Privacy Policy

This Privacy Policy explains how PT. SURA AND BIXI RESTAURANT MANAGEMENT (SURA), the operator and personal-data controller, handles information when authorized employees and managers use the SURA Manager web or mobile application.

SURA Manager is a private workplace service. Access is limited to accounts authorized by SURA.

Account information: email address, phone number, name, role, team, store or department, and authentication information.

Workplace content: chat messages, instructions, todos, reports, meeting notes, attendance and sick-leave records, comments, expense and sales records, uploaded photos, videos, audio and files, and operational updates submitted by authorized users.

Recruitment information: with the applicant's consent, authorized managers may record an applicant's name, contact information, photograph, signature, preferred position and store, and optional age, height and weight. Recruitment records are deleted after one month.

Service information: device and browser information, push-notification tokens, sign-in events, access records, and technical error logs. The app does not use information for cross-app tracking or advertising.

We use information to authenticate authorized users, provide role-based access, deliver workplace messages and notifications, coordinate tasks and operations, protect the service, investigate errors or misuse, and provide support.

We do not use SURA Manager information to sell advertising or to provide customer ordering or payment services.

Information is shared inside SURA according to a user's role and permissions. Supabase provides database, authentication and file storage; Vercel provides application hosting; Google Firebase and Apple Push Notification service deliver notifications; and OpenAI processes text needed for translation, authorized drafting, and temporary speech-to-text transcription.

These providers may process information outside Indonesia, including in the United States. Information is limited to what is necessary for the service and is handled under contractual security and confidentiality obligations. OpenAI receives workplace text, not SURA passwords or authentication credentials.

Refrigerator and hygiene report records and their photos are automatically deleted after 10 days. Meeting-note text remains available as a workplace record, while its photo and video attachments are deleted after 10 days. Recruitment records are deleted after one month. Voice recordings used for speech-to-text are sent only for transcription and are not retained as chat audio. Push device tokens are removed when an account is deleted or the token becomes invalid.

Account data is kept while employment access is active. On in-app account deletion, sign-in access, personal device tokens and notification data are deleted and the account profile is de-identified. Operational, financial, attendance and audit records may remain where necessary for employment, accounting, safety, dispute, security or legal obligations, with access restricted by role. They are deleted or de-identified after the applicable business or legal retention period ends.

Users may request access, correction, export or deletion through the in-app Delete account function or the contact below. We verify requests before processing them.

We use access controls, authentication, transport encryption, role-based permissions, logging, and other reasonable safeguards designed to protect information. No internet service can guarantee absolute security.

SURA Manager is a workplace application and is not directed to children. We do not knowingly collect information from children through this service.

Before authenticated use, the app explains and asks the user to agree that workplace text may be sent to OpenAI for translation among Korean, English, Indonesian and Chinese and for authorized drafting. See the separate AI Processing Notice linked in the app.

We may update this Privacy Policy when the service or applicable requirements change. The revised version will be posted on this page with an updated effective date.