where we act as processor we inform the Venue without delay. We notify affected individuals without delay in plain language unless a statutory exception applies.

17. Your rights

Subject to the Law, you may request:

• Information about processing and access to your data, including a copy.
• Rectification of inaccurate or incomplete data.
• Erasure (deletion) where the purpose has ended or processing is unlawful.
• Blocking / restriction of processing in the cases the Law provides.
• Portability of data you provided, where technically feasible and the Law allows.
• Withdrawal of consent, where processing is based on consent, without affecting processing already carried out lawfully.
• A complaint to the supervisory authority or a court (see section 21).

We fulfil access and copy requests within 10 working days of receiving a valid, sufficiently identified request. If we need more time we may extend by up to 10 further working days and will tell you why.

Venue guests and staff should first contact the Venue for operational data the Venue controls. For data we control, email contact@qaris.dev with the subject “Privacy request”, enough detail to locate the data, and information that lets us verify you are the data subject (or an authorised representative). We may refuse or limit a request only on grounds the Law allows, and we will explain that decision.

18. Children

Sufra is designed for restaurant businesses and adult staff. We do not knowingly collect personal data from children under 16. Under the Law, a person aged 16 or over may give their own consent to processing; below 16, a parent or guardian must consent. If you believe a child provided data to us, contact us and we will delete it or take other appropriate steps.

19. Automated decisions and profiling

We do not make solely automated decisions that produce legal or similarly significant financial effects about you. Rate limiting, spam filters, and tenant isolation are security measures, not profiling of guest behaviour for marketing. The Sufra Assistant does not decide whether you receive the Service.

20. Data Protection Officer and impact assessments

A Data Protection Officer is mandatory for public institutions, insurers, banks, microfinance, credit bureaus, electronic-communications companies, airlines, airports, and medical institutions, and for controllers/processors that process a large volume of personal data or carry out systematic large-scale monitoring of behaviour.

Qaris is not a listed public, financial, telecom, aviation, or medical institution. We will appoint a Data Protection Officer if our processing becomes large-scale or otherwise legally required, notify the State Audit Office of Georgia within 10 working days of appointment, and publish the officer’s identity and contact details. Until then, privacy requests go to contact@qaris.dev.

We carry out a written Data Protection Impact Assessment before processing that is likely to create a high risk to rights and freedoms (including large-scale special-category processing or systematic large-scale behavioural monitoring). If high risk cannot be reduced, we do not carry out that processing.

21. Complaints and the supervisory authority

You may lodge a complaint with the State Audit Office of Georgia, apply to a court, or (where applicable) a superior administrative body if you believe your rights under the Law have been violated. From 2 March 2026, personal-data supervision previously exercised by the Personal Data Protection Service is carried out by the State Audit Office of Georgia.

You may also ask that authority to block processing while it reviews your application, as the Law provides.

22. Changes to this Policy

We may update this Privacy Policy when the Service or the Law changes. The “Last updated” date at the top will change. Material changes will be posted on this page and, where practical, we will also notify Venues by email or in-product notice. Continued use after an update means you have been informed of the revised Policy. Where the Law requires a new consent, we will ask for it.