Privacy Policy

Effective September 29, 2026

This Privacy Policy explains how Orda, “we” or “us”, collects, uses and shares information through the Orda online-ordering platform at chitstream.app, including restaurant ordering pages, the restaurant dashboard, and our text-message order alerts.

Information we collect

Restaurant account information: name, email address, password (stored hashed by our authentication provider), restaurant name, address, phone number, website URL, logo and banner images.
Order-alert contact details: the email address and mobile phone number a restaurant owner provides for new-order notifications, and a record of when they consented to receive text messages.
Customer order information: when you order from a restaurant, your name, email address, optional phone number, delivery address (for delivery orders), the items you ordered and any special instructions.
Payment information: card payments are processed by Stripe. We never receive or store full card numbers; we store payment status and Stripe transaction identifiers.
Menu content: publicly available content from a restaurant’s website, which the restaurant asks us to read to build its menu.
Technical information: cookies needed to keep you signed in, and standard server logs.

How we use information

To run ordering pages, process orders and payments, and pay restaurants.
To send order confirmations and status updates to customers by email.
To send restaurant owners new-order alerts by email and, if they opted in, by text message.
To keep restaurant menus up to date, provide support, and keep the service secure.

Text messaging (SMS)

If a restaurant owner opts in, we send automated new-order alerts from Orda to the mobile number they provide. Message frequency varies with order volume. Msg & data rates may apply. Reply HELP for help and STOP to opt out at any time.

We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. Mobile numbers and text-messaging consent are used only to deliver the alerts you asked for, and are shared only with our SMS provider (Twilio) for that purpose.

How we share information

We do not sell personal information. We share it only as needed to provide the service:

With the restaurant you order from, so it can prepare and fulfil your order.
With service providers that operate on our behalf: Supabase (database and authentication), Stripe (payments), Twilio (text messages), Resend (email), Anthropic (reading restaurant menus) and Vercel (hosting).
When required by law, or to protect the rights and safety of our users and the service.

Retention

We keep account and order records for as long as the restaurant account is active and as required for tax, accounting and legal purposes. Restaurant owners can ask us to delete their account.

Your choices and rights

Stop text messages by replying STOP, or by unticking text alerts in Orda Settings.
Update your restaurant details at any time in the dashboard.
Ask us to access, correct or delete your personal information by contacting us.

Security

We use encryption in transit, access controls and row-level database security so each restaurant can only access its own data. No system is perfectly secure, but we work to protect your information.

Children

Orda is not directed to children under 13, and we do not knowingly collect their information.

Changes

We may update this policy and will change the effective date above when we do.

Contact

Orda. See also our Terms of Service.