Privacy policy

This is the whole of it, in plain English. If anything below is unclear, ask us and we will answer in writing.

Last updated 26 August 2026 · Applies to backtotheroot.ae and the Back to the Root app

Who we are. Back to the Root is a trading name of [REGISTERED COMPANY NAME] Group, Abu Dhabi, United Arab Emirates. We are the controller of the personal data described here, which means we decide what is collected and why, and we are the ones answerable for it. Reach us at or .

We handle personal data under the UAE Personal Data Protection Law (Federal Decree Law No. 45 of 2021). Where a customer is in the EU or the UK, we apply the equivalent GDPR rights described below.

1. What we collect, and why
2. The body assessment, and why it is different
2a. Crash reports, and what is stripped out of them
3. What allows us to hold it
4. Who else sees it
5. The meal planner and AI
6. Payment details
7. How long we keep things
8. How it is protected
9. Your rights, and how to use them
10. Cookies and what is stored on your device
11. Children
12. Changes to this notice

1. What we collect, and why

We collect the least we can and still get hot food to the right door.

What	Why we need it
Name	It goes on the box so the right bag reaches the right person.
Mobile number	The driver calls it if they cannot find the door. We do not market to it.
Delivery address	To deliver. It is on the driver's run sheet for that morning only.
Email address	Order confirmations, delivery notices, and signing in.
What you ordered	To cook it, pack it, bill it, and show it to you again next week.
Allergies you tell us about	Printed on every box and read out at packing. See section 2.
Delivery history	So you can see where a box is, and so we can settle a dispute about one.
Notes you write to the kitchen	Gate codes, spice preferences, where to leave the bag.
Crash reports	When something breaks in your browser we are sent the error, the page it happened on and which browser you were using — so we can fix it instead of waiting for somebody to describe it over the phone. See section 2a.

What we do not collect. We do not buy data about you from anyone. We do not track you across other websites. There is no advertising pixel on this site, no Facebook tag and no Google Analytics. We do not sell or rent your details to anybody, for any amount, ever.

2. The body assessment, and why it is different

If you use the body assessment we ask for your sex, age, height, weight, activity level and goal, and we work out a calorie and protein target from them. If you tell us about an allergy or an intolerance, that is health information too.

Under UAE law and under GDPR this is sensitive personal data, and it gets stricter handling:

We only hold it because you chose to give it to us, and you can withdraw that at any time by asking us to delete it.
You can use the assessment without signing in. If you do, the result stays in your own browser and never reaches us.
Allergy notes are shown to the kitchen and packing staff who are handling your box that morning, because that is the point of them. They are not shown to anyone else and not used for anything else.
It is never used to set a price, and it is never shared with an insurer, an employer, or anyone else. There is no circumstance in which we would.

How the number is worked out, and what it is not. The calorie figure comes from the Mifflin St Jeor equation, the same formula used in clinics: it estimates what your body burns at rest from your sex, age, height and weight, multiplies that by an activity factor for how much you train, and then adds or subtracts for the goal you picked. The protein target is set from your body weight and your goal.

It is an estimate, not a medical opinion, and we are not doctors or dietitians. A formula cannot know about your thyroid, your medication, a pregnancy or a condition you are being treated for. If any of those apply, please talk to your doctor before changing what you eat, and take their number over ours. Nothing on this site is a diagnosis or a treatment, and it is not a substitute for advice from someone qualified who has actually met you.

2a. Crash reports, and what is stripped out of them

If a page fails, your browser sends us a short report. It is worth being precise about what is in one, because the honest answer is "less than you would expect":

What it contains: the error message, the technical stack trace, the path of the page (/order.html), your browser and version, and your window size.
What is removed before it leaves your device: the query string of any address, anything shaped like an email address, and anything shaped like a UAE phone number. This happens in your browser, not on our server, so the data never reaches us at all.
What is never in one: your name, your delivery address, what you ordered, or your assessment.
If you were signed in, the report is tagged with your account so we can trace a fault back to an order if you ask us to. If you were not, it carries no identity whatsoever.
Only our staff can read them. They cannot be read back by anyone else, including you, which is deliberate: a stack trace can contain a fragment of whatever was on screen.
The same fault within an hour is counted rather than stored again.

We use these only to fix faults. They are not analytics, they are not used to build a picture of you, and they are deleted after 90 days.

3. What allows us to hold it

To perform our contract with you — your name, address, phone, order and delivery record. Without these we cannot deliver food.
Your consent — the body assessment, allergy notes, and any marketing email. Consent can be withdrawn, and withdrawing it is as easy as giving it.
Our legitimate interests — keeping the site secure, preventing fraudulent orders, and understanding in aggregate which dishes sell. This never involves profiling you as an individual.
A legal obligation — invoices and tax records, which UAE law requires us to keep for five years.

4. Who else sees it

A short list, and it does not grow quietly.

Who	What they get	Where
Supabase	Everything in your account. They host our database and sign in.	Cloud hosting. Data is encrypted at rest and in transit.
Google	Only if you choose "Continue with Google": your email, name and profile picture. Google is told you signed into Back to the Root. We are not given your Google password, contacts, or anything else.	Under Google's own privacy policy.
Our payment gateway	The amount and an order reference. See section 6.	UAE, PCI DSS compliant.
Google (Gemini)	Only if you use the AI planner: your goal, weight, activity level and what you avoid. Never your name, address, phone or email. See section 5.	Sent from our server, not from your browser.
Our drivers	Your name, address, phone and box count, for that morning's run.	On a device that is wiped of the run at the end of the shift.

Some of these providers are outside the UAE. Where personal data leaves the country we rely on the provider's contractual data protection terms, which oblige them to protect it to the same standard.

5. The meal planner and AI

The planner can use Google's Gemini model to suggest a week of dishes. Three things about that are worth stating plainly:

What is sent. Your goal, your weight, how often you train, and what you avoid — plus our menu. Your name, address, phone number and email are never sent. The model is not told who you are.
Where it is sent from. Our server, not your browser. That means our key stays ours and the request cannot be intercepted or replayed from a page.
You can skip it entirely. If you never open the planner, nothing is sent to any AI provider. The site plans a week perfectly well without it, using our own menu maths, and the planner falls back to that automatically whenever the model is unavailable.

No decision that affects you legally or significantly is made by the model. It suggests dishes; you choose them, and you can change every one.

6. Payment details

We never see your card number. When you pay by card you are handed to the gateway, you type the number into their page, and they tell us only whether the payment succeeded and for how much. No card number, expiry date or CVV ever reaches our systems, and there is nothing of that kind in our database to steal.

For bank transfer and cash we hold only the fact of the payment and the amount.

7. How long we keep things

What	How long
Your account and contact details	While your account is open, then 12 months.
Order and delivery records	5 years, because UAE tax law requires it.
Body assessment results	24 months, or until you ask us to delete them.
Allergy notes	While your plan is active, then deleted with the account.
Notes to the kitchen	90 days after the delivery.
Sign in logs	90 days, for security.
Crash reports	90 days, then deleted.

When a retention period ends the record is deleted, not archived. The exception is an invoice, which we are required to keep and which we reduce to the legal minimum: date, amount, and an order number.

8. How it is protected

Every page is served over HTTPS. There is no unencrypted version.
The database enforces, row by row, that an account can only read its own orders, its own deliveries and its own assessment. This is enforced by the database itself, not by the website, so a bug in a page cannot expose somebody else's record.
Prices and orders are calculated on our server. Nothing a browser sends about what something costs is trusted.
Kitchen access depends on a role held in the database and given by hand. There is no shared staff password and no code word that grants access.
Passwords are stored hashed by our authentication provider. Nobody here can read yours, including us.
We keep the number of people with access to customer records to those who need it to do the day's work.

If something goes wrong. If personal data is exposed in a way likely to harm you, we will tell you and the UAE Data Office. We will say what happened, what was affected and what we are doing, and we will not wait until we have a comfortable version of the story.

9. Your rights, and how to use them

You can ask us to:

Show you everything we hold about you, as a file you can read.
Correct anything that is wrong.
Delete your account and your data. You do not have to ask us: there is a Delete my account button at the bottom of your account page, and it works immediately without anyone talking you out of it. It removes your profile, your saved details, your body assessment and your delivery history. Past invoices are kept for five years because UAE tax law requires it, with your name, address and phone number stripped out of them. A plan that is still running has to be stopped first — call us — because there is food already bought and a driver already routed.
Hand it over in a portable format, to you or to somebody else.
Stop a particular use, such as marketing email, while keeping your plan running.
Withdraw consent for the body assessment or allergy notes.

Email with the word "data" in the subject. We reply within 30 days, usually within a few. There is no charge, and asking will never affect your service.

If you are not satisfied with how we handle a request you can complain to the UAE Data Office. We would rather you told us first, but you do not have to.

10. Cookies and what is stored on your device

There are no advertising or tracking cookies on this site. What is stored is only what makes the site work:

What	Why	How long
Sign in session	To keep you signed in between visits.	Until you sign out.
The week you are building	So closing the tab does not lose an hour of choosing. Stored in your browser only.	Until you order, or clear it.
Your assessment result	To match a plan to your numbers. Stored in your browser.	Until you clear it.
Whether you have seen an offer	So the same window does not appear every visit.	Until you clear it.

Clearing your browser data removes all of these. Nothing breaks; you simply start again.

11. Children

This service is for adults. We do not knowingly collect data from anyone under 18, and the body assessment is not designed for and should not be used by children. A parent ordering for a household is welcome; tell us about any allergy in the household and we will flag the whole plan.

12. Changes to this notice

If we change anything that matters — a new provider seeing your data, a new use of it, a longer retention period — we will email you before it takes effect, not after. Small corrections are made in place and the date at the top changes.