Legal
Privacy Policy
Last updated October 30, 2026
This policy explains how NG8 Group LLC (“UKU”, “we”, “us”) handles personal information when you visit ukuos.com, use the UKU dashboard, register apps, online ordering pages and UKU Sites, or connect an app to UKU.
In short: we collect what we need to run the Services; we do not sell or share personal information for advertising; there are no advertising or analytics trackers on our sites; card numbers go to Stripe, never to us; and for a business’s customers and staff, we act on that business’s behalf.
1.Our two roles
- Where we decide (controller or business). For information about the businesses that sign up (owners, admins and their account details), visitors to ukuos.com, people who use our free website grader, and people who contact us, UKU decides how the information is used, and this policy applies in full.
- Where a business decides (service provider or processor). Businesses use UKU to serve their own customers and manage their staff. For that information (orders, loyalty, gift cards, messages, reservations, staff records and so on), the business is in charge, and UKU processes it only on the business’s behalf under our Terms of Service. The business’s own privacy notice applies. If you are a customer or employee of a business that uses UKU, please contact that business first; we will help where we can (see Your rights).
2.Information we collect
| Category | Examples | Source |
|---|---|---|
| Account and business details | Name, email, password (stored only as a one-way hash), business name, address, phone, opening hours, map location of the business, menus and prices. For text-message registration: legal business name, tax ID and contact details. | You, when you sign up and set up the business |
| Payment account details | Your Stripe account reference and its status, payment, refund, payout and dispute records. Identity and bank details for payouts are given to Stripe directly, not to us. | You and Stripe |
| Staff records | Names, roles, contact details, PINs (stored only as a one-way hash), shifts, clock-in and clock-out times, sales and tips attributed to them. | The business |
| Customer and guest information | Name, phone number, email, delivery address and instructions, order history, notes, loyalty balance, gift card balances and eGift recipients, feedback, reservations and waitlist entries, house accounts, the caller details of phone orders. | The guest, at checkout or at the counter; the business; connected marketplaces and phone-ordering partners |
| Unfinished checkouts | The name, phone, email and cart a guest has typed on an online ordering page before placing the order, so the business can send an abandoned-cart reminder if the guest opted in. | The guest’s browser, as they type |
| Marketing consent records | The exact opt-in wording shown, when consent was given or withdrawn, and the IP address and browser of the opt-in. | The guest |
| Assistant and connected apps | Messages to the assistant, its answers and the actions it took or proposed; which AI apps or integrations are connected and with what permissions. | You and your team |
| Device and usage information | IP address, browser and device type, sign-in sessions, paired register identifiers, browser push subscriptions, and server logs of requests and errors. | Your browser or device, automatically |
| Website grader | The website address and business details you ask us to grade, the report, and public listing details from Google. | You, the public website, Google |
| Communications | Emails and messages you send us, and our replies. | You |
We do not ask for or knowingly collect Social Security numbers, driver’s licence numbers, health information or biometric information through the Services.
3.How we use information
- to provide the Services: ring up and route orders, take payments through Stripe, send receipts and order updates, run loyalty, gift cards, marketing, reservations, scheduling and online pages;
- to create and secure accounts, verify email addresses, prevent fraud and abuse, and keep audit records of changes;
- to send messages a business sends to its customers, honouring consent, quiet hours and opt-outs;
- to provide support and tell you about changes to the Services, your account or these policies;
- to maintain, debug and improve the Services, including measuring how features are used;
- to comply with law, tax and accounting obligations, and to establish or defend legal claims.
We do not use personal information for targeted advertising, and we do not sell it.
4.The UKU assistant and AI
The UKU assistant runs on Claude, an AI model provided by Anthropic, PBC through its commercial API. When someone at a business uses the assistant, we send Anthropic their message and the business information the assistant looks up to answer it, which can include menu and sales data, staff names, and customer names, order notes and reviews when the question needs them. Staff PINs, passwords, keys and card details are never sent.
- No training on your data. UKU does not use business data or customer data to train AI models. Under its commercial terms, Anthropic does not train its models on data sent through its API.
- People stay in control. The assistant proposes changes that a person confirms, or acts within limits the business sets, and every action is logged.
- Third-party AI apps. If a business connects an AI app such as ChatGPT or Claude to UKU, information the business lets that app access goes to the app’s provider (for example OpenAI or Anthropic) under the business’s own account with that provider, and that provider’s privacy policy applies.
- Phone ordering. If a business connects a phone-ordering partner, the partner receives the menu and hours and sends us orders with the caller’s name and number. Our partner terms require it to disclose automated answering and any recording, and not to train on callers’ data without consent.
5.Payment information
Card payments are processed by Stripe. Card numbers and security codes are entered only into Stripe’s card readers and Stripe’s secure payment forms, and go straight to Stripe: UKU never receives or stores them. We keep Stripe’s reference for each payment with its amount, time and status. Stripe’s handling of payment information is described in the Stripe Privacy Policy.
6.Location
The register apps ask for permission to use the device’s location because Stripe requires it to connect to card readers; UKU does not record the device’s location. We store the business’s address and map location to show it on its pages and listings, and delivery addresses to deliver orders. We do not use IP addresses to track where people are.
9.How long we keep information
We keep information while the business’s account is open and as long as needed for the purposes above. Specific periods:
| Information | Kept for |
|---|---|
| Data exports | 7 days after the export is ready, then deleted |
| Unfinished checkout details | 30 days, then deleted (only used for reminders if the guest opted in) |
| In-app notifications | 90 days |
| Records of webhook deliveries to a business’s integrations | 30 days |
| Expired sign-in sessions | 7 days after they expire |
| Database backups | Rolling, about 7 days |
| After an account is closed | Personal information of customers and staff is erased or de-identified when the closure is processed. Sales, payment, refund, tax and accounting records are kept, stripped of personal information, for 7 years, then purged. |
| Marketing consent and opt-out records | As long as needed to prove consent and to make sure people who opted out are not messaged again, including after an account is closed. |
10.Security
We protect information with encryption in transit and at rest, one-way hashing of passwords, PINs and access tokens, encryption of stored third-party credentials, access controls that keep each business’s data separate, restricted and logged staff access, and audit records of changes. No system is perfectly secure; if we confirm a security incident affecting your information, we will notify you and the authorities as the law requires.
11.Your rights and choices
Businesses using UKU
The account owner can see, correct and export the business’s data in the dashboard (Settings, Data & privacy), erase an individual customer’s personal information from the Customers page, and close the account. See Account deletion.
Customers and staff of a business
Ask the business to access, correct or delete your information; it can do this in UKU. You can also email [email protected] with the business’s name and the phone number or email it has for you. We will pass your request to the business, help it respond, and tell you what happened. To stop marketing, reply STOP to a text or use the unsubscribe link in an email.
US state privacy rights
Depending on where you live, including California (CCPA, as amended by the CPRA), Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia, you may have the right to:
- know what personal information we collect, use and disclose, and get a copy of it in a portable format;
- correct inaccurate personal information;
- delete personal information, subject to legal exceptions;
- opt out of the sale or sharing of personal information, targeted advertising and certain profiling (we do none of these);
- limit the use of sensitive personal information (we use it only for purposes the law permits, such as signing you in);
- appeal our decision on your request, and not be treated differently for using your rights.
To make a request, email [email protected]. We will verify your identity by matching details we already hold (for example by asking you to confirm the request from the email address or phone number we have for you) and respond within 45 days, or tell you if we need more time as the law allows. You can use an authorised agent with your signed permission. If we deny your request, you can appeal by replying to our decision; if the appeal is denied, you can contact your state attorney general. Where we hold the information on behalf of a business, we will refer you to that business or forward your request.
In the last twelve months we collected the categories in the table above (identifiers, customer records, commercial information, internet activity, approximate location from addresses, professional information about staff, and account credentials), from the sources listed, for the purposes in this policy, and disclosed them for business purposes to the service providers and recipients described in the sharing section. We did not sell or share any of them.
Bank and financial information
UKU does not currently connect to bank accounts. If we add bank connections for bookkeeping, a bank-data provider will collect bank login details directly, and we will update this policy and handle that information as the Gramm-Leach-Bliley Act and similar laws require.
12.Children
The Services are meant for businesses and are not directed to children. We do not knowingly collect personal information from children under thirteen. A business may record an order from a younger guest at its counter; businesses must not enrol children under thirteen in marketing. If you believe a child’s information is in UKU, contact [email protected] and we will delete it.
13.Where information is stored
The Services are offered to businesses in the United States, and information is stored and processed in the United States. Some service providers, such as Cloudflare, process network traffic across their global networks.
14.Changes to this policy
We will update this policy when our practices change and change the “last updated” date above. For a material change, we will tell account owners by email or in the dashboard before it takes effect.
15.Contact
NG8 Group LLC, [Company address]. Email [email protected].