Privacy Policy

Your Business Pty Ltd · Version 2026-10-24 · Last updated 24 October 2026

1. About this policy

This policy explains how Your Business Pty Ltd handles personal information in the OrderChess ordering service. OrderChess is used by food businesses ("shops"); when you order from a shop, the shop decides how it uses your order, and we handle it on the shop's behalf.

2. What we collect

• Customers ordering from a shop: name, mobile or WhatsApp number, the order, pickup or delivery details, notes you add, booking details, and (if you choose to send one) a payment receipt image.
• Deliveries: the driver's delivery status and an optional photo of the order at the door (drivers are asked to photograph the order only, never people or the inside of a home).
• Shop owners and staff: name, email, phone, business details, sign-in records and settings.
• Employees of shops that use Staff Management: name, mobile number, job role, hourly pay rate, availability, rostered shifts, clock-in and clock-out times, attendance notes and timesheets. The shop enters this, and each employee sees only their own through a private link.
• Technical: basic logs (time, page, errors) to keep the service secure and working.

We collect it from you when you message a shop on WhatsApp, order on a shop's web page, book a table or sign up, and from the shop and its drivers when they handle your order. We don't collect card numbers: online payments are made on Stripe's pages, in the shop's own Stripe account.

3. Why we use it

To take and confirm orders and bookings, send order updates (such as "accepted" and "ready") on WhatsApp or email, help drivers deliver, let shops see their orders and reports, provide support, prevent misuse, and keep the service working. We don't use customers' details for our own marketing and we don't sell personal information.

4. The AI ordering assistant

Some shops use an AI assistant to understand typed orders. Your message and the shop's menu are sent to our AI provider to work out which items you want. The assistant doesn't make decisions about you: you always see and confirm the order and total yourself, and the shop decides whether to accept it.

5. Who we share it with

• The shop you order from (that's the point of the order).
• Service providers who help run OrderChess, under contracts that require them to protect it: Meta (WhatsApp Business Platform), Stripe (payments, for shops that use them), our cloud hosting provider, our email provider, our AI provider and, for delivery planning, a suburb-location lookup (OpenStreetMap; only suburb and postcode).

6. Overseas storage

Cloud110 is hosted in Sydney, Australia. Some other providers store or process information outside Australia, including in the United States (WhatsApp, Stripe, email and AI services). We take reasonable steps to make sure they protect it.

7. How long we keep it

• Delivery photos: 30 days, then the picture is deleted (the delivery record stays).
• Your personal details on an order (name, phone number, address, email and notes): 12 months, then removed. The order itself (items, totals, date, suburb) stays for the shop's sales records, without your details.
• Payment receipts you attach: 12 months, then deleted.
• Table bookings: your name, number and notes are removed 12 months after the booking.
• WhatsApp conversations with a shop's ordering assistant: unfinished baskets expire after a few hours, and the conversation record is deleted after 12 months without messages.
• Employee records (details, shifts and timesheets): kept while the shop uses Staff Management so it has its pay and attendance history; employees the shop marks inactive stay on past timesheets. The shop can ask us to delete them.
• After a shop's account closes, the shop has 30 days to export its data; then we delete it.

8. Security

Data is encrypted in transit; keys and secrets are stored encrypted; staff access needs a password or private key; driver and employee links are private and can be cancelled. We will do our best to keep information confidential, but no system is completely secure and some risks, such as attacks on our providers or on a person's own phone or account, are outside our control. If a breach is likely to cause serious harm, we'll tell the people affected and, where required, the regulator.

9. Your choices and rights

You can ask to access or correct your information, or ask a shop or us to delete it, at privacy@example.com.au. You can stop WhatsApp messages from a shop by telling the shop or blocking the chat. We'll respond within 30 days.

10. Questions or complaints

Please contact us at privacy@example.com.au and we'll get back to you.