Privacy Policy: Ordelo

This Privacy Policy explains how Ordelo LLC (“Ordelo”, “we”, “us”) collects, uses, and shares personal information when you use the Ordelo platform at ordelo.co, our ordering pages, and related services (together, the “Service”).

Ordelo serves two kinds of people, and our role differs for each:

Business owners who sign up to sell food through Ordelo. For their account data, Ordelo is the data controller.
Customers who place orders on a business’s ordering page. For that order data, the business is the controller and Ordelo acts as a processor on its behalf; we handle the data to operate the ordering and payment service, under the business’s instructions.

1. Information we collect

a. Business owner accounts

When you create and run a business account, we collect:

Your name and email address;
A securely hashed password (we never store it in plain text);
Your business profile: business name, description, address, city, state, ZIP, phone number, contact email, logo and banner images, and operating settings;
Subscription and billing identifiers from our payment processor (e.g. a Stripe customer ID, subscription ID, plan, and subscription status). We do not store your full card number. That is handled by Stripe.

b. Customer orders

When a customer places an order on a business’s page, we process:

Name, email address, and (optionally) phone number;
Order contents, special instructions, pickup time or fulfillment date;
For delivery orders, the delivery address;
Payment identifiers returned by Stripe or Square (such as a payment intent ID and payment status). Card details are entered directly into the processor’s fields and are not stored on Ordelo’s servers.

c. Information collected automatically

IP address, browser user-agent, and session activity, stored with your login session and on certain order activity logs for security and fraud prevention;
Strictly necessary cookies and local browser storage needed to keep you signed in and to remember an in-progress cart (see our Cookie Policy).

2. How we use information

To provide, operate, and maintain the Service;
To process orders and route payments to the business’s own payment account;
To bill business owners for their Ordelo subscription;
To send transactional email (order confirmations, owner order alerts, password resets, email verification, refunds, and billing notices);
To power menu search via AI-generated embeddings;
To secure the Service, prevent abuse and fraud, and enforce our terms;
To comply with legal obligations.

Our legal bases (where the GDPR applies) are: performance of a contract, legitimate interests, consent (for any non-essential cookies), and legal obligation.

3. AI order matching

When a customer types an order in plain language, that text, and the relevant menu, is sent to our AI provider (OpenAI) to interpret the request and suggest matching items. We send only what is needed to match the order; the AI’s suggestions are always re-checked against our database before anything is added to a cart or priced. Per OpenAI’s API terms, this data is not used to train their models. We do not use this text for advertising or profiling.

4. How we share information

We do not sell personal information. We share it only with service providers (“subprocessors”) who help us run the Service, and only as needed:

Provider	Purpose	Data shared
Stripe	Payment processing (customer orders) and Ordelo subscription billing	Name, email, payment details, billing identifiers
Square	Payment processing for businesses that choose Square	Name, email, payment details, order totals
OpenAI	Generating search embeddings for menu items	Menu data
Postmark	Sending transactional email	Recipient email address and message content
Amazon Web Services	Cloud storage and hosting (e.g. uploaded logos/banners)	Uploaded files and stored application data

When a customer pays, the funds and associated payment data go to the business’s own Stripe or Square account — Ordelo does not hold the funds. We may also disclose information if required by law or to protect the rights, safety, and security of Ordelo, our users, or the public.

5. Data retention

We keep account and order data for as long as the account is active and as needed to provide the Service, then for any period required to meet legal, tax, accounting, or dispute-resolution obligations. Businesses control their own customers’ order data and may request its deletion. When data is no longer needed, we delete or anonymize it.

6. Security

We use industry-standard safeguards: passwords are hashed, traffic is encrypted in transit (HTTPS), payment card data is handled by PCI-compliant processors (Stripe and Square) and never stored by us, and access to data is restricted. No method of transmission or storage is 100% secure, but we work to protect your information.

7. Your rights

Depending on where you live (e.g. the EU/UK under GDPR, or California under the CCPA/CPRA), you may have the right to access, correct, delete, or port your personal information, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, contact us at help@ordelo.co. If your data was submitted as a customer of a specific business, we may refer your request to that business as the controller. You also have the right to complain to your local data protection authority.

8. Children’s privacy

The Service is not directed to children under 13 (or the minimum age in your jurisdiction), and we do not knowingly collect their personal information.

9. International transfers

We and our subprocessors may process information in the United States and other countries. Where required, we rely on appropriate safeguards (such as the European Commission’s Standard Contractual Clauses) for international transfers.

10. Changes and contact

We may update this policy from time to time; we’ll revise the “Last updated” date above and, for material changes, provide additional notice. Questions or requests:

Ordelo LLC
Riverview, FL 33578
help@ordelo.co