Privacy Policy

Two kinds of people interact with OrderGrid: operators (the venues who subscribe to our platform) and their customers (diners who order through an operator's storefront or phone line). This policy describes how we, as the platform provider, handle personal information for both.

From operators: business and contact details, login credentials, billing information, and the menu, sales and operational data you enter or upload.

From your staff: the records a venue keeps to run a roster and a till. Name and contact details, employment and pay details where the venue uses payroll, clock-in and clock-out times, and the clock-in photo where the venue has that switched on. Staff sign in to the till with a short PIN, and we store only a one-way cryptographic hash of that PIN, never the PIN itself, so nobody at OrderGrid can read it back.

From diners: the details needed to place and fulfil an order: typically name, contact number or email, order contents, and (for delivery) an address. Card payments are processed by our payment providers; we do not store full card numbers.

From the devices a venue uses: each till, kitchen screen and owner phone generates an installation identifier when the app is first opened, and sends it with every request. We hold that identifier alongside the name the venue gave the device, what the device is used for, and its model, so a venue can see its own devices and switch a lost one off. It is not an advertising identifier and we do not use it to follow anyone between apps or websites.

Automatically: basic device and usage information, and cookies as described in our Cookie Policy.

To provide the platform: take and fulfil orders, run the point of sale and kitchen, manage menus and stock, process billing, and provide support.

To improve and secure the service, and to send service and (where you have consented) marketing communications. Marketing consent is handled per the Spam Act 2003 (Cth) and you can opt out at any time.

The OrderGrid platform runs in Australia. Your account, your menu, your orders, your staff records and your customer records are stored on Amazon Web Services in Sydney (ap-southeast-2), encrypted in transit and at rest. Every request is scoped to your venue, so one venue's data is not reachable from another venue's account. Access by our own people is restricted to those who need it.

Running the platform also means using a small number of specialist providers, and some of them process information outside Australia. The next section names them and says what each one receives.

We would rather name the providers who touch your information than leave you to assume. This is the current list, and we update this page when a provider is added or changes. Where we have not been able to establish which country a provider processes in, we say so instead of guessing.

In Australia, hosting and email. Amazon Web Services in Sydney (ap-southeast-2) holds the platform: your account, menus, orders, staff records, customer records, files you upload, and our system logs. Email we send you goes out through Amazon SES in the same Sydney region.

In Australia, artificial intelligence. The AI that reads an uploaded menu, drafts a description, reads a supplier invoice, writes a message or takes a phone order runs on Amazon Bedrock, using model profiles that operate only in AWS's Australian regions, Sydney (ap-southeast-2) and Melbourne (ap-southeast-4). What goes to those features does not leave the country, and AWS does not store the input or the output.

In Australia, card payments taken at the counter: Tyro. Where a venue takes card payments on an EFTPOS terminal, the terminal is supplied by Tyro, an Australian bank. The card details go from the terminal to Tyro and never through OrderGrid; what comes back to us is the amount, the outcome and a reference. Tyro is an Australian institution regulated here.

Overseas, payments: Stripe. Stripe processes card payments for orders and our own subscription billing. It receives the amount, an order or account reference, and the email address a receipt or invoice goes to. If you pay online, your browser also talks to Stripe directly so you can enter your card, which means Stripe receives your IP address and device information. We never see or store your full card number. Stripe states in its own privacy policy that it may transfer personal data to other countries, including the United States and India.

Overseas, messages and calls: Twilio. Twilio delivers our SMS messages, our WhatsApp messages (which also pass through Meta, who operate WhatsApp), and the calls for venues that switch on automated phone ordering. It receives the phone number and the content of the message or call. Our Twilio account is not pinned to Twilio's Australian region, so this is handled in Twilio's default region, which is outside Australia. We have not confirmed the exact country with Twilio, so we do not name one here.

Overseas, the automated assistant's voice: ElevenLabs. ElevenLabs turns the assistant's replies into the voice you hear on the phone. It receives the words the assistant speaks, which can include your name and your order read back to you. ElevenLabs states that its customer data is hosted in the United States.

Country not established, speech recognition: Deepgram. On an automated phone call, Twilio uses Deepgram to turn speech into text. Deepgram is engaged by Twilio rather than by us, and we have not been able to establish which country that processing happens in. We will name it here once we can.

Overseas, fault monitoring: Sentry. When something goes wrong in our software, the error report is sent to Sentry so we can fix it. It contains the technical detail of the fault and identifiers such as the venue's account id, not your order or your contact details. Sentry stores our data in its United States region, in Iowa.

Overseas, two things on a venue's ordering page. When you start typing a delivery address, the suggestions come from Nominatim, a free address-lookup service run by the OpenStreetMap Foundation, which receives what you have typed and your IP address; we have not established which country that runs in. The page's typefaces are loaded from Google Fonts, which receives your IP address and browser details. Neither is needed to take your money and neither receives your order.

Overseas, integrations a venue chooses to switch on. If a venue connects its accounting, payroll or delivery-platform account (for example Xero, or a delivery app such as Uber Eats), or its Google Business Profile, Facebook Page or Instagram account, the relevant records flow to that provider under that provider's own terms and privacy policy. Xero states that data may be processed in Australia, New Zealand and the United States. If a venue connects its Google Business Profile, Facebook Page, Instagram account or Uber Eats store, the section "Accounts you connect" below says what we read from it and how long we keep it.

Because some of this processing happens overseas, Australian privacy law may not apply to that provider in the same way it applies to us. We choose providers who commit contractually to protecting the information, we take reasonable steps to check that they do, and we treat their handling of your information as our responsibility, not theirs alone.

We share personal information only as needed to run the service, with the providers named in the section above, under contracts that require them to protect it. We do not sell your personal information.

An operator is the controller of their own customers' data; we process it on their behalf.

If OrderGrid offers a venue a connection to its own Google Business Profile, Facebook Page, Instagram account or Uber Eats store, the owner decides whether to make it. An account is connected only if the owner signs in to that platform and says yes there. If an owner connects one, this section says what we read from it, what we keep and for how long, who handles it, how to switch it off, and how to ask us to delete it.

Google Business Profile: when a venue connects its Google Business Profile, we read the shop's profile (its name, address, opening hours and links), its Google reviews (the star rating, the words, the date, and the name and picture Google shows for the reviewer), the venue's replies to them, and its posts. While a profile is connected, we use what we read only to show the owner their reviews, to send a reply or a post the owner has approved, and to keep the shop's opening hours on Google the same as in OrderGrid. If a profile is connected, we keep anything we read from it for 30 days at most, then delete it, and read it again from Google when it is needed. While a profile is connected, the one thing we keep longer is the connection itself, meaning which profile it is and the permission the owner gave, and we keep that only until the owner disconnects.

If a venue connects its Google Business Profile, what we read from Google is used only for the features the owner sees in OrderGrid: we never sell it, never use it for advertising, and none of our people reads it unless the owner asks us for help with it, or we need to in order to keep the service secure or to follow the law. If a venue connects its Google Business Profile, our use of information we receive from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

Facebook Page and Instagram: when a venue connects its Facebook Page and the Instagram account linked to it, we read the name and picture of the Page and of the account, the posts the venue makes through OrderGrid, and the comments and private messages people send to the Page or the Instagram account, with the name and picture Meta shows for each person. Once they are connected, we use this only so the owner can post, and read and answer comments and messages, from OrderGrid. While the Page stays connected, we keep its comments and messages so the owner can follow a conversation, and we keep the connection itself, meaning which Page and account it is and the permission the owner gave, until the owner disconnects. If a venue has connected them, then when the venue disconnects, removes OrderGrid in its Facebook settings or asks us, or when Meta asks us, we delete everything we hold from that Page and Instagram account within 30 days.

Uber Eats: when a venue connects its Uber Eats store, we receive each Uber Eats order for that store, with the order number, the customer's first name, the items, any notes for the kitchen, and the prices. If a store is connected, Uber does not give us the customer's delivery address, and we do not keep the masked phone number that Uber's order carries for the customer. Once a store is connected, we use each order to put it on the kitchen screen and to tell Uber when it is accepted, refused or cancelled. If a store is connected, each Uber Eats order becomes one of the venue's orders and is kept the way every order is, as set out under "How long we keep it". If a store is connected, the connection itself, meaning which store it is and the permission the venue gave, is kept until the venue disconnects.

Who handles it: if a venue connects any of these accounts, everything we keep from them is stored with the rest of the venue's data on Amazon Web Services in Sydney. If a venue has connected an account and OrderGrid's AI suggests a reply for the owner, the words it is replying to go to Amazon Bedrock in Australia, as described above. If a venue has connected an account, anything the owner sends through it from OrderGrid, such as a reply, a post or an answer to an order, goes to Google, Meta or Uber, which are companies based outside Australia and handle it under their own terms and privacy policies. If a venue connects any of these accounts, we never sell anything we read from them.

Switching an account off: if a venue has connected any of these accounts, it can disconnect it at any time by emailing us at support@ordergrid.com.au. If an owner has connected a Google Business Profile, they can also remove OrderGrid's access from their Google Account settings, and if they have connected a Facebook Page and its Instagram account, from their Facebook settings. Once a connection is removed there, OrderGrid can no longer read from that account.

Asking us to delete it: if a venue has connected one of these accounts, anyone can ask us to delete what we hold from it, including a person who left a review, a comment or a message for that venue and has no OrderGrid account of their own. If a venue has connected one of these accounts, our Account and Data Deletion page, at ordergrid.com.au/legal/delete-data, says how to ask.

If a venue switches on an automated assistant to answer its phone, you are told at the start of the call, before you say anything, that you are speaking to an automated assistant, what happens to the call, and how to ask for a person instead.

On those calls the conversation is turned into text so the venue can check your order is right and so we can improve the system. Your phone number, the order and the transcript are stored in Australia. If a venue's line is also set to keep the audio, the announcement at the start of the call says so. The speech itself passes through the providers named above, and some of those are outside Australia.

If you mention an allergy or a medical reason for a change to your order, that is health information under the Privacy Act and we treat it with the extra care that requires. It goes to the kitchen, because the kitchen needs it to make your food safely.

You can ask us for a copy of a call transcript we hold about you, ask us to correct it, or ask us to delete it, using the contact address below.

While a venue's account is open we keep the information the venue needs to trade: its menus, its orders, its customer records, its staff records and its own account details. That is the working record of a business, and deleting it while the business is still using it would not be privacy, it would be data loss.

When an account is closed, or when someone asks us to delete their information, we delete it, with one exception we cannot make: Australian tax and employment law requires order records, payment records and employment records to be kept for a set period, which is five to seven years depending on the record. We hold those for that period and delete them when it ends. Our Account and Data Deletion page sets out how to ask and what happens.

Some things are on a much shorter clock. Where a venue has automated phone answering switched on, the words of a call, which is the transcript and the caller number held with it, are removed from the record 90 days after the call. If a venue also has audio recording switched on, the recording goes after 7 days, sooner than the words on purpose, because a recording captures a person's voice and can catch something spoken that no filter can take back out. Both windows are enforced by a job that runs on its own timer and an alarm that measures the data rather than the job, so a window nothing enforced would show up as a fault rather than as silence.

If a venue connects its Google Business Profile, anything we read from it is kept for 30 days at most. If a venue connects its Facebook Page or Instagram account, anything we hold from it is deleted within 30 days of the venue disconnecting it. The section "Accounts you connect" above sets out both.

Our system and fault logs hold technical detail rather than orders or contact details, and are kept only as long as we need them to find and fix a problem.

You do not have to close an account to have something removed. Clock-in photos, a call transcript, or a customer record can each be deleted on request using the contact address below.

You may request access to, or correction of, the personal information we hold about you. Operators can also download their sales, product, staff, payment, purchasing and menu data from the screens where it lives. To make a request, or to raise a privacy concern, contact us at support@ordergrid.com.au. If you are not satisfied with our response you may contact the Office of the Australian Information Commissioner (OAIC).

Privacy enquiries: support@ordergrid.com.au.