← Back

Privacy Policy

When we make an important change to this policy, we announce it in the app before it takes effect.

Who we are

OrdersIn is operated by an independent developer based in Bengaluru, India. The developer is the "data fiduciary" for OrdersIn under India's Digital Personal Data Protection Act, 2023. That means the developer decides how your data is used and is responsible for protecting it.

Grievance Officer, OrdersIn: support@ordersin.co, with the subject line "Privacy". Postal address: available on request.

Who this covers

Two kinds of people use OrdersIn:

• Business owners: people who run a small business, such as a home kitchen, boutique or other small business, and use the OrdersIn app to manage their catalogue, orders, customers and payments.
• Customers: people who place an order or leave feedback through a business's OrdersIn link.

What we collect

From business owners:

• Your mobile phone number, used to sign you in.
• Profile details you choose to add: your name, email address, date of birth, anniversary and gender.
• Your business details: business name, address, phone number, opening hours, catalogue, prices, and registration numbers such as GST or FSSAI if you add them.
• Payment details you choose to add, such as your UPI ID and UPI QR code.
• Photos you upload: item photos, your logo and banner, and your UPI QR image. These are stored in Firebase Storage and shown on your public ordering page, so anyone with your ordering link can see them.
• The records you create while running your business: orders, customers, payments, expenses, stock and subscriptions.
• If you send a bug report: what you write, the app version, and a short description of your phone and browser.
• If a screen crashes: an automatic error report with the error message, the screen it happened on and your account ID, so we can fix it.

From customers placing an order:

• Your name and mobile phone number. Some businesses ask you to confirm your number with a one-time code.
• Your delivery address (society, tower, floor, flat, landmark) and any order notes you add.
• The items you ordered, the amount and how you paid.
• If you leave feedback: your star rating and any comment.
• To save you typing next time, the ordering page remembers your name, phone and address on your own phone (in your browser). It stays on your device, and you can clear it by clearing your browser data.

Optional WhatsApp auto-orders: if a business connects its WhatsApp Business number to OrdersIn, the messages customers send to that number come to us through Meta's WhatsApp Cloud API and are stored in that business's account. The message text, together with the business's catalogue, is sent to Anthropic's Claude AI to draft an order. Nothing is ever ordered automatically: the business owner reviews every draft and decides whether to place it.

We do not knowingly collect any more than what is needed to run the business and take and fulfil orders.

How we use it

• To let a business receive, prepare and deliver your order.
• To show the business owner their own orders, customers, earnings and basic insights.
• To read new orders aloud, if the business owner turns on voice announcements.
• To sign owners in securely, block abuse, and fix problems in the app.
• To send occasional service emails, such as a welcome email.

We do not sell your data, and we do not show third-party advertising.

Who processes your data

OrdersIn runs on trusted service providers who process data on our behalf. They do not use it for their own advertising.

• Google Firebase Authentication (sign-in). Receives: owner phone number; customer phone number when a business asks for a code; sign-in checks.
• Google Cloud Firestore (main database). Receives: all the app data described above.
• Google Cloud Functions (server tasks such as placing orders and saving feedback). Receives: orders, feedback and related details.
• Google Firebase Storage (photo storage). Receives: item photos, logo, banner, UPI QR.
• Google Firebase App Check and reCAPTCHA (blocking bots and abuse). Receives: technical signals from your browser.
• Google Cloud Text-to-Speech (optional voice announcements). Receives: the announcement text, which can include a customer's name and the items ordered.
• Google Fonts (loads the app's typeface). Receives: your IP address and browser details when a page loads.
• Google gstatic (delivers the Firebase software to the ordering pages). Receives: your IP address and browser details.
• Netlify (hosts the app and ordering pages). Receives: standard web request details, such as your IP address.
• Resend (sends service emails and contact-form messages). Receives: owner name and email, and what you write in the contact form.
• Meta WhatsApp Cloud API (optional WhatsApp auto-orders). Receives: WhatsApp messages sent to a business's linked number.
• Anthropic (Claude) (optional WhatsApp auto-orders). Receives: the text of those messages and the business's catalogue, to draft an order.
• Wikimedia (shows the GPay, PhonePe and Paytm logos on the ordering page). Receives: your IP address and browser details.

When you tap to call, WhatsApp, share, or pay by UPI, OrdersIn hands you over to that app on your phone, and that app's own privacy policy applies from then on.

Where it is stored

A customer's order details are stored under the specific business's account and are visible to that business owner. Your business data (orders, customers, catalogue and settings) is stored in Google's Mumbai region (asia-south1), and the server functions that process it run in that same region. Some supporting services (hosting, fonts, email delivery, AI order drafting, sign-in and anti-abuse checks) are operated globally, so some data may be processed outside India. We only use providers that commit to appropriate security and confidentiality safeguards.

How long we keep it

Data	How long we keep it
Your account, profile and business details	Until you delete your account
Orders, customers, payments, expenses, stock, subscriptions, ratings	Until you delete them, or delete your account
Photos you upload	Until you replace them or delete your account. The photo of an item you remove stays stored until you delete your account.
WhatsApp auto-order messages	Until you delete your account
In-app notifications	Deleted automatically once they are more than 30 days old (the next time you open the app)
Bug reports you send	Until you delete your account
Automatic crash reports	Until you delete your account
Ordering-page anti-spam counters (they include customers' phone numbers)	Until the business deletes its account
Details a customer's phone remembers for the ordering page	On the customer's own phone, until they clear their browser data
The record that an account was deleted	Kept. It holds only the date and time (and, for a request made by email, which OrdersIn administrator carried it out), with no personal data about you.

When an account is deleted, everything in this table that belongs to it is deleted at once. Google may keep deleted data in its internal backups for a short period before it is permanently overwritten.

Security and breach notification

• Encrypted in transit: the app and ordering pages work only over secure HTTPS connections.
• Encrypted at rest: Google encrypts all data stored in Firebase (database, photos and logins) by default.
• Each owner sees only their own data: security rules let each business account read and change only its own data. Customers cannot see other customers' details. The OrdersIn operator can view account data when needed to provide support or keep the service secure.
• Order links: the feedback link a business sends to a customer shows that one order's details to whoever has the link. Share it only with the customer.
• If something goes wrong: if a data breach affects your personal data, we will tell you through the app or by email without delay, and inform the Data Protection Board of India as the law requires.

Your choices

• Access or correct your data: email us and we'll help.
• Delete your account and data: see our account deletion page for the steps and what gets removed. You can also email support@ordersin.co from the phone or email you used, and we will remove it within 30 days. Customers can also ask the business directly.

Cookies and local storage

The app stores small amounts of data on your device to keep you signed in and remember your preferences (like language and theme). The ordering page also remembers a customer's own details on their phone, as described above. We use Google reCAPTCHA and App Check to help block automated abuse.

Your rights under Indian law

You can ask us to show you the personal data we hold about you, correct it if it is wrong, or delete it. You can also withdraw your consent at any time. In practice, that means we close your account and remove your data.

Write to the Grievance Officer, OrdersIn, at support@ordersin.co (subject "Privacy"). We aim to respond within 30 days. If you are not satisfied with our response, you have the right to complain to the Data Protection Board of India.

Children

OrdersIn is meant for adults running a small business and their customers. It is not meant for anyone under 18.

Contact

OrdersIn · support@ordersin.co

---