Orderpeal privacy policy
Effective date: 21 October 2026
This policy explains how Orderpeal handles personal data. Orderpeal is an app for Shopify merchants (restaurants, takeaways, bakeries, florists and other shops) that runs their order flow: kitchen and counter screens, a collection board, a live order tracker, SMS updates and, if the merchant uses it, delivery with their own drivers.
Orderpeal is operated by More Checkouts Limited ("Orderpeal", "we", "us"), a company registered in England and Wales under number 15632212, whose registered office is at South Shields, United Kingdom. You can contact us about privacy at privacy@orderpeal.com.
1. Who this policy is for, and our role
We handle personal data in two different roles.
| Whose data | Examples | Our role |
|---|---|---|
| Merchants who install Orderpeal, and people who visit orderpeal.com or contact us | Shop owner's name and email, billing plan, support emails | Controller. We decide why and how this data is used. |
| The merchant's customers | First name, last-name initial, phone number for SMS, delivery address, order details | Processor (under the CCPA, a service provider). The merchant is the controller and decides how it is used; we process it only on their instructions. |
| The merchant's staff and drivers | Display name, role, screen PIN (stored only as a hash), who moved an order to the next stage, driver location while on a delivery | Processor for the merchant, as above. |
If you are a customer of a shop that uses Orderpeal, the shop is responsible for your data. Please read the shop's own privacy policy and send requests about your data to the shop. If you contact us, we will pass your request to the shop and help them answer it.
2. Data about merchants (we are the controller)
What we collect
- Store details from Shopify when you install: store name, myshopify domain, shop owner name and email, country, currency, time zone, plan.
- Account and billing: your Orderpeal plan and add-ons, which Shopify bills on our behalf. We do not receive your card details.
- Settings you enter in Orderpeal: locations, opening hours, workflows, stages, wording, notification choices. Most of these are saved in your Shopify store as app-owned metaobjects and metafields.
- Support and communication: emails and messages you send us.
- Usage and diagnostics: which features you use, error reports and technical logs (with customer details removed).
- orderpeal.com visitors: standard server logs (IP address, browser, pages requested), kept for up to 30 days for security. We do not use advertising or tracking cookies.
Why we use it, and our lawful basis (UK GDPR and EU GDPR)
| Purpose | Lawful basis |
|---|---|
| Provide the app, keep your account and settings, bill through Shopify | Contract |
| Support, service messages (for example a change to these terms) | Contract |
| Security, fraud prevention, fixing errors | Legitimate interests (keeping the service safe and working) |
| Improving Orderpeal, including the operational learning described in section 5 | Legitimate interests (building a better product) |
| Product news by email | Consent, or legitimate interests for existing merchants, with a one-click opt-out |
| Keeping records the law requires (for example tax) | Legal obligation |
We keep merchant account data while you have Orderpeal installed and for up to 12 months after you uninstall, except billing and tax records, which we keep for 6 years as UK law requires.
3. Data about the merchant's customers (we are the processor)
What we process, and why
We read customer data from the merchant's Shopify store only when a feature needs it, and we store as little of it as we can.
| Data | What it's used for | Stored by Orderpeal? |
|---|---|---|
| First name and last-name initial | Showing who an order is for on kitchen and counter screens, the front desk handover screen and (if the shop chooses) the collection board | Yes, on the order and on a customer record. Removed 90 days after the customer's last completed order, or sooner if the merchant sets a shorter period |
| Phone number | Sending order updates by SMS (for example "your order is ready") when the customer opted in at checkout; finding a returning customer when staff take a phone order | No. Read from Shopify at the moment a message is sent and passed to our SMS provider |
| Email address | Finding a returning customer when staff take a phone or counter order | No. Used only to search the merchant's Shopify customers |
| Delivery address | Showing the address and route to the driver (delivery add-on only) | No. Read from Shopify when the driver opens the job |
| Order details | Items, notes, allergies, chosen collection or delivery time, stage times, so the shop can prepare the order and the customer can follow it on the tracker | Yes, while the order is active and for the merchant's records (see section 6) |
| Customer notes, tags and allergy flags entered by the merchant | Helping staff serve returning customers safely | Saved in the merchant's Shopify store; we keep a working copy so screens work offline |
| Voice and chat while ordering (only if the shop turns on "Order by voice" and the customer uses it) | Understanding the order the customer speaks or types, asking follow-up questions and speaking the replies. The recording is turned into text in the browser where it can, otherwise by ElevenLabs; the text goes to Anthropic's Claude with the shop's menu | No. Neither the recording nor the conversation is stored or logged. Only the items the customer confirms go into their basket |
| Order history from Shopify | The customer recognition card at the front desk (visit count, last orders, usual items) | Calculated from Shopify when needed; we keep a summary only while the merchant uses the feature |
The live order tracker is a private link (for example
track.orderpeal.com/…) sent by SMS or shown on the Shopify order status
page. It shows the shop's details, the order's progress and its expected
time, and never shows the customer's phone, email or address. The link stops
working 7 days after the order is completed or cancelled.
What we never do with customer data
- We never sell customer data, or share it for cross-context behavioural advertising.
- We never market to a merchant's customers ourselves, or use their data for any other merchant.
- We never show a customer's full name, phone, email or address on a public screen. The collection board shows only an order number or first name.
Customers can ask a shop not to be recognised at the front desk (a "don't recognise me" setting), and can reply STOP to any SMS to stop messages.
Requests from customers
Customers should send requests (access, correction, deletion, objection) to
the shop. When Shopify tells us a customer has asked for their data or for
deletion (through Shopify's customers/data_request and customers/redact
notices), we give the merchant what we hold or delete it, normally straight
away and always within 30 days.
4. Data about staff and drivers (we are the processor)
- Staff: display name, role, location, and a screen PIN stored only as a one-way hash. Each stage change (for example "Cooking" to "Ready") records which staff member and screen made it, so the merchant can see how orders moved and resolve mistakes.
- Drivers (delivery add-on): display name, vehicle type, shift status and, while a delivery is in progress, the phone's location. Location is used to show the driver on the shop's map and on the customer's tracker, and to estimate arrival times. It is collected only while the driver is signed in and on shift. Drivers can take a proof-of-delivery photo, which is kept for 30 days.
- Voice notes: staff can record a short voice note on an order or for a colleague on the shop's screens. We keep the recording and its words, with the staff member's name or the screen's name, for 7 days at most (less if the merchant keeps customer data for less). While a note is recorded, the voice is sent to our speech-to-text provider (ElevenLabs) to write it down; when that isn't set up, the screen's browser does it instead. A note can mention a customer's first name, order or allergy. Detailed location traces are deleted after 30 days; after that we keep only anonymised drive-time statistics per area and hour.
Staff performance information is shown only to the merchant. The merchant is responsible for telling their staff and drivers that this data is recorded.
5. How Orderpeal learns from operations
Orderpeal gets better at predicting how long orders take by learning from how each shop runs: how long each item takes at each station and time of day, how busy the kitchen is, and how accurate the promised times were.
- This learning uses operational data with personal data removed: no customer names, phone numbers, emails, addresses, Shopify customer ids, staff names or staff ids.
- Comparisons across shops (benchmarks, or starting a new shop with typical prep times for similar shops) use only aggregates of at least 10 shops, so no single shop can be identified.
- We keep this de-identified operational history after a merchant uninstalls (see section 6), so that a returning merchant gets their learned timings back and the predictions keep improving for everyone.
6. How long we keep data
| Data | How long |
|---|---|
| Customer first name and initial (on orders and the customer record), and free-text kitchen notes on orders | 90 days after the customer's last completed order (merchant can set less) |
| A customer who asks the shop to delete their data | Their customer record and working copy of notes are deleted, and their name is removed from their orders, when Shopify sends customers/redact |
| Driver location traces and proof-of-delivery photos | 30 days |
| Staff voice notes (recording and words) | 7 days, or less if the merchant keeps customer data for less |
| Tracker links | Stop working 7 days after the order is completed or cancelled |
| Active order and stage data with personal data | While Orderpeal is installed, subject to the limits above |
| Personal data of the shop's customers, staff and drivers, and everything copied from the shop's Shopify store, for a shop that uninstalls | Deleted when Shopify sends shop/redact (48 hours after uninstall), normally straight away and always within 30 days |
| De-identified operational history and aggregates (section 5) | Kept, with all customer, staff and driver data removed |
| Backups | Rolling, overwritten within 30 days |
| Merchant account and support records | Up to 12 months after uninstall |
| Billing and tax records | 6 years |
Before uninstalling, a merchant can download their data (orders with stage times, customer notes and allergy flags, workflows and staff without PINs) from Settings.
7. Who we share data with
We use a small number of service providers (sub-processors) to run Orderpeal, listed at orderpeal.com/sub-processors: database and hosting (Supabase, Railway), SMS (Twilio), maps (Google Maps Platform), error tracking (Sentry), AI features (Anthropic: turning a merchant's description of their kitchen steps into stages, suggesting steps, and the voice ordering assistant), voices and speech-to-text for voice ordering and staff voice notes (ElevenLabs), service emails to merchants (Resend) and Shopify itself. Each is bound by a contract that requires it to protect the data and use it only to provide its service to us.
We may also disclose data if the law requires it, to protect people's safety, or as part of a sale or merger of our business (in which case this policy continues to apply).
8. Where data is stored, and international transfers
Orderpeal's database is hosted in the European Union (Ireland, AWS eu-west-1, through Supabase) and our application servers run in the EU (Netherlands, Railway's EU West region). Some providers, such as Twilio and Google, may process data in the United States. Where data leaves the UK or EEA, we rely on adequacy decisions (including the EU-US Data Privacy Framework and the UK Extension where the provider is certified) or the EU Standard Contractual Clauses with the UK Addendum.
9. How we protect data
- Encryption in transit (TLS) everywhere, and at rest (AES-256) in the database and its backups.
- Each shop's data kept apart in the database (row-level security), so each shop, screen and driver can read only its own data.
- Access to production data limited to the few people who need it, with multi-factor authentication and an access log.
- Separate test and production systems; test systems use made-up data.
- A written incident response process. If a breach affects personal data we process for a merchant, we tell the merchant without undue delay and within 48 hours of becoming aware, so they can meet their own 72-hour duty.
10. Your rights
UK and EU. You can ask for access to, correction of, or deletion of your personal data, ask us to restrict or stop processing it, object to processing based on legitimate interests, and ask for a copy in a portable format. Where we rely on consent, you can withdraw it at any time. You can complain to the UK Information Commissioner's Office (ico.org.uk) or your local EU data protection authority, though we would like the chance to help first.
California (CCPA/CPRA). For merchant data, you have the right to know, delete and correct personal information, and not to be discriminated against for using these rights. We do not sell or share personal information, and we do not use sensitive personal information to infer characteristics. For customers of a shop, we are the shop's service provider: please contact the shop.
Automated decisions. Orderpeal does not make decisions with legal or similarly significant effects on anyone. Estimated ready times and suggestions to staff are operational aids only.
To make a request, email privacy@orderpeal.com. We will answer within one month (UK/EU) or 45 days (California).
11. Children
Orderpeal is a business tool and is not directed at children. We do not knowingly collect data about children except as part of an ordinary order a merchant receives.
12. Changes
If we make a material change, we will tell merchants in the app or by email at least 30 days before it takes effect, and update the date at the top.
13. Contact
More Checkouts Limited, South Shields, United Kingdom. Email: privacy@orderpeal.com.
Appendix: wording merchants can add to their own privacy policy
Merchants are responsible for telling their customers how their data is used. They can adapt this paragraph (ORD-64):
We use Orderpeal to prepare your order and keep you updated. Orderpeal processes your first name, last-name initial, order details and, if you choose SMS updates, your phone number on our behalf, so our team can prepare your order and you can follow it on a live tracker. If we deliver your order, our driver sees your delivery address and you may see the driver's location on the tracker. If you order from us regularly, our staff may see your previous orders so they can recognise you; ask us if you'd rather they didn't. Reply STOP to any message to stop SMS updates.