NURI Concierge privacy notice

Version 1.0 · 23 October 2026

Who is responsible

NURI Korean BBQ Canary Wharf is operated by VISION31 LIMITED, the data controller for this service, company number 15296904, registered at 33 Westferry Circus, London, E14 8RR. For privacy questions or requests, contact info@nurikbbq.co.uk or write to that address. The business owner monitors the privacy inbox daily.

Chat and enquiries

Concierge provides AI-generated restaurant information and booking guidance. AI can make mistakes: please confirm important details with NURI. It does not confirm bookings or make decisions with legal or similarly significant effects about you. Book a table opens our separate booking service.

Chat sends your message and recent conversation to OpenAI to generate a reply. The application keeps conversation history in the open page rather than saving it as an enquiry or a chat transcript in our database. Our API requests ask not to store responses; this does not mean provider security logs or other operational records never exist.

For group/private dining, we collect the contact details you provide, party size, proposed date/time, enquiry type and optional notes. We save the enquiry and notification record in our database and email the NURI team. Submission is an enquiry, not a reservation or a marketing signup.

Hosting/security services process request information such as IP addresses and technical logs. Application rate limits use salted hashes of relevant identifiers to limit abuse and duplicate submissions. Their short counting windows are not a promise of immediate physical deletion from every log or backup.

Why we use information

• Your own booking enquiry: Article 6(1)(b), where processing your contact details and arrangements is necessary to take steps you request before a possible booking contract.
• AI restaurant questions, enquiries for an organisation, proportionate follow-up records and service security: Article 6(1)(f), our legitimate interests in answering guests, managing restaurant enquiries and preventing abuse or duplicate notifications. We limit the information used, provide direct contact alternatives and consider your privacy interests. General AI chat is not treated as necessary for a booking contract.
• Required rights and breach handling: Article 6(1)(c), only where necessary to meet an applicable legal obligation, including UK GDPR duties to respond to rights requests or report a qualifying breach.

The form’s privacy acknowledgement is not marketing consent or consent to process health information. We do not use enquiry details to enrol you in marketing, sell your data or build advertising profiles.

Please avoid sensitive details

Do not include health, allergy, medical or other sensitive information in chat or the form. There is no dedicated allergy/dietary collection field. Contact NURI to arrange an appropriate way to discuss requirements. If sensitive details arrive unexpectedly, the owner will restrict further handling, assess the lawful response and remove unnecessary information through our request-handling procedure. A warning cannot prevent someone entering sensitive free text, and already transmitted copies may need separate handling. Concierge is not intended to collect health information.

Service providers and overseas processing

Our service uses Vercel for hosting/security, OpenAI for AI replies, Supabase for enquiry storage, Resend for notifications and our Microsoft 365 business mailbox supplied through GoDaddy. Squarespace hosts the surrounding website and EatApp handles the separate booking flow; this notice covers Concierge. Enquiries are handled by authorised NURI personnel; we do not sell enquiry data.

The enquiry database and its scheduled backups are hosted in London. The application runs in the United States. AI processing can involve the US, and Resend stores its service data there. Supabase is based in Singapore and provides support and operational processing outside the database region. Microsoft, GoDaddy and other providers also use international operations and subprocessors. We do not promise UK-only processing.

Applicable provider processing terms contain cross-border safeguards, including standard contractual clauses with the UK Addendum or the UK International Data Transfer Agreement where required. These are contractual protections, not a guarantee that overseas processing has no risks. Contact us for information about relevant recipients and safeguards or a copy, subject to necessary redactions. Provider account/billing and some security information may also be handled for their own purposes under their privacy notices.

Provider terms and further details: Vercel, OpenAI, Supabase, Resend and GoDaddy. Microsoft’s processing terms are available through its Data Protection Addendum.

How long information is kept

The approved database retention period is 180 days from enquiry creation, to handle the enquiry, follow-up and related service issues. Enquiries become eligible for deletion at 180 days; the daily 03:15 UTC job removes eligible enquiries and their associated notification records. A failed or held job can delay removal and requires owner review. Earlier requests and a specifically justified legal exception are assessed individually; 180 days is not a minimum period we insist on keeping every record.

• Business emails: the owner reviews Concierge copies older than 180 days weekly, including sent, archived and deleted-item copies, and removes copies no longer needed. A continuing booking, complaint or legal need is recorded with its own purpose and review date. Mailbox recovery/hold systems may keep copies after ordinary deletion; we do not claim an automatic 180-day mailbox purge.
• Exports: no routine enquiry exports. Any necessary working copy has a restricted location and disposal deadline, is removed when its purpose ends and normally no later than the original enquiry’s expiry, unless a specific continuing need is documented.
• Providers: OpenAI’s standard abuse-monitoring retention is up to 30 days, with legal/security exceptions; response-storage settings do not eliminate all logging or caching. Resend publishes a 30-day email and log retention window for its standard plans and a seven-day backup window. Hosting and mailbox records follow their applicable provider controls and any necessary legal/security retention.
• Backups: Supabase’s standard Pro daily-backup window is seven days. Backup/recovery copies are not ordinary working records; individual erasure may await their expiry. We keep a minimal record of erased identifiers so they can be suppressed before any restored service is reopened. A published backup window is not a promise of immediate physical erasure from all provider systems.

Database deletion cannot recall a delivered email. Request/incident records keep only necessary evidence of handling, reviewed when the case closes and while a specific legal or complaint need continues. We explain any applicable retention exception rather than promising universal deletion.

Your choices and rights

Using Concierge is optional; you may contact NURI or use Book a table. Depending on the processing and applicable law, you may request access, correction, erasure, restriction, portability or object to processing, including processing based on legitimate interests. Email the privacy contact with enough information to locate your enquiry. We verify identity proportionately, explain exceptions and normally respond within one month, subject to applicable clarification or extension rules. Pending email notifications are paused, drained and reconciled as necessary before deletion; an unresolved send is not blindly retried. You can also complain to the UK Information Commissioner’s Office.

Page storage and updates

The Concierge application does not add advertising cookies or analytics tracking. Hosting, security and the surrounding website may have their own necessary storage and policies. This notice covers Concierge, not every service reached through its links. Material changes will be reflected here before new processing begins.