Legal

Privacy Policy

How Ulupa collects, uses and protects your personal data.

Last updated: 1 June 2026

1General provisions

This Privacy Policy explains how Ulupa (the platform operating at ulupa.ge, hereinafter 'Ulupa', 'we' or the 'platform') collects, uses, stores and protects the personal data of users of the website and mobile applications.

We process personal data in accordance with the Law of Georgia 'On Personal Data Protection' and, where applicable, the principles of the EU General Data Protection Regulation (GDPR).

By using ulupa.ge or registering an account, you confirm that you have read and understood this Policy.

2Who we are (data controller)

The data controller is Ulupa, the operator of the ulupa.ge platform, located in Tbilisi, Georgia.

For any questions about the processing of your personal data, contact us at support@ulupa.ge.

3What data we collect

We collect only the data needed to provide our service. Depending on how you use the platform, this may include:

Account data: first and last name, email address, phone number, profile photo, role (buyer or cook).
Order and delivery data: delivery address, entrance, floor, apartment, district, geolocation coordinates, order comments and history.
Cook data: information provided during verification — kitchen photos, verification documents, bio, specialisation, pickup address and payout bank details.
Payment data: processed by our payment partners (TBC Bank, Bank of Georgia). We do not store full card numbers on our servers.
Technical data: IP address, device and browser information, cookies and analytics data.

4Purposes of processing

We process your personal data in order to:

create and manage your account and provide access to the platform;
process, prepare and deliver your orders, and connect buyers with cooks;
process payments and, where necessary, refunds;
verify cooks and maintain food-safety and quality standards;
provide customer support and respond to your requests;
send service notifications about your orders and account;
analyse and improve the platform and ensure its security;
comply with our legal obligations.

5Legal basis for processing

We process personal data on the following legal bases set out in the Law of Georgia 'On Personal Data Protection': performance of the contract between you and the platform; your consent; our legitimate interests in operating and improving the service; and compliance with legal obligations.

You may withdraw your consent at any time; this does not affect the lawfulness of processing carried out before withdrawal.

6Who we share data with

We do not sell your personal data. We share it only with parties necessary to provide the service:

Cooks — receive the buyer's name and delivery details needed to prepare and deliver an order;
Payment providers — TBC Bank and Bank of Georgia — to process payments and refunds;
Delivery partners — Glovo, Wolt, Yandex and similar couriers — to deliver orders;
Google Maps — to geocode addresses and calculate delivery distance;
Infrastructure and analytics providers — Supabase, Railway, Vercel and Sentry — for hosting, error monitoring and analytics;
Government authorities — where required by law.

7International data transfer

Some of our service providers process data on servers located outside Georgia, including in the European Union and the United States. Where data is transferred internationally, we take steps to ensure an adequate level of protection in line with applicable law.

8Data retention

We keep your personal data for as long as your account is active and for as long as necessary to provide the service.

After an account is deleted, we retain certain data only for the periods required by law (for example, accounting and tax records), after which it is deleted or anonymised.

9Data security

We apply technical and organisational measures to protect your data, including encrypted connections, row-level access control in our database, restricted staff access and continuous monitoring.

No method of transmission over the internet is completely secure, but we work continuously to protect your information.

10Cookies and analytics

We use cookies and similar technologies to keep you signed in, remember your preferences and understand how the platform is used.

For analytics we use privacy-friendly tools (such as Vercel Web Analytics and Speed Insights). You can manage cookies through your browser settings.

11Your rights

Under the Law of Georgia 'On Personal Data Protection' you have the right to:

obtain information about the processing of your data and access a copy of it;
request correction, updating or deletion of your data;
request restriction of, or object to, processing;
withdraw consent at any time;
lodge a complaint with the Personal Data Protection Service of Georgia (personaldata.ge).

To exercise these rights, contact us at support@ulupa.ge.

12Children's privacy

The platform is intended for users aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has provided us with data, please contact us so we can delete it.

13Changes to this Policy

We may update this Policy from time to time. The current version is always available on this page with the 'last updated' date. Significant changes will be communicated through the platform.

14Contact us

If you have any questions about this Privacy Policy or how we handle your data, contact us at support@ulupa.ge or through the support chat on the platform.