Privacy Policy

This policy explains what personal information Ordo handles, why we handle it, who we share it with, how long we keep it and how you can have it deleted. It is written to be read, not to be survived — if anything here is unclear, write to us at info@aflatus.com and we will explain it in plain language.

1. Who we are

Ordo is a WhatsApp ordering service for restaurants, operated by AFLATUS OPC PVT LTD, a company incorporated in India ("Ordo", "we", "us").

• Contact email: info@aflatus.com
• WhatsApp: +91 89036 68239
• Privacy contact: privacy questions, requests and complaints all go to info@aflatus.com and are handled by the company directly.

2. There are two different groups of people in this policy

Ordo sits between a restaurant and that restaurant's customers, so it helps to be clear about who is who.

Restaurants (our customers)

The restaurant signs up for Ordo, gives us its menu, and connects its WhatsApp number. For information about the restaurant's own staff and business, we are the controller — we decide how it is used.

Diners (the restaurant's customers)

When someone messages a restaurant to place an order, Ordo handles their information on behalf of that restaurant — we are the processor and the restaurant is the controller. The restaurant decides what happens to its own customer records. We act on the restaurant's instructions, and on yours where the law gives you a direct right, such as the right to have your data deleted.

If you are a diner and you want your data removed, you can ask either us or the restaurant. See how to delete your data.

3. What information we collect

From diners, when they order

Ordo only records what it needs to complete an order:

• Your WhatsApp phone number, and the WhatsApp ID associated with it
• Your WhatsApp profile name, as WhatsApp supplies it to the restaurant
• The messages you send to the restaurant during the ordering conversation, and the replies Ordo sends you
• Your delivery address, as you type it
• Your location, if you choose to share a location pin — stored as latitude and longitude, and turned into a map link for the delivery driver
• Your order — the items, quantities, prices, delivery fee and total
• Technical records — the time of each message and the message identifier WhatsApp assigns, which we use to avoid processing the same message twice

We do not ask for and do not want your email address, your date of birth, your ID documents, or any payment card details. Ordo orders are cash on delivery, so no payment information passes through Ordo at all.

From restaurants

• Business name, address and opening hours
• Contact name, phone number and email of the owner or manager
• The staff phone number that should receive order alerts
• Menu, prices, delivery fee and minimum order
• The identifiers Meta issues when you connect your WhatsApp Business account, and the access token that lets Ordo send and receive messages for your number

From this website

If you fill in the callback form, we receive the name, restaurant name, phone number and city you enter. This website does not use advertising cookies, does not track you across other websites, and does not run any analytics or tracking scripts.

4. Why we use it

• To take and complete your order — showing you the menu, working out the total, and passing the finished order to the restaurant's kitchen. This is the whole purpose of the service.
• To deliver your order to the right place — your address and location pin go to the restaurant and its delivery driver.
• To keep the restaurant's records — so the restaurant has an accurate list of what was ordered, by whom and when.
• To keep the service working — diagnosing faults, preventing duplicate orders, and preventing abuse.
• To answer you if you contact us for support.

We do not use your information to advertise to you, we do not build a profile of you across different restaurants, and we do not sell or rent it to anyone. We will not send you marketing messages on WhatsApp unless the restaurant has your consent to do so and instructs us to.

5. Our legal basis

Where the law requires a specific basis for using your information, we rely on:

• Performance of a contract — you asked the restaurant for food; taking the order is how that request is fulfilled.
• Consent — for anything optional, such as sharing your location pin. You can decline; the restaurant will simply rely on the address you type.
• Legitimate interests — keeping the service secure and reliable, and defending against fraudulent or abusive use.
• Legal obligation — where we are required to retain records or respond to a lawful request.

6. Who we share it with

Your ordering information is shared with the restaurant you messaged. That is the point of the service. It is not shared with any other restaurant.

Beyond that, we use a small number of service providers to run Ordo. They may handle your information only to provide their service to us:

• Meta Platforms, Inc. — WhatsApp carries the messages between you and the restaurant. Meta's own handling of your WhatsApp data is governed by WhatsApp's privacy policy, not by this one.
• Google LLC — orders are recorded in Google Sheets, part of Google Workspace.
• Hostinger International Ltd. — provides the servers on which Ordo's ordering logic runs.
• Twilio Inc. — currently carries messages between Ordo and WhatsApp, including the order alert sent to restaurant staff.

We may also disclose information if we are legally required to, or to establish or defend a legal claim.

7. Where your information is held

Ordo is operated from India, and our service providers operate globally, so your information may be stored or processed outside your own country — including outside the United Arab Emirates if you order from a restaurant there. Where that happens, we rely on the contractual protections offered by those providers.

If you would like to know exactly where your data is stored, ask us at info@aflatus.com and we will tell you.

8. How long we keep it

Ordering sessions expire automatically 30 minutes after your last message, and the working session data is overwritten by your next order.

Completed order records are kept in the restaurant's own spreadsheet for up to 24 months, after which they are deleted unless the restaurant is required to keep them longer for tax or accounting purposes. You can ask for yours to be deleted sooner at any time.

If you ask us to delete your data, we act on it as described in our data deletion page.

9. How we protect it

• Messages between you and the restaurant travel over WhatsApp's own encrypted transport.
• Access to order records is restricted to the restaurant and to the small number of Ordo staff who need it to run the service.
• The access tokens that let Ordo message on a restaurant's behalf are held on our servers and are never exposed to a web browser.
• We do not hold payment card details, because Ordo does not take payments.

No system is perfectly secure. If a breach affects your information and the law requires us to tell you, we will.

10. Your rights

Depending on where you live, you may have the right to:

• ask what information we hold about you, and get a copy
• have inaccurate information corrected
• have your information deleted
• object to or restrict how we use it
• withdraw consent you previously gave
• complain to your local data protection authority

To exercise any of these, email info@aflatus.com or message us on WhatsApp. We acknowledge every request within 3 working days and complete it within 30 days. There is no charge.

Because we handle diner information on behalf of restaurants, we may need to pass your request to the restaurant you ordered from, and we will tell you when we do.

11. Children

Ordo is meant for adults placing food orders and is not directed at children. We do not knowingly collect information from a child. If you believe a child's information has reached us, contact us and we will delete it.

12. A note about WhatsApp and Meta

Ordo connects to WhatsApp through Meta's official WhatsApp Business Platform. Ordo is an independent product and is not affiliated with, endorsed by, or sponsored by Meta Platforms, Inc. When a restaurant connects its account, it authorises that connection on Meta's own screens; we never receive or ask for a WhatsApp or Facebook password.

13. Changes to this policy

If we change this policy we will update the "Last updated" date at the top. If the change materially affects how we handle your information, we will make a clearer announcement — for restaurants, by messaging the contact we hold for you.

14. Contact us

Questions, requests or complaints about privacy: info@aflatus.com, or WhatsApp +91 89036 68239. We reply to every one.