Privacy Policy

1. What we collect

• Account data: your name, work email, phone number, password (hashed — we never see it in plain text), and your company name, GSTIN, business address, logo and invoice branding.
• Your customers' data (you provide it): customer name, phone, email, GSTIN, billing/shipping addresses, and the orders, products, invoices and shipments you create for them. This data belongs to your company. It is visible only to users in your company — never to another ORDEROS customer.
• Messages you connect: the text of WhatsApp, Instagram DM and email messages you route into the Unified Inbox, plus sender identity and timestamps, so we can create draft orders from them.
• Usage data: pages and features used, order counts, and device information (device model, OS version, app version). Product analytics events carry no personal data — your company ID is hashed.
• Push token: your device's Firebase Cloud Messaging token, so we can send order and shipment notifications.
• Payment data: we do not collect or store card, UPI or bank details. Payments are processed by our payment partners (Razorpay / Stripe); their own privacy policies govern that step.

2. How we use it

To run ORDEROS for you: create your account and company, capture and display orders, generate draft orders, validate inventory, send confirmations and GST invoices, track shipments, run your customer portal, provide support, and keep the service secure. We do not sell your data or your customers' data, and we do not use it for advertising.

3. Who we share it with (processors only)

• Supabase (PostgreSQL + Storage) — hosts your data, encrypted in transit and at rest.
• Meta (WhatsApp Business / Instagram) — delivers the messages you send and receive through those channels.
• OpenAI (or a compatible LLM provider) — receives message text only to extract a draft order (customer, products, quantities, delivery date). It does not receive your password, payment data or other companies' data.
• Firebase Cloud Messaging — delivers push notifications to your device.
• Sentry — crash and error monitoring. Phone numbers and email addresses are masked before anything leaves the app.
• PostHog — product analytics with no personal data in event properties.
• Razorpay / Stripe — subscription billing.
• Cloudflare — DNS, CDN and backup storage.

We share data with a processor only to perform the service above, and only the data that step needs. We disclose data to authorities only where Indian law requires it, by a lawful order or request.

4. Your rights (India — DPDP Act, 2023)

You may ask us to give you a copy of your data, correct it, or delete it. Data export: request an export from Settings and we return all your company data as a ZIP within 24 hours. Deletion: request deletion and we delete your company data within 30 days of the request. To exercise any right, email support@orderos.co.in from your account email. Your customers' rights over their own data are exercised through you as their seller; if one of your customers contacts us directly, we will direct them to you.

5. Retention

• While your subscription is active, we keep your data for as long as you use ORDEROS.
• After cancellation: we keep your data for 90 days so you can return or export it, then delete it. If you ask us to delete it sooner, the 30-day rule in section 4 applies instead — an explicit deletion request always wins over the 90-day grace period.
• Orders and invoices are never silently deleted — they are voided or cancelled with a status, so your GST records stay intact while you are a customer. Backups expire on their own cycle (daily backups, 30-day retention) and are not restored for individual deletions.
• Logs contain no message text or personal data and are kept for 30 days.

6. Security

Passwords are hashed, access is by secure token with role-based permissions (Owner / Admin / Sales / Warehouse / Read Only / Support), company data is isolated by company ID on every record, and files are served through signed URLs. Data is encrypted in transit (HTTPS) and at rest with our hosting provider. No system is perfectly secure; if we discover a breach affecting your data we will tell you by email without unreasonable delay.

7. Children

ORDEROS is a business tool for adults running a business. It is not directed at children, and we do not knowingly collect data from anyone under 18.

8. Changes

If we change this policy we will post the new version here and note the effective date. Continued use after the change means you accept it.