Privacy policy

Ordilo helps business groups collect weekly meal orders and send them to a restaurant. This policy explains what personal information we handle, why, where it’s stored and your choices. We follow the Australian Privacy Principles in the Privacy Act 1988.

What we collect

• Members: name, email address, optional phone number, group memberships and permissions, standing and weekly orders.
• Visitors and substitutes: a name is all we need. Company, email and phone are optional and only used for that guest’s order and confirmation.
• Order notes: a free-text field for allergies and requests. Dietary or allergy details can be health information; please only include what the kitchen needs. Notes are never used for analytics.
• Security records: sign-in times, IP addresses and device type for active sessions, and an audit log of changes.
• Enquiries: what you send through our contact form.

Why we use it

To run your group’s ordering: show and confirm orders, send the order to the restaurant, send reminders and confirmations, keep accounts secure, and investigate problems. We don’t sell personal information or use it for advertising.

Where it’s stored

Our servers and backups are in Sydney, Australia. Email is delivered through SendGrid (Twilio Inc.) in the United States, which processes recipient addresses and message content to deliver them. Bot protection is provided by Cloudflare, which processes your IP address and browser signals.

How long we keep it

• Meeting, attendee and order data (including notes): 12 months after the meeting date.
• Copies of what was sent to the restaurant: 12 months.
• Guests not seen for 12 months: deleted.
• Audit log: 2 years, with order details removed after 12 months.

Your choices

• Download your data as JSON, or delete your account, from your account page.
• Turn off confirmation emails for your own order changes.
• Ask us to correct or delete information — including information a host entered about you as a visitor.

Contact and complaints

Contact us through the contact page. If you’re not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).