1. Who we are
Orderhatch is run by [Orderhatch trading entity], company number [company number], registered office [registered address]. We are registered with the Information Commissioner's Office under number [ICO registration number].
For anything about your personal data, email [contact email].
2. Our two roles
Orderhatch handles personal data in two different ways:
- As controller for people who run or work at shops that use Orderhatch, and people who visit this website. We decide how that data is used, and this policy explains it.
- As processor for customers who order from those shops. The shop decides how its customers' data is used, and we only handle it on the shop's behalf. Section 9 explains this for customers.
3. What we collect about shop owners and staff
- Account details: your email address and a password. Passwords are stored by our sign-in provider in scrambled (hashed) form, and we cannot read them.
- Business details: your business and store names, addresses, phone numbers, the email for order alerts, opening hours, menu, photos, logo, brand colour and refund policy. Most of this is business information, but it can include personal data, for example if you trade under your own name.
- Team: the email addresses and roles of staff you add to your stores.
- Billing: your subscription status and the reference Stripe gives us for your billing account. Your bank details for Direct Debit are collected and held by Stripe, not by us.
- Payments set-up: the ID of the Stripe account you connect and whether it can take payments. We do not see your bank details or balances.
- Agreements: which version of our Terms, Data Processing Agreement and Privacy Policy you accepted, and when.
- Messages: anything you send us, such as setup help requests and support emails.
- Enquiries: if you ask us for a quote or register interest in Orderhatch Creators, the details you give us: your name, email, town, and your business name or social media handle.
- Technical data: our hosting provider keeps short-lived server logs, which include IP addresses, to keep the service secure and working.
4. How we use it, and our lawful bases
| What we do | Lawful basis |
|---|---|
| Provide your account, ordering pages, order screen, order alerts and support | Contract |
| Bill your subscription and any setup work | Contract |
| Send service messages, such as order alerts, billing notices and changes to our terms | Contract |
| Call or email you if an order has not been accepted | Contract, and legitimate interests in making sure customers' orders are not missed |
| Reply to quote requests, and email people who registered interest in Orderhatch Creators when it opens in their area | Legitimate interests in answering people who asked us to |
| Keep the service secure and stop fraud and fake orders | Legitimate interests |
| Keep records of what you agreed to, and accounting and tax records | Legal obligation and legitimate interests |
| Improve Orderhatch, using information about how the service is used | Legitimate interests |
We do not currently send marketing emails. If we start, we will only email shop owners about Orderhatch itself, and every email will have an unsubscribe link. We do not use advertising or tracking cookies, and we never sell personal data.
5. Who we share it with
We use these providers to run Orderhatch. Each handles data only on our instructions:
| Provider | What for |
|---|---|
| Supabase | Database, sign-in and file storage |
| Vercel | Website hosting, and counting visits to our public pages |
| Stripe | Subscription billing and Direct Debit |
| Resend | |
| Twilio | Text messages |
We may also share data with our professional advisers, with authorities when the law requires it, and with a buyer if Orderhatch is ever sold, in which case this policy would continue to protect your data.
6. Data outside the UK
Some of our providers are based in, or use staff in, the United States. Where personal data leaves the UK, we rely on the UK–US data bridge or the UK International Data Transfer Addendum to keep it protected to UK standards.
7. How long we keep it
- Account and business details: while your account is open, then deleted within [90 days] unless we need them for the reasons below.
- Billing and accounting records: 6 years after the end of the financial year they relate to, as UK tax law requires.
- Records of what you agreed to: for as long as your account exists, then 6 years, in case of a dispute.
- Support messages: up to [2 years] after the conversation ends.
- Orderhatch Creators interest: until we open in your area and have told you, or 12 months, whichever comes first.
- Server logs: kept by our hosting provider for a short period, normally days.
8. Your rights
You can ask us for a copy of your personal data, and ask us to correct it, delete it, restrict or object to how we use it, or send it to you or someone else in a portable format. Email [contact email]. We will reply within one month.
If you are unhappy with how we have handled your data, please tell us first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
9. If you ordered from a shop
When you order from a takeaway or café that uses Orderhatch, the shop is responsible for your personal data (it is the controller). Orderhatch provides the ordering software and handles your details only on the shop's behalf, as its processor. For questions about your data, or to use your data rights, please contact the shop. Its name, address and phone number are at the bottom of its ordering page.
What the shop collects through Orderhatch
- Your name, email address and phone number.
- What you ordered, your collection time, and whether the order was paid, collected or refunded.
How it is used
- To show your order to the shop's kitchen, send your confirmation email and tell you when your order is ready.
- If the shop does not accept your order in time, Orderhatch staff may see your order details so we can chase the shop and make sure your order is not missed.
- To stop fake orders, we keep a scrambled (salted and hashed) version of your IP address for 24 hours. We never store the address itself.
Payments
You pay the shop directly through its own Stripe account. Your card details go to Stripe, never to Orderhatch. Stripe's use of your payment data is covered by the shop's agreement with Stripe and by Stripe's own privacy notice.
What we don't do
Orderhatch does not use your details for its own marketing, does not sell them, and does not share them with other shops. Your basket is saved in your own browser, not on our servers, until you order (see our cookie notice).
How long it is kept
The shop decides how long to keep its order history while it uses Orderhatch. If the shop stops using Orderhatch, your name, email and phone number are deleted from its order records 30 days later.
If you contact us instead
If you send us a request about your data, we will pass it to the shop within 5 working days and help the shop to respond. You can also complain to the Information Commissioner's Office at ico.org.uk.
10. Cookies
We only use cookies and browser storage that the site needs to work, such as keeping you signed in and remembering your basket. There are no analytics or advertising cookies. On our own public pages we count visits with Vercel Web Analytics, which uses no cookies and does not identify you. Our cookie notice explains both.
11. Security
Data is encrypted in transit and at rest. The database is only reachable through our own server, which checks who is signed in and which stores they can see. Access to our production systems is limited to named people and protected with multi-factor authentication.
12. Changes to this policy
We will update this policy when how we handle data changes. The version date is at the top of the page, and we will email shop owners about important changes.