Privacy policy

Who we are

OrdersUp is a booking and guest-communications platform for hospitality venues, run by OrdersUp Labs Pte. Ltd., a company registered in Singapore (UEN 202633497D), registered address 60 Paya Lebar Road #06-28 Paya Lebar Square, Singapore 409051.

You can reach us about privacy at [email protected].

This policy explains what personal data we handle, why, and your rights under Singapore's Personal Data Protection Act (PDPA).

Two different roles we play

We handle personal data in two distinct roles, and your rights depend on which one applies.

1. On behalf of a venue (we are the venue's processor).

When a venue uses OrdersUp to run its bookings and guest messages, we handle that venue's guest data on the venue's instructions. The venue decides what it collects and why; we hold and process it to make the service work. Enquiries reach a venue on the channels it connects, which may include email, its booking widget, telephone and WhatsApp. This covers:

• guest names, phone numbers and email addresses;
• booking and enquiry details, and the messages exchanged, including messages sent and received on WhatsApp;
• voice call content when a guest calls a venue's voice agent; and
• any dietary, allergy or accessibility notes a guest gives the venue.

For all of this, the venue is your first point of contact, and we act under the venue's direction. We do not decide how a venue uses its guest data, and we do not use it for our own purposes.

2. For ourselves (we are the controller).

When you deal with us directly, we decide how your data is used. This covers:

• operator accounts (venue staff and owners who log in to OrdersUp): name, work email, role, and login security data;
• website visitors: basic analytics and anything you send us through a contact form or email; and
• billing contacts for paying customers.

For this data, your rights run directly to us at the contact address above.

How we use AI, in plain language

OrdersUp runs an automated agent we present as a digital team member of your venue. It reads enquiries, drafts replies, answers calls and helps take bookings. We tell guests when they are dealing with the digital team member rather than a person, at the first automated contact on each channel. A human at the venue owns anything they write and send themselves.

To do this, the digital team member uses Anthropic's commercial AI service. Two things matter for your privacy:

• Your data is not used to train AI models. Under the commercial terms we use, Anthropic does not train its models on what we send or what it returns.
• It is not kept around. Under the standard commercial service, the content we send is not retained by default; where anything is held it is deleted within a short window (up to 30 days), except where the law requires otherwise.

We send the AI only what it needs to handle the task in front of it, not a venue's whole guest history.

Google and Microsoft integrations

Where a venue connects a Google or Microsoft mailbox or calendar to OrdersUp, we access only the scopes needed to triage enquiries, draft replies and manage bookings on that venue's instructions. We do not use Google user data to serve advertising, and we do not sell Google user data or transfer it to third parties except the sub-processors listed below, to comply with the law, or as part of a merger or acquisition of our business, subject to this policy.

WhatsApp messaging

Where a venue connects its own WhatsApp Business number to OrdersUp, guest messages sent to that number arrive in the venue's OrdersUp workspace alongside its email and telephone enquiries. Sending the venue's replies back to the guest on the same WhatsApp conversation is in progress and is being tested with design partners. We do this as the venue's processor, on the venue's instructions, and the venue remains your first point of contact for those messages.

WhatsApp is operated by Meta Platforms. To deliver the service we exchange your messages, your WhatsApp phone number and your WhatsApp profile name with Meta through the WhatsApp Business Platform, and Meta handles that data under its own terms as well as ours. We do not send marketing on our own account to a venue's guests over WhatsApp, and we do not use the content of guest messages for anything other than delivering the venue's own service. Messages we hold are kept for the periods set out below.

How long we keep data

We keep personal data only as long as we need it to run the service, then delete it:

• enquiries: 24 months;
• message contents: 12 months;
• voice transcripts: 6 months;
• quality-check data: 90 days;
• guest records: up to 36 months of inactivity;
• system logs: 18 months;
• anonymous usage counts (no personal data): kept indefinitely.

Where your data is processed

OrdersUp hosts its systems in Singapore. Some of the services we rely on to run the platform process data outside Singapore (for example, the AI service, the voice service and the WhatsApp Business Platform process data in the United States). Where that happens, we require those providers to protect your data to a standard comparable to the PDPA, as the PDPA requires for overseas transfers.

Sub-processors we use: Anthropic (AI processing), Vapi (voice telephony and transcription), DigitalOcean (application and database hosting, Singapore), Cloudflare (edge network and access control), Google (email, where a venue connects a Google mailbox), and Meta Platforms (WhatsApp messaging, where a venue connects a WhatsApp Business number).

Your rights

Under the PDPA you can ask to access the personal data held about you and to correct it if it is wrong.

• If you are a guest of a venue, ask the venue first. They control your data; we help them respond. The venue can pull an export of your data from us to answer you.
• If you are an operator or you deal with us directly, contact us at [email protected] and we will respond within the timeframe the PDPA sets.

You can also ask us to delete the personal data we hold about you, including messages you sent a venue on WhatsApp. Our data deletion instructions set out what to send us and what happens next.

Marketing and do-not-call

We do not send marketing on our own account to a venue's guests. Where a venue uses OrdersUp to send its own marketing, we check the Singapore Do-Not-Call registry before any marketing message goes out, and the venue is responsible for having a lawful basis to contact you. Booking confirmations and replies you asked for are not marketing.

Data breaches

If something goes wrong and personal data is exposed, we act on it quickly. Where the data belongs to a venue's guests, we tell the venue without delay so the venue can meet its own legal duties, including notifying the PDPC and affected people where required. Where the data is our own (for example operator accounts), we handle the notifications ourselves.

Changes to this policy

We may update this policy as the platform grows. We will post the new version here with an updated date.