Orderzo
Legal · Privacy Policy

Privacy Policy

Last updated: 27 July 2026 · Effective from: 27 July 2026

💡

In simple words: We collect only what we need to run your shop's order book. We don't sell your data. We follow Indian data protection law (DPDP Act 2023). You can ask us to delete everything anytime by emailing info@orderzo.io.

🛍️Shopped at a store that uses Orderzo? Most of this policy is for the business owners who use our software. Jump to the section written for you ↓

If you ordered from a store using Orderzo

This part is for shoppers — if you placed an order or booked an appointment at a store that runs on Orderzo. The rest of this policy is written for the business owners who use our software; this section is written for you, in plain words.

Who holds your details

The business you bought from decides how your details are used. Under India's Digital Personal Data Protection Act, 2023, that business is the Data Fiduciary. Orderzo is only the software the store runs on — we store and handle your details on that business's instructions, as its Data Processor. Orderzo is not the seller and does not run the store.

What we collect when you order or book

  • Your name
  • Your phone number
  • Your delivery address — only if you chose delivery
  • Your email — only if you gave one (for example, for a booking confirmation)
  • What you ordered or the appointment you booked, and any note you added

Where your details go

Your details are stored in India, on AWS servers in the Mumbai region (through Supabase) — the same as all other Orderzo data. In limited cases, some data may be handled outside India; see section 6 (Data storage and security) for the specifics. They are shared with the business you ordered from so it can prepare and fulfil your order or confirm your booking, and with the service providers we use to run Orderzo — for example, a booking confirmation email is sent through our email provider. The full list of these providers is in section 5 (Third-party services we use). We do not sell your data or use it for advertising.

When you open a store's page you may see a cookie notice — see section 10 (Cookies) for what we use and why.

Your payment

When you pay, the money goes straight from your UPI app into the business's bank account, bank-to-bank. Orderzo never holds, routes, collects, or touches your money, and takes no commission on it. We are not a payment gateway and do not sit in the path of your payment.

Your rights, and who to contact

Under the DPDP Act 2023 you can ask to access your data, correct it, have it deleted, or nominate someone to act for you.

Because the business you bought from is the Data Fiduciary, contact that business first — it controls your order data and can act on it directly. If you can't reach them, or they don't resolve it, contact Orderzo's Grievance Officer:

Name: Chetan Aitaraju

Email: chetan@orderzo.io (subject "DPDPA Request")

We acknowledge within 48 hours. Erasure requests are responded to within 7 days, and other requests within 30 days (per the DPDP Act). If you are still unsatisfied, you may escalate to the Data Protection Board of India.

How long we keep it

Your order details stay while the store's Orderzo account is active. If the business closes its account, its data — including your order records — is removed within 90 days, except records that must be kept for tax or legal reasons (kept for 7 years under Indian tax law).

1. Who we are

This Privacy Policy applies to services provided by Orderzo Technologies Private Limited (CIN: U62099TS2026PTC216704) ("Orderzo", "we", "us", "our") — a company incorporated in India under the Companies Act, 2013, with its registered office at:

F No 101, Anand Nagar Laksh Residency, 1st Floor
Laqsh, Gopala Krishna Puram
Nagole, Hyderabad - 500068
Rangareddy District, Telangana, India

For privacy concerns or data requests, contact us at chetan@orderzo.io with subject "DPDPA Request".

Grievance Officer (per DPDP Act 2023, Section 8(9))

Name: Chetan Aitaraju

Email: chetan@orderzo.io

All privacy grievances will be acknowledged within 48 hours and resolved within 30 days. If you are unsatisfied, you may escalate to the Data Protection Board of India.

2. Information we collect

We collect the following categories of personal data:

From business owners (our customers):

  • Mobile phone number (used as unique identifier)
  • Business name, business type, business address (if provided)
  • UPI ID (for receiving payments from your customers)
  • Items and pricing you create in the app
  • Order and transaction records you create

From business owners' customers (data you enter):

  • Customer name and phone number (entered by business owner)
  • Order history and payment records

Who controls this data: For the personal data of your own customers that you enter (their name, phone number, and order history), you are the Data Fiduciary under the Digital Personal Data Protection Act, 2023, and Orderzo acts as your Data Processor — we handle that data only on your instructions, to provide the service to you. You are responsible for having a lawful basis and any consent required before adding your customers' data to Orderzo.

Automatic collection:

  • IP address, browser type, device information
  • Pages visited, features used, timestamps
  • Crash logs and error reports (no personal content)

3. How we use your information

We use your data only for:

  • Operating Orderzo — your account, orders, bills, payments, invoices
  • Sending OTPs for phone verification at login
  • Generating and storing PDF invoices
  • Generating UPI payment links (using your UPI ID) to share with your customers
  • Customer support requests you send us
  • Improving the product (anonymized analytics)
  • Legal compliance (tax records, audit trails)

We do NOT: sell your data to third parties, share it for advertising, or use it for purposes other than running Orderzo.

4. Lawful basis (DPDP Act 2023)

Under the Digital Personal Data Protection Act, 2023, we process your data based on:

  • Consent — you sign up willingly and accept these terms
  • Contract performance — to deliver the service you signed up for
  • Legal obligation — tax records, regulatory filings
  • Legitimate interest — security, fraud prevention, product improvement

5. Third-party services we use

To run Orderzo, we use these third-party providers, each with their own privacy policies. We disclose them per DPDP Act Section 5:

  • Supabase Inc. — Database and file storage. All Orderzo data is hosted in AWS Mumbai (Asia Pacific - Mumbai region).
  • Vercel Inc. — Web hosting and serverless functions for orderzo.io.
  • Cloudflare Inc. — DNS routing and DDoS protection.
  • Google Workspace — Our business email (info@orderzo.io, support@orderzo.io, chetan@orderzo.io).
  • Razorpay Software Pvt Ltd — Payment processing for subscription billing. When you upgrade to a paid plan, your payment details (UPI ID, card, bank info) are processed by Razorpay directly. We never see or store your payment credentials. Razorpay privacy policy
  • Meta Platforms (WhatsApp): When you send invoices via WhatsApp, we use wa.me deep links to open your WhatsApp app. We do not access WhatsApp message content — you communicate with your customer directly through your own WhatsApp account.
  • MSG91 — SMS delivery for the one-time passwords (OTPs) we send to your phone number to log you in and verify your identity.
  • Resend — Transactional email delivery (for example, subscription receipts, renewal reminders, and account notices).
  • Anthropic — AI used only for the optional "import items from a photo or list" feature. When you choose to import your catalogue, the photo or text you submit is sent to Anthropic's API to read out the item names and prices. This is processed outside India (United States); the content is not used to train AI models and is not retained for this purpose beyond your request. If you do not use this feature, nothing is sent to Anthropic.
  • Sentry — Error and crash monitoring, so we can find and fix problems in the app. Sentry may receive technical error details (such as error messages, stack traces, and the page or request that failed); personal data — including phone numbers, email addresses, UPI IDs, and OTPs — is scrubbed out before anything is sent. Error data may be processed outside India. This runs only in our production environment.
  • Browser push services (Google, Apple, Mozilla) — Used to deliver new-order and payment notifications to your own device when you turn on notifications. The notification payload is end-to-end encrypted, so the push service only sees an encrypted blob and your device's endpoint address — not the content of the notification.

If we add new processors in future, we will update this list and notify users of material changes via email.

6. Data storage and security

All Orderzo data is stored in AWS Mumbai (Asia Pacific - Mumbai region) via Supabase Cloud — kept exclusively within India, in line with the Digital Personal Data Protection Act, 2023.

  • Encrypted in transit (HTTPS/TLS 1.3)
  • Encrypted at rest (AES-256)
  • Regular automated backups
  • Access restricted to authorized personnel only
  • Our infrastructure provider Supabase is SOC 2 Type II certified

Cross-border access disclosure

Your business records are stored exclusively in India. Two narrow exceptions involve access or processing from outside India: (a) our operations team — including our founder, who is based in the United States — may access data over encrypted, access-controlled connections to operate the service; and (b) if you use the optional "import items from a photo or list" feature, the content you submit is processed by our AI provider (Anthropic) in the United States, as described in the third-party services section above. We do not otherwise transfer or store your data outside India.

7. Data retention

We retain your data only as long as your account is active or as required by law.

  • Active accounts: kept indefinitely while in use
  • Deleted accounts: data removed within 90 days, except records required for tax/legal purposes (kept for 7 years per Indian tax law)
  • Crash logs and analytics: 90 days

8. Your rights (DPDP Act 2023)

As an Indian Data Principal, you have the right to:

  • Access — request a copy of your personal data
  • Correction — fix incorrect data about yourself
  • Deletion — ask us to delete your data
  • Withdraw consent — at any time
  • Grievance redressal — contact us first; if unsatisfied, escalate to the Data Protection Board of India
  • Nominate — designate someone to exercise rights on your behalf

To exercise any of these rights, email our Grievance Officer at chetan@orderzo.io with subject "DPDPA Request" and your registered phone number. Erasure requests: responded within 7 days (per DPDP Act). Other requests: within 30 days.

9. Children's privacy

Orderzo is built for businesses run by adults (18+). We do not knowingly collect data from anyone under 18. If you believe we have inadvertently collected data from a minor, contact us at info@orderzo.io and we will delete it.

10. Cookies

We use minimal cookies — only what is needed to keep you logged in and to remember your preferences. We do not use advertising or tracking cookies. We use Vercel's built-in analytics (no personal data captured).

11. Data breach notification

In case of any personal data breach, we will notify affected users within 72 hours via email and notify the Data Protection Board of India per DPDP Act requirements.

12. Changes to this policy

We may update this Privacy Policy when we add new features or to comply with new laws. Changes take effect when posted. We will notify users of material changes via email or in-app notice.

13. Governing law

This Privacy Policy is governed by the laws of India. Any disputes are subject to exclusive jurisdiction of courts in Hyderabad, Telangana.

14. Contact us

Orderzo Technologies Pvt Ltd

F No 101, Anand Nagar Laksh Residency, 1st Floor, Laqsh, Gopala Krishna Puram, Nagole, Hyderabad, Rangareddy, Telangana 500068, India

Privacy / DPDPA / Grievance: chetan@orderzo.io

Customer support: support@orderzo.io