Privacy Policy

This Privacy Policy applies to services provided by Orderzo Technologies Private Limited (CIN: U62099TS2026PTC216704) ("Orderzo", "we", "us", "our") — a company incorporated in India under the Companies Act, 2013, with its registered office at:

For privacy concerns or data requests, contact us at info@orderzo.io with subject "Privacy Request".

We collect the following categories of personal data:

From business owners (our customers):

• Mobile phone number (used as unique identifier)
• Business name, business type, business address (if provided)
• UPI ID (for receiving payments from your customers)
• Items and pricing you create in the app
• Order and transaction records you create

From business owners' customers (data you enter):

• Customer name and phone number (entered by business owner)
• Delivery addresses and order notes, when given
• Order history and payment records

Who controls this data: For the personal data of your own customers that you enter (their name, phone number, and order history), you are the Data Fiduciary under the Digital Personal Data Protection Act, 2023, and Orderzo acts as your Data Processor — we handle that data only on your instructions, to provide the service to you. You are responsible for having a lawful basis and any consent required before adding your customers' data to Orderzo.

Automatic collection:

• IP address, browser and device type
• The pages requested, and when
• Error reports (with personal details removed), if error monitoring is in use — see section 5

We use your data only for:

• Operating Orderzo — your account, orders, bills, payments, invoices
• Sending OTPs for phone verification at login
• Generating and storing PDF invoices
• Generating UPI payment links (using your UPI ID) to share with your customers
• Customer support requests you send us
• Finding and fixing problems in the product (error monitoring)
• Legal compliance (tax records, audit trails)

We do NOT: sell your data to third parties, share it for advertising, or use it for purposes other than running Orderzo.

We process your data with your consent when you sign up and use Orderzo, and for the purposes the law allows without consent — such as keeping the records we must keep for tax.

To run Orderzo, we use these third-party providers, each with its own privacy policy. We use them to run Orderzo:

• Supabase Inc. — Database and file storage. Supabase hosts Orderzo’s primary application database and file storage in its Mumbai region (ap-south-1).
• Vercel Inc. — Web hosting and serverless functions for orderzo.io. Orderzo’s server functions run in Vercel’s Mumbai region (bom1). Vercel also serves pages and static files from its global network, so those may be delivered from outside India.
• GitHub Inc. — Source code hosting and the daily database backup. Backup files are stored as GitHub artifacts and may be stored outside India.
• Cloudflare Inc. — DNS for the orderzo.io domain.
• Google Workspace — Our business email (info@orderzo.io, support@orderzo.io, chetan@orderzo.io).
• Razorpay Software Pvt Ltd — Payment processing for Orderzo's Pro fee. When you upgrade to a paid plan, your payment details (UPI ID, card, bank info) are processed by Razorpay directly. We never see or store your payment credentials. Razorpay privacy policy
• Meta Platforms (WhatsApp): When you send invoices via WhatsApp, we use wa.me deep links to open your WhatsApp app. We do not access WhatsApp message content — you communicate with your customer directly through your own WhatsApp account.
• MSG91 — SMS delivery for the one-time passwords (OTPs) we send to your phone number to log you in and verify your identity.
• Resend — Transactional email delivery (for example, Pro payment receipts and account notices).
• Groq — AI used only for the optional "import items from a photo" and "import items from a website" features. When you choose to import your catalogue from a photo, the photo you submit is sent to Groq's API to read out the item names and prices. When you choose to import from a website link, Orderzo fetches that page, reads it itself where it can, and may send the page text to Groq's API to do the same. A list you paste is read by Orderzo itself and is not sent to Groq. Orderzo does not keep the photo or the page text: the item list that comes back is shown to you to check, and only the items you save are stored. Groq, which may process the photo or page text outside India, handles it as our service provider, under its own commercial terms and privacy policy, which govern how long it keeps the data. If you do not use these features, nothing is sent to Groq.
• Sentry — Error and crash monitoring. We may use Sentry to receive technical error details (such as error messages, stack traces, and the page or request that failed). Orderzo is configured not to send default personal data, and to remove phone numbers, email addresses, UPI IDs and OTP-like codes from error reports before they are sent. Error data may be processed outside India.
• Browser push services (Google, Apple, Mozilla) — Used to deliver new-order and payment notifications to your own device when you turn on notifications. The notification payload is end-to-end encrypted, so the push service only sees an encrypted blob and your device's endpoint address — not the content of the notification.

If we add new processors in future, we will update this list and notify users of material changes via email.

Orderzo's primary application database and file storage run on Supabase in its Mumbai region (ap-south-1), and Orderzo's server functions run in Vercel's Mumbai region (bom1). Orderzo also uses the other third-party service providers listed in section 5, and some of them may process data outside India.

• Encrypted in transit (HTTPS/TLS)
• A daily backup of the database is taken and kept for 90 days. Backups are encrypted (AES-256) and held by GitHub, which may store them outside India.
• Access to production systems is limited to the people who run Orderzo
• Our database provider, Supabase, states that it is SOC 2 Type 2 compliant and encrypts customer data at rest with AES-256 (Supabase security)

We retain your data only as long as your account is active or as required by law.

• Active accounts: kept indefinitely while in use
• Deleted accounts: the account closes immediately, and its records are permanently deleted from Orderzo's database within 30 days. That schedule does not cover: the tax invoices for Pro payments made to Orderzo, which we keep for as long as tax law requires; stored PDF copies of bills and uploaded logo files; database backups; and copies held by the service providers listed in section 5. These are kept or removed separately.
• Error reports, if error monitoring is in use: kept for our error-monitoring provider's standard retention period (see section 5)

You have the right to:

• Access — request a copy of your personal data
• Correction — fix incorrect data about yourself
• Deletion — ask us to delete your data
• Withdraw consent — at any time
• Grievance redressal — contact us first; if unsatisfied, escalate to the Data Protection Board of India
• Nominate — designate someone to exercise rights on your behalf

To exercise any of these rights, email our Grievance Officer at info@orderzo.io with subject "Privacy Request" and your registered phone number. We acknowledge every request and respond as quickly as we can, within the period applicable law requires.

Orderzo is built for businesses run by adults (18+). We do not knowingly collect data from anyone under 18. If you believe we have inadvertently collected data from a minor, contact us at info@orderzo.io and we will delete it.

Orderzo uses a small number of cookies and your browser's own storage, only to make the service work:

• Sign-in cookie — keeps a business owner signed in. Set when you log in.
• Security cookie — a random token that protects forms against cross-site request forgery. Set on every visit, including store pages.
• Preference cookie — remembers whether you dismissed the prompt to install the app.
• Browser storage, on your device only — for business owners: the phone number you logged in with, a random device tag used by the WhatsApp sending-device setting, the Pro plan you picked before signing in, and which screen and scroll position you were on. For shoppers on a store page: your cart and order receipt for the current visit and, after a delivery order, your phone number and delivery address so that store's page can fill them in next time. You can clear this storage at any time in your browser settings.

Orderzo does not show a cookie banner. We do not use advertising or tracking cookies, and we do not run analytics.

If a personal data breach affects you, we will tell you by email without undue delay, and we will report it to the Data Protection Board of India as the law requires.

We may update this Privacy Policy when we add new features or to comply with new laws. Changes take effect when posted. We will notify users of material changes via email or in-app notice.

This Privacy Policy is governed by the laws of India. Any disputes are subject to exclusive jurisdiction of courts in Hyderabad, Telangana.