Privacy Policy
What information OrderVora handles, why, who it goes to, how long it is kept, and the choices you have.
This Privacy Policy explains how [Company Legal Name], operating under the brand name OrderVora ("OrderVora", "we", "us"), handles personal information in connection with the OrderVora platform, the merchant dashboard, and the storefronts published through it (the "Service").
It applies to two different audiences, and the distinction matters throughout: Merchants — businesses that use OrderVora to run a storefront — and Customers, who place orders through a storefront powered by OrderVora, with an account or as a guest.
1. Our role: when we act for ourselves and when we act for a Merchant
OrderVora handles information in two capacities, and your rights and the right party to contact depend on which one applies.
1.1 Where OrderVora decides (we act for our own purposes)
For our relationship with a Merchant and for running the platform itself, OrderVora determines the purposes of processing. This covers Merchant account and login data, Subscription and billing records, platform security and fraud prevention, support, service communications, aggregate platform analytics, and our own legal and accounting obligations.
1.2 Where the Merchant decides (we act on its behalf)
For a Merchant's storefront, the Merchant determines why customer information is collected and how it is used. OrderVora processes that information on the Merchant's behalf and on its instructions, as a service provider or processor under applicable US state privacy law — including customer accounts and guest checkout details at that store, orders, delivery addresses, that store's marketing lists and consent records, reviews, and loyalty activity.
This means the Merchant you ordered from is also responsible for how it uses your information, including its own marketing, its own staff's access to it, and its own retention practices. A request about your data at a particular store may need to be directed to that Merchant; if you contact us, we will help you identify the right party and will assist the Merchant in responding.
OrderVora does not use information processed on a Merchant's behalf for its own unrelated purposes. We do use it to operate, secure, support, and maintain the Service, to prevent fraud and abuse, and to comply with law — and we may create de-identified or aggregated data that cannot reasonably be linked to an individual.
2. Information we collect
2.1 Merchant account information
- owner and staff name, email address, and phone number, including whether an email or phone has been verified
- a password, stored only as a salted cryptographic hash — we never store it in a readable form
- where you sign in with Google, the identifiers and basic profile information that sign-in returns
- business details you enter: business name, business type, addresses, service areas, hours, timezone, tax settings, and contact details
- role and permission assignments for the people you grant access to
- Subscription plan, billing cycle, invoices, and payment status
- for a regulated business type, the signed compliance agreement, including the signer's typed name and title, any retail licence number, state, and expiry you provide, and the date, IP address, and browser user-agent at signature
2.2 Customer account and guest-checkout information
- name, email address, and phone number
- for a registered account, a password stored only as a hash, plus saved delivery addresses and saved favourites
- for guest checkout, the name and email (and phone, where collected) needed to place and follow the order — held per store rather than as a platform-wide profile
- order history at the stores you have ordered from
- loyalty balances and activity, and coupon or promotion use, where a store offers them
- reviews or ratings you submit
2.3 Order and fulfillment information
- items, options, quantities, prices, taxes, fees, tips, and totals
- fulfillment type and, for delivery, the delivery address, any access notes or instructions you provide, and calculated distance and delivery zone
- order timing, status history, and preparation and handover events
- notes or special requests you add — please do not include health, medical, or other sensitive details you do not want the Merchant to see
- where a store operates its own delivery, driver assignment and driver location pings during an active delivery, retained only briefly
2.4 Payment-related information
For orders, card and wallet details are collected and tokenised by the Merchant's own payment provider. OrderVora does not receive or store full payment card numbers. We keep payment metadata needed to run the order and reconcile it: a provider token or reference, card brand and last four digits where the provider returns them, amount, currency, authorisation and capture status, decline or error codes, refund records, and provider webhook records.
For Merchant Subscriptions, payment details are handled by OrderVora's own payment processor. We keep the subscription and invoice records that processor returns, not card numbers.
2.5 Device, log, and security information
- IP address, browser and device type, operating system, and general information about how the Service is used
- server and application logs, including request paths, timestamps, and error diagnostics
- authentication and session information, including session and refresh tokens, sign-in events, failed sign-in attempts and lockouts, and step-up verification events for sensitive actions
- records of security-relevant administrative actions
- where you enable push notifications, the push subscription your browser issues
2.6 Communications and support
- messages you send us, support requests, and any files or screenshots you attach
- the email, SMS, and push messages the Service sends about your account or order, and delivery outcomes such as bounces, failures, or opt-outs reported by a provider
- your marketing consent status per store and per channel, when and how it was given or withdrawn, and a hash of the exact consent wording you were shown, so we can later confirm what you actually agreed to
2.7 AI inputs and generated content
- material a Merchant submits to an AI feature: photographs or scans of a menu, PDFs, images, website addresses and the text fetched from them, and product names and descriptions
- prompts and messages a Merchant sends to the AI assistant, and the business data the assistant reads to answer them
- the content the AI produces — extracted catalogue data, generated descriptions and categories, and generated product and storefront imagery — and a record of usage for plan allowances and cost accounting
2.8 Analytics
We generate operational analytics — order volumes, sales, popular items, timing patterns, and similar business reporting — for a Merchant about its own store, and aggregate metrics about the platform for ourselves. Storefront analytics are derived from orders and interactions in the Service. We do not use third-party advertising or cross-site tracking technologies.
3. How we use information
- to provide the Service: create and run storefronts, manage catalogues, take and route orders, run checkout, calculate delivery areas and estimates, and display order status
- to send transactional messages: verification, password reset, order confirmations and status updates, receipts, security alerts, and billing notices
- to send marketing messages only where the applicable consent has been given, and to honour opt-outs and suppress further marketing to an address or number that has opted out
- to operate accounts and Subscriptions, enforce plan entitlements and usage allowances, and take payment for Subscriptions
- to provide AI features, which involves sending the relevant input to an AI provider on our behalf
- to provide support, investigate issues, and respond to your requests
- to secure the Service: authenticate users, rate-limit, detect and prevent fraud, abuse, and unauthorised access, maintain audit records, and debug errors
- to produce analytics and reporting for a Merchant about its own business, and aggregate or de-identified analytics for us
- to improve and develop the Service, using aggregated or de-identified data wherever it will serve the purpose
- to comply with law, respond to lawful requests, enforce our terms, and establish, exercise, or defend legal claims
We do not use Merchant business data or Customer personal information from the Service to train our own general-purpose AI models. Where we send input to a third-party AI provider to deliver a feature, we seek to use their services on terms that do not permit training on our input; the provider's own terms govern their processing, and we cannot guarantee a third party's practices beyond what its terms commit to.
6. Data retention
We keep personal information for as long as needed for the purposes described in this Policy, and then delete or de-identify it. How long that is depends on the record:
- account records are kept while the account is active, and for a period afterwards for security, dispute-resolution, and legal purposes
- order and transaction records are kept as long as needed for the Merchant's operational, accounting, tax, and dispute-resolution needs, and to meet legal record-keeping requirements
- consent and unsubscribe records are kept for as long as needed to prove and honour the choice — a suppression record in particular must outlive the marketing list, or an opt-out could be undone
- compliance signatures for regulated business types are kept as evidence of what was agreed and when
- short-lived operational data is deleted automatically on a rolling basis, including processed message-queue records, abandoned carts, expired or used one-time tokens, driver location pings from completed deliveries, and processed provider webhook records
- logs and security records are kept for a limited period appropriate to their purpose
- backups persist for their own cycle, so deleted data may remain in a backup for a limited period before it is overwritten
We may keep information longer where we must to comply with law, resolve a dispute, enforce our agreements, or investigate an incident. We may keep aggregated or de-identified data indefinitely.
7. Security
We use technical and organisational measures appropriate to the risk, including encryption in transit, encryption of sensitive stored credentials such as connected payment-provider secrets, password hashing, tenant isolation in the database, role-based access control, additional verification for sensitive actions such as connecting a payment provider, rate limiting, sign-in lockouts, audit logging, and monitoring.
No product, transmission method, or storage system is perfectly secure, and we cannot guarantee that information will never be accessed, disclosed, altered, or destroyed. You also play a part: use a strong, unique password, keep your credentials private, manage staff access carefully, and tell us promptly at hello@ordervora.com if you suspect a problem. We will notify affected people and regulators of a security incident where the law requires it.
8. Your privacy rights and choices
Depending on where you live, you may have some or all of the following rights. We honour them as applicable law requires, and we do not discriminate against you for exercising them.
- access: to know what personal information we hold about you and how we handle it, and to get a copy
- correction: to have inaccurate personal information corrected
- deletion: to have personal information deleted, subject to exceptions where we must keep it
- portability: to receive information in a portable form where required
- opt out of sale, sharing, or targeted advertising: we do not engage in these activities, so there is nothing to opt out of
- limit the use of sensitive personal information, where applicable — we do not use sensitive personal information for purposes that trigger this right
- withdraw marketing consent at any time, and opt out of marketing email, SMS, or push messages using the mechanism in the message or your account settings
- appeal: where applicable law provides it, to appeal a decision we make about your request
- to be free from discrimination for exercising a privacy right
8.1 Making a request
Send your request to hello@ordervora.com. Tell us what you are asking for, and — if it concerns a specific store — which store, since that determines whether we act as the Merchant's service provider.
Identity verification: we must verify who you are before acting on a request, because acting on an unverified request is itself a privacy risk. We will normally ask you to confirm your request from the email address on the account, and may ask for additional information matching what we already hold. We use that information only to handle the request. An authorised agent may act for you where the law allows; we may ask the agent for proof of authority and ask you to confirm it directly.
Where OrderVora acts as a Merchant's service provider, we will either forward your request to that Merchant or help it respond, rather than making decisions about that Merchant's data ourselves.
Transactional messages about your account or an order are necessary to provide the Service and are not marketing; opting out of marketing does not stop them.
8.2 California residents
If you are a California resident, the CCPA as amended by the CPRA gives you the rights to know, access, delete, correct, and receive a portable copy of your personal information, to opt out of the sale or sharing of personal information and of targeted advertising, to limit the use of sensitive personal information, and to be free from discrimination for exercising them.
The categories of personal information we collect, the purposes for which we use them, the categories of sources, and the categories of recipients are described in the sections above; our retention approach is described under "Data retention". As stated above, we do not sell personal information and do not share it for cross-context behavioural advertising. We do not knowingly sell or share the personal information of anyone under 16.
You may make a request as described above, and may designate an authorised agent to make one for you.
8.3 Other US state privacy rights
Residents of other US states with comprehensive privacy laws — including Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana and others as they take effect — have comparable rights to access, correct, delete, and obtain a copy of their personal information, and to opt out of targeted advertising, sale, and certain profiling. We honour these rights as those laws require, including any right to appeal a decision on your request. We do not conduct profiling that produces legal or similarly significant effects about you.
9. Where information is processed
OrderVora is a US-focused service, and information is primarily processed in the United States. Some of our service providers may process or store information in other countries. Where information moves across borders, we rely on the providers' contractual commitments and appropriate safeguards.
If you access the Service from outside the United States, you understand that your information will be processed in the United States, where privacy laws may differ from those in your location.
10. Children
The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has given us personal information, contact us at hello@ordervora.com and we will delete it.
Some storefronts sell age-restricted products and are intended only for adults who meet the applicable minimum age, which may be 21. An age gate on a storefront asks a visitor to declare a date of birth; it is a self-declared attestation and is not identity verification. Merchants are responsible for the age and identity verification the law requires for their products.
11. Changes to this Policy
We may update this Policy. When we do, we will change the effective and last-updated dates above. For a material change we will take reasonable steps to notify you — by email, by a notice in the Service, or by another reasonable means — before it takes effect, and will obtain consent where the law requires it.
12. Contact us
[Company Legal Name], operating as OrderVora
Registered address: [Company Address]
Privacy requests and questions: hello@ordervora.com
If you ordered from a store and your question is about how that business uses your information, contact the Merchant directly using the details on your order — and you can always contact us and we will help you reach the right party.