Privacy Policy

Last updated: April 1, 2026

Ordegate ("we," "our," or "us") is committed to protecting the privacy and security of your personal information. This Privacy Policy describes how we collect, use, store, share, and protect information when you access or use the Ordegate platform, website (ordegate.com), merchant dashboard, POS systems, storefronts, APIs, and any related services (collectively, the "Platform"). By using the Platform, you agree to the practices described in this Privacy Policy. If you do not agree, please discontinue use of the Platform immediately.

1. Information We Collect

Ordegate collects personal data necessary to provide and improve the Platform's services. This data may include:

1.1 Account Information

When you register for an Ordegate account, we collect:

• Business name, trading name, and business type or industry.
• Contact name, email address, and phone number of the account owner.
• Business address and operational locations.
• Billing information, including payment method details for Subscription processing.
• For Merchants using the POS system: employee names, roles, and PIN credentials (stored encrypted).
• Tax identification numbers or business registration numbers when required for compliance.

All information provided during registration must be accurate and current. Failure to provide accurate information may result in account restrictions.

1.2 Transaction Data

We process and store data related to orders placed through your Ordegate-powered Storefront, including:

• Customer names, email addresses, phone numbers, and delivery addresses as provided during checkout.
• Order contents, quantities, special instructions, and order modifications.
• Payment method types (card, cash, PayPal, etc.) and transaction amounts.
• Order timestamps, statuses, and fulfillment records.
• Refund and cancellation records.

This data is necessary to facilitate order processing, provide analytics, and resolve disputes. Transaction data is stored in your Firebase database under your client account and is accessible through your Dashboard.

1.3 Technical Data

We automatically collect technical information when you access the Platform, including:

• IP addresses and approximate geographic location derived from IP.
• Browser type, version, and language preferences.
• Device identifiers, operating system, and screen resolution.
• Referring URLs and the pages you visit on the Platform.
• Session duration, click patterns, and interaction data.
• Error logs and performance metrics.

This data helps us maintain Platform security, diagnose technical issues, improve performance, and understand how the Platform is being used.

1.4 Communication Data

We retain records of communications between you and Ordegate, including:

• Emails sent to and received from [email protected].
• In-dashboard support tickets and chat messages.
• Phone call records (if applicable) for quality assurance.
• Feedback submitted through surveys, forms, or other channels.

Communication data is used to provide customer service, resolve issues, and improve our support processes.

1.5 Cookies and Tracking Technologies

We use cookies, local storage, and similar technologies to:

• Maintain your login session and authenticate your identity.
• Remember your Dashboard preferences and settings.
• Analyze Platform usage patterns and identify areas for improvement.
• Detect and prevent fraudulent or suspicious activity.

For detailed information about our use of cookies, please refer to our separate Cookie Policy document.

1.6 Data From Third-Party Sources

In some cases, we may receive information from third-party sources, including:

• Payment processors (transaction confirmation, fraud alerts).
• Identity verification services (when additional verification is required).
• Public business registries (to verify business legitimacy).

Third-party data is used only in conjunction with data you have provided and is subject to this Privacy Policy.

2. How We Use Your Information

We use collected information for the following purposes:

2.1 Providing and Operating the Platform

• Creating and maintaining your account, Storefront, and Dashboard.
• Processing and managing orders placed by your Customers.
• Facilitating payment processing and payout transactions.
• Enabling POS, KDS, Dispatch, and other Add-On functionalities.
• Generating analytics and reports to help you understand your business performance.

2.2 Communication

• Sending account-related notifications (billing confirmations, payment reminders, subscription changes).
• Responding to your support requests and inquiries.
• Notifying you of Platform updates, new features, maintenance schedules, and policy changes.
• Sending promotional communications about new Add-Ons, features, or offers (only with your consent, and you may opt out at any time by updating your notification preferences in Settings or clicking the unsubscribe link).

2.3 Security and Fraud Prevention

• Detecting, preventing, and investigating fraud, security incidents, and unauthorized access.
• Monitoring for suspicious account activity and enforcing Terms of Service.
• Conducting identity verification when required.
• Implementing and maintaining security measures including encryption, access controls, and audit logs.

2.4 Platform Improvement

• Analyzing usage patterns and user feedback to improve Platform functionality, design, and performance.
• Conducting internal research and development to build new features and services.
• Testing new functionality and measuring its effectiveness.
• Generating aggregate, anonymized statistics for business planning.

2.5 Legal Compliance

• Complying with legal obligations, regulatory requirements, and lawful requests from authorities.
• Enforcing our Terms and Conditions and other policies.
• Establishing, exercising, or defending legal claims.

3. How We Share Your Information

We do not sell or rent your personal information to third parties for marketing purposes. We may share information in the following circumstances:

3.1 Payment Processors

We share payment-related data with our authorized payment processors (currently PayPal and Paymob) to facilitate secure transactions. These processors operate under their own privacy policies and are contractually required to protect your data. The data shared includes:

• Merchant business details for account setup and verification.
• Transaction amounts and currency for payment processing.
• Customer payment information (handled directly by the processor — Ordegate does not store full card numbers).

3.2 Cloud Infrastructure Providers

Your data is stored and processed using the following cloud infrastructure:

• Firebase (Google): Firestore database, Authentication, Cloud Functions, and Storage. Your business data, product catalogs, orders, and customer records are stored in Firebase under your unique client ID.
• Cloudflare: Content delivery, DDoS protection, and hosting for your Storefront and Dashboard.
• AWS (Amazon Web Services): Email delivery via Simple Email Service (SES) for transactional and support emails.

These providers access only the data necessary to perform their functions and are bound by their respective data protection agreements and certifications.

3.3 Communication Service Providers

If you enable WhatsApp ordering on your Storefront, customer order data (order details, contact information) is shared with WhatsApp (Meta Platforms, Inc.) via the WhatsApp Business API to facilitate order communication. This data sharing is subject to WhatsApp's own terms of service and privacy policy.

3.4 Your Customers

When Customers place orders through your Ordegate Storefront, certain Merchant information is displayed to facilitate the transaction, including:

• Your business name, logo, and branding.
• Your business address and contact information (as configured in your Storefront settings).
• Product descriptions, pricing, and availability.

You control what information appears on your Storefront through your Dashboard settings.

3.5 Legal Requirements

We may disclose information in response to:

• Valid legal processes, including court orders, subpoenas, and government requests.
• Law enforcement requests where we believe disclosure is necessary to prevent harm, investigate fraud, or protect the rights and safety of Ordegate, our users, or the public.
• Regulatory requirements in jurisdictions where we operate.

3.6 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of all or a portion of our assets, your personal data may be transferred as part of that transaction. We will notify you of any such transfer and any changes to the applicable privacy terms.

4. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy or to comply with legal obligations. Specific retention periods include:

4.1 Active Account Data

Account information, Storefront settings, product catalogs, and Dashboard preferences are retained while your account remains active and for 30 days after account termination (to allow for reactivation or data export).

4.2 Transaction Records

Order data, payment records, and financial transaction logs are retained for 7 years after the transaction date for tax, accounting, and regulatory compliance purposes.

4.3 Support Communications

Customer support tickets, emails, and communication records are retained for 2 years after the issue is resolved.

4.4 Technical Logs

Server logs, access logs, error logs, and security audit trails are retained for up to 12 months.

4.5 Data Deletion

Data no longer required for operational or legal purposes will be securely deleted or anonymized. When you request data deletion, we will process the request within 30 days, subject to legal retention requirements that may prevent us from deleting certain records (such as financial transaction data required for tax compliance).

5. Data Security

We implement industry-standard security measures to protect your data, including:

5.1 Encryption

• All data transmitted between your browser and our servers is encrypted using TLS/SSL protocols.
• Sensitive data at rest (including POS PIN codes and payment configuration) is encrypted in the database.
• API keys and credentials are stored using environment variables and secure vault systems.

5.2 Access Controls

• Platform data access is limited to authorized personnel on a need-to-know basis.
• Your Firestore data is protected by security rules that ensure only authenticated users with proper client IDs can access their own data.
• Dashboard access requires authentication with email/password, with optional multi-factor authentication.

5.3 Infrastructure Security

• Cloudflare provides DDoS protection, WAF (Web Application Firewall), and SSL/TLS management for all Platform endpoints.
• Firebase provides Google Cloud's security infrastructure, including automated threat detection and regular security updates.
• GitHub Actions CI/CD pipeline includes automated security checks before deployment.

5.4 Security Monitoring

• We conduct regular security audits and vulnerability assessments.
• Automated monitoring systems detect and alert on suspicious activity.
• Security incidents are investigated and documented with corrective actions taken.

5.5 Your Responsibilities

While we take reasonable precautions, no system is completely secure. You are responsible for:

• Maintaining the security of your account credentials (email and password).
• Not sharing your Dashboard or POS login credentials with unauthorized individuals.
• Reporting any suspected security breaches immediately to [email protected].
• Keeping your browser and devices updated with the latest security patches.

6. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

6.1 Right of Access

You may request a copy of the personal data Ordegate holds about you. We will provide this in a structured, commonly used format within 30 days of your request.

6.2 Right to Correction

You may request correction of inaccurate or incomplete data. Most account and business data can be updated directly through your Dashboard settings.

6.3 Right to Deletion

You may request deletion of your personal data. We will process deletion requests within 30 days, subject to legal retention requirements (for example, financial transaction records may need to be retained for 7 years for tax compliance).

6.4 Right to Data Portability

You may request your data in a structured, machine-readable format for transfer to another service. Ordegate provides data export functionality in the Dashboard for orders, products, and customer data.

6.5 Right to Object

You may object to the processing of your data based on legitimate interests. You may also opt out of promotional communications at any time.

6.6 Right to Restrict Processing

You may request that we limit the processing of your data in certain circumstances, such as when the accuracy of the data is disputed.

6.7 Right to Withdraw Consent

Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

6.8 Exercising Your Rights

To exercise any of these rights, contact us at ordegate.com">support@ordegate.com with:

• Your account email and business name.
• A clear description of the right you wish to exercise.
• Any relevant details to help us locate and process your request.

We will acknowledge your request within 48 hours and process it within 30 days. If we require additional time, we will notify you of the reason for the delay.

7. International Data Transfers

Ordegate operates globally, and your data may be transferred to and processed in countries outside your country of residence. Our infrastructure providers (Firebase/Google, Cloudflare, AWS) operate data centers in multiple jurisdictions. We ensure that all international transfers comply with applicable data protection laws and implement appropriate safeguards, including:

• Adequacy Decisions: Transferring data to countries recognized as providing adequate data protection.
• Standard Contractual Clauses: Implementing contractual safeguards for transfers to countries without adequacy decisions.
• Certifications: Our infrastructure providers maintain SOC 2, ISO 27001, and other relevant security certifications.

Users will be notified of significant changes to international data transfer practices.

8. Children's Privacy

The Platform is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a child under 18, we will take immediate steps to delete that data. If you believe a child has provided personal data to us, please contact ordegate.com">support@ordegate.com.

9. Merchant Responsibility for Customer Data

As a Merchant using Ordegate, you collect and process personal data of your Customers through your Storefront. This includes names, addresses, phone numbers, email addresses, and order details. You are independently responsible for:

• Complying with all applicable data protection laws (GDPR, CCPA, and equivalent regulations) regarding your Customers' data.
• Implementing a privacy policy on your Storefront that accurately describes your data collection and usage practices.
• Obtaining appropriate consent from Customers for data processing where required by law.
• Ensuring Customer data is used only for legitimate business purposes related to order fulfillment and customer service.
• Responding to Customer data access, correction, and deletion requests in accordance with applicable law.
• Not sharing or selling Customer data to third parties without proper consent.

Ordegate provides the technical infrastructure for data storage and processing but does not control how Merchants use Customer data. Merchants are the data controllers for their Customer data; Ordegate acts as a data processor on your behalf.

10. Cookies and Tracking Technologies

Ordegate uses cookies and similar technologies as described in our separate Cookie Policy document. The Cookie Policy provides detailed information about the types of cookies we use, their purposes, duration, and how you can manage your preferences.

11. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or business operations.

11.1 Notification of Changes

When significant updates are made, we will notify you through:

• Email notification to the address linked to your account.
• A prominent notice on the Dashboard upon login.
• Updated documentation on ordegate.com with the new effective date.

We will provide at least 14 days advance notice for significant changes.

11.2 Acceptance

Continued use of the Platform after changes become effective constitutes acceptance of the updated Privacy Policy. If you do not agree with the changes, you may terminate your account before the effective date.

11.3 Historical Versions

Previous versions of this Privacy Policy are archived and available upon request for reference purposes.

12. Contact Us

For privacy-related inquiries, data requests, complaints, or to exercise your rights, contact us at: Ordegate Email: ordegate.com">support@ordegate.com Website: ordegate.com If you believe Ordegate has violated your data protection rights, you may also contact the relevant data protection authority in your jurisdiction.