Privacy Policy

1. Information we handle

• Seller account information: name, email address and sign-in details from Google or Apple, plus the business name, products and settings.
• Orders and content sellers add: order text they paste or share, screenshots, voice notes, and the orders, products and plans created from them.
• Messages on connected accounts (Pro plan): when a seller connects a WhatsApp Business number or an Instagram professional account, Orderat receives the messages customers send to that account, including the customer's phone number or username, message text, voice notes and images. Orderat also stores the replies it sends on the seller's behalf.
• Data in the phone app: the Orderat phone app keeps orders, customers, products and expenses on the seller's own device. None of it reaches our servers unless the seller uses a feature described in this policy.
• Account and cloud sync (optional): if a seller signs in with Apple or Google to turn on cloud backup and sync, we store the provider account id, email address and name, and a copy of the shop's data so it syncs across the seller's devices and staff.
• Shop link: when a seller publishes a shop link, we store what they choose to publish (shop name, bio, area, pickup hours, WhatsApp number, products, prices and photos), and that content becomes public. When a customer orders from the shop page, we store their name, phone number and order details until the seller's app downloads them.
• Subscription status: Google Play or the App Store process payments. We receive the subscription status, not card details.
• Technical information: basic logs such as request times and error reports, used to run the service and keep it secure.

2. How we use information

We do not sell personal information, and we do not use customer messages for advertising.

• To read orders from messages and create draft orders for the seller to review.
• To send replies, order summaries and confirmations to customers on the seller's behalf, when the seller turns this on.
• To build the seller's order book, preparation plan, stock and sales views.
• To operate, secure, support and improve Orderat.

3. AI processing

Orderat uses an AI service, Google's Gemini API, to read order details from text, images and voice notes. Message content is sent to this service only to extract the order, and we do not send customers' phone numbers to it. The seller reviews every order the AI drafts before it is confirmed.

The phone app also uses Gemini for the features below, and each one runs only when the seller uses it:

• Ask Orderat: a summary of the shop's numbers (sales, expenses, product names and customers' first names) is sent with the seller's question. We never send phone numbers or addresses.
• Post writing: the shop name and the chosen products' names and prices are sent.
• AI order reading: when the seller pastes an order message or picks a screenshot, it is sent to Gemini to read the order details, with phone numbers removed from the text first. We do not store the message or the image.
• Photo studio: the product photo the seller picks is sent to create a new image. We do not store either image on our servers.

4. Sharing

We share information only as needed to run Orderat:

• With the seller who owns the account, who sees their customers' messages and orders.
• With anyone who opens a shop link, who sees only the content the seller chose to publish.
• With service providers that process data for us: Meta (WhatsApp Business Platform and Instagram messaging), Google (Gemini API, sign-in and Google Play billing), Apple (sign-in and App Store billing), and our hosting and database providers.
• When the law requires it, or to protect the rights and safety of users and Orderat.

5. Retention

• Screenshots and voice notes are deleted 30 days after the related order is confirmed.
• Orders and messages are kept while the seller's account is active.
• Customer orders sent from a shop page are deleted from our servers as soon as the seller's app downloads them, and within 30 days at most.
• Cloud sync data is kept while the account exists. Deleting the account in the app deletes it and every shop it owns with its data.
• Shop link content leaves the public page when the seller unpublishes it, and we delete it when the seller asks.
• When a subscription ends, the seller's data stays readable for 30 days so it can be exported, and is then deleted.
• When a seller deletes their account, or anyone asks us to delete their data, we delete it within 30 days, except what the law requires us to keep.

6. Security

Information travels over encrypted connections (HTTPS). Access keys for WhatsApp and Instagram are stored on our servers, not in the app. Each seller's data is kept separate from other sellers' data.

7. Your rights

Under Bahrain's Personal Data Protection Law (Law No. 30 of 2018), you can ask to access, correct or delete your personal data, or object to how it is used. Email us at orderat.world@gmail.com. Customers of a seller can also contact that seller directly. To delete your data, see the data deletion page.

8. Where data is processed

Our service providers may process data outside Bahrain. We use providers that protect data under their own terms and security standards.

9. Children

Orderat is a business tool and is not directed at children under 18.

10. Changes

We update this page when our practices change and show the new date at the top.