Privacy Policy

1. Our role

For account, website and pilot information, Lukama generally decides why and how information is used. For catering customer information entered by a restaurant, the restaurant generally makes those decisions and Lukama processes the information to provide the service.

2. Information we collect

We may collect account and contact information; restaurant identity, locations, menus and settings; catering inquiries and customer communications; quotes, invoices, transaction references and fulfillment records; uploaded files; integration settings; support and research responses; and device, security and diagnostic logs. Payment card details are handled by the payment provider rather than stored by Lukama.

3. Sources of information

Information comes from account owners and team members, customers submitting a restaurant’s catering form, connected services chosen by the restaurant, communications with Lukama and technical activity needed to operate and secure the service.

4. How we use information

We use information to provide and personalize workspaces, deliver requested emails and documents, process integrations, prevent abuse, troubleshoot problems, support users, improve Lukama, maintain records and meet legal obligations. We limit collection to information reasonably needed for these purposes.

5. Service providers and disclosures

We use providers for hosting, databases, authentication, email delivery, payments, calendar connections, anti-abuse protection, backups and monitoring. Current core services include Cloudflare, Supabase, Resend, Stripe and Google when a user enables the relevant feature. They receive only information needed to provide their service. We may also disclose information when required by law, to protect rights and safety, or during a business transaction subject to appropriate safeguards.

6. No sale or targeted advertising

Lukama does not sell personal information and does not use personal information for cross-context behavioral or targeted advertising. If this practice changes, we will update this notice and provide any legally required choice before the change applies.

7. Retention

We retain information while an account is active and as reasonably needed for service delivery, security, recovery, legal obligations and dispute resolution. Workspace owners can export available records and request deletion. Backup copies may remain until their normal protected rotation expires. Financial and audit records may be retained when legally required.

8. Security

We use workspace isolation, access controls, encrypted connections, backups, audit records and service monitoring. No online service can guarantee absolute security. Users should protect credentials, review account access and report suspected misuse promptly.

9. Your privacy choices

Depending on where you live, you may request access, correction, deletion or a portable copy of personal information, or object to certain processing. Account owners can use Settings → System for workspace export and deletion requests. Anyone may email hello@lukama.app. We may verify identity and authority before completing a request. If we deny a request, you may reply to appeal the decision.

10. Texas residents

Texas residents may have rights under the Texas Data Privacy and Security Act, including access, correction, deletion, portability and rights concerning certain sales, targeted advertising or profiling. Lukama does not sell personal information or use it for targeted advertising. Privacy requests and appeals may be submitted at the contact address below without discrimination for exercising a right.

11. International users and transfers

Lukama is operated from Texas, United States. Information may be processed in the United States and other countries where our service providers operate, which may have different privacy laws from your country. We use contractual, organizational and technical safeguards appropriate to the service. Where applicable law requires an approved transfer mechanism or additional agreement, such as for certain European or United Kingdom transfers, we will work with the restaurant before beginning that processing. Mandatory local privacy rights remain available.

12. Children

Lukama is a business service and is not directed to children. Users should not intentionally submit information about children unless it is genuinely necessary for a lawful catering purpose and handled with appropriate authorization.

13. Changes and contact

We may update this policy as the service or law changes and will post the new effective date. Questions, requests and appeals may be sent to hello@lukama.app.