Privacy Policy

Subb Specialty Portal (licence FF6539, No. 1633552), Nad Al Hammar, Dubai, UAE, is responsible for your personal data on Subb. Contact: hello@subb.ae or WhatsApp 0502239240.

• Account: your email address and, once you add them, your name and phone number. If you sign in with Google, Google shares your name, email and profile picture with us. If you sign in with Apple, Apple shares your email address, or a private relay address if you choose to hide yours, and may share your name the first time you sign in; we also keep a token from Apple so that we can end Sign in with Apple for Subb when you delete your account. We never receive your Google or Apple password.
• Bookings: the café, package, date, time, number of guests, any staffing preference you choose, the event address and emirate, an optional map link, and any notes you write for the café.
• Payments: the amount, status and reference of each payment and refund. You enter your card details on Stripe's page; they never reach us.
• Messages: what you write to a café, or to us, in Subb's chat.
• Reviews and disputes: what you write, and any photos you attach to a dispute. Reviews are shown on the café's page without your name.
• Booking without an account: the name, UAE mobile number and email address you give at checkout, kept with that booking. We keep these bookings under an internal account that no one can sign in to, and they do not appear in an account you sign in to later. In our database we store only a one-way fingerprint of each booking link, never the link itself.

If you run a café on Subb, we also collect: the café's name, contact person, email and phone; the details and photos on your page; your trade licence and the documents we ask for to verify your business; and the bank account we pay you to. Bank details are visible only to you and to the Subb team that handles payouts, and never to customers.

• Cookies that keep you signed in and remember your language. We use no advertising or analytics cookies.
• In the app: a notification token, if you turn notifications on, so we can tell you about your bookings.
• A one-way, irreversible fingerprint of your network address, used only to limit repeated attempts such as sign-in codes. We do not store your IP address itself.
• Our hosting provider keeps short-lived server logs, which include IP addresses, to run and secure the service.
• A cookie that lets you reopen a booking on this device after using its link.
• One-way, irreversible fingerprints of your email address or mobile number, used only to limit repeated requests for booking links and codes.

We do not use analytics, advertising or tracking tools, and we do not track you across other apps or websites.

To create and run your account and bookings; to give the café what it needs to serve you; to take payments, give refunds and pay cafés; to send booking confirmations and updates by email and notification, and to message cafés on WhatsApp about their bookings; to verify cafés before they appear on Subb; to handle complaints and disputes; to keep Subb secure; and to meet our legal and accounting obligations.

We do not sell your data, and we do not use it for advertising.

• When you book: your name and emirate, the package, the number of guests, the date and time.
• Once the café confirms: also your phone number, full address, map link and notes.

A café only ever sees bookings made with that café. Notifications to cafés do not include your name.

We use these providers to run Subb. Each processes data on our instructions, only for the purpose listed:

• Stripe: card payments, refunds and the card hold. Receives your name, email and payment details.
• Supabase: our database, accounts and file storage.
• Vercel: hosting for the website and the app.
• Sentry (EU region): error reports, so we can find and fix faults.
• Meta (WhatsApp Cloud API): booking messages to cafés, and our replies when you contact us on WhatsApp.
• Zoho Mail and ZeptoMail: sending emails such as sign-in codes and booking confirmations.
• Google Firebase Cloud Messaging: delivering app notifications.
• Google: sign-in, if you choose it.
• Apple: Sign in with Apple, if you choose it, and delivering app notifications to iPhones.

Some of these providers store or process data outside the UAE, including in India, where our database is hosted, the European Union and the United States. We choose providers that protect data to a standard consistent with UAE law.

• Account details: while your account is open.
• Booking, payment and tax records, including refunds, payouts, dispute outcomes, the bank details recorded on each payout and the star ratings you gave (without your name): 5 years.
• All other account data, including café verification documents, your messages, the text of your reviews and of disputes you raised, uploaded files and our records of changes to your email and phone: deleted within 30 days of a deletion request. If a booking or payment is still in progress, the data we need to finish it, such as the event address and your contact details and our records of changes to them, is deleted within 30 days of the day it is finished.
• Server logs: deleted automatically by our providers after a short period.
• Bookings made without an account: the contact details are kept with the booking record until you ask us to delete them, and booking links stop working about a week after the event.

In the app, open Account and choose Delete my account. If nothing is in progress, the deletion starts straight away and we email you to confirm it.

What is removed straight away: your name, email, phone and picture; your messages in the app; the text of your reviews (the star rating stays, without your name); the text of disputes you raised; your booking addresses and notes; your notification tokens; and our records of changes to your email and phone. You are signed out everywhere. If you signed in with Apple, we also ask Apple to end the link between your Apple account and Subb. A café is taken off Subb, and its description, package descriptions, bank details and messages with us are removed. Photos and other stored files, including dispute photos, a café's photos and its verification documents, and your WhatsApp conversations with us, are deleted within 30 days.

What we keep: booking, payment, payout and tax records, for 5 years, only to meet our legal obligations and never to contact you. They are linked to an account with no name or contact details; a café's name stays on its past bookings, and each payout record keeps the bank details it was paid to. The outcome of a dispute (its status and amounts) is kept with its booking, and the star ratings you gave stay without your name. Stripe, our payment provider, keeps its own payment records, and WhatsApp keeps media sent to us there for about 30 days. Copies of documents sent to our support mailbox are deleted from it within 30 days. Everything else linked to your account is deleted within 30 days of your request.

If a booking or payment on your account is still in progress (for example an upcoming event, a refund or an open dispute), you can ask us to delete the account once that has finished. We delete what we don't need to finish it within 30 days of your request; we then delete the account automatically once it has finished, email you, and delete the rest within 30 days of that day. A café that asks us to close it stops taking new bookings straight away, and its verification documents are deleted at once. A payout Subb still owes a café does not stop the deletion, as long as its bank details are on record: we still pay it to the bank details recorded for it.

You can also ask us to delete your data by emailing hello@subb.ae or messaging 0502239240. We reply within 30 days and, once we have confirmed that the account is yours, delete it as described above.

Bookings made without an account: choose Delete my details on your booking page or on the sign-in page, or go to app.subb.ae/m/delete. We email a code to the address you booked with. Once you enter it, unpaid bookings are cancelled; your name, mobile number, email, event addresses and notes are removed; and your booking links stop working. Booking and payment records are kept as described above.

You can ask us to tell you what data we hold about you and give you a copy, correct anything wrong, delete your data, restrict or object to how we use it, and stop non-essential emails. Contact hello@subb.ae or WhatsApp 0502239240. We reply within 30 days. You can also complain to the UAE Data Office.

Data is encrypted in transit. Access is limited to the people who need it. A café sees a customer's contact details only for that café's confirmed bookings. Card details never reach our systems. If a breach puts your data at risk, we will tell you and the authorities as the law requires.

We may update this policy. The date at the top shows the current version. We will tell you by email about material changes.

This policy is published in Arabic and English. If the two versions conflict, the Arabic version prevails.