Privacy policy

Who we are

OrdersUp is a booking and guest-communications platform for hospitality venues, run by OrdersUp Labs Pte. Ltd., a company registered in Singapore (UEN 202633497D), registered address 60 Paya Lebar Road #06-28 Paya Lebar Square, Singapore 409051.

You can reach us about privacy at dpo@ordersup.ai.

This policy explains what personal data we handle, why, and your rights under Singapore's Personal Data Protection Act (PDPA).

Two different roles we play

We handle personal data in two distinct roles, and your rights depend on which one applies.

1. On behalf of a venue (we are the venue's processor).

When a venue uses OrdersUp to run its bookings and guest messages, we handle that venue's guest data on the venue's instructions. The venue decides what it collects and why; we hold and process it to make the service work. Enquiries reach a venue on the channels it connects, which may include email, its booking widget, telephone, WhatsApp and Instagram. This covers:

• guest names, phone numbers and email addresses;
• booking and enquiry details, and the messages exchanged, including messages sent and received on WhatsApp and Instagram;
• voice call content when a guest calls a venue's voice agent; and
• any dietary, allergy or accessibility notes a guest gives the venue.

For all of this, the venue is your first point of contact, and we act under the venue's direction. We do not decide how a venue uses its guest data, and we do not use it for our own purposes.

2. For ourselves (we are the controller).

When you deal with us directly, we decide how your data is used. This covers:

• operator accounts (venue staff and owners who log in to OrdersUp): name, work email, role, and login security data;
• website visitors: basic analytics and anything you send us through a contact form or email; and
• billing contacts for paying customers.

For this data, your rights run directly to us at the contact address above.

How we use AI, in plain language

OrdersUp runs an automated agent we present as a digital team member of your venue. It reads enquiries, drafts replies, answers calls and helps take bookings. We tell guests when they are dealing with the digital team member rather than a person, at the first automated contact on each channel. A human at the venue owns anything they write and send themselves.

To do this, the digital team member uses Anthropic's commercial AI service. Two things matter for your privacy:

• Your data is not used to train AI models. Under the commercial terms we use, Anthropic does not train its models on what we send or what it returns.
• It is not kept around. Under the standard commercial service, the content we send is not retained by default; where anything is held it is deleted within a short window (up to 30 days), except where the law requires otherwise.

We send the AI only what it needs to handle the task in front of it, not a venue's whole guest history.

Google and Microsoft integrations

Where a venue connects a Google or Microsoft mailbox or calendar to OrdersUp, we access only the scopes needed to triage enquiries, draft replies and manage bookings on that venue's instructions. We do not use Google user data to serve advertising, and we do not sell Google user data or transfer it to third parties except the sub-processors listed below, to comply with the law, or as part of a merger or acquisition of our business, subject to this policy.

WhatsApp messaging

Where a venue connects its own WhatsApp Business number to OrdersUp, guest messages sent to that number arrive in the venue's OrdersUp workspace alongside its email and telephone enquiries. Sending the venue's replies back to the guest on the same WhatsApp conversation is in progress and is being tested with design partners. We do this as the venue's processor, on the venue's instructions, and the venue remains your first point of contact for those messages.

WhatsApp is operated by Meta Platforms. To deliver the service we exchange your messages, your WhatsApp phone number and your WhatsApp profile name with Meta through the WhatsApp Business Platform, and Meta handles that data under its own terms as well as ours. We do not send marketing on our own account to a venue's guests over WhatsApp, and we do not use the content of guest messages for anything other than delivering the venue's own service. Messages we hold are kept for the periods set out below.

Instagram messaging

Where a venue connects its own Instagram professional account to OrdersUp, direct messages that guests send to that account arrive in the venue's OrdersUp workspace alongside its other enquiries. The venue's administrator connects the account by signing in with Facebook and choosing which Page and Instagram account to share, and we receive only what they choose to grant. We handle guest messages as the venue's processor, on the venue's instructions, and the venue remains your first point of contact for them. Instagram messaging is new and is being tested with design partners.

What we receive and keep about a guest:

• the Instagram-scoped ID that Meta gives the guest for that venue's account, which is a number that identifies the conversation and is not your username, name, phone number or email address;
• the text of each message you send, or a short note instead of the content where a message is a photo, video, voice note or other attachment (we do not download or keep the attachment itself);
• the time each message was sent and the time we received it; and
• the replies sent back to you, and the time each was sent.

We do not ask Instagram for your profile details, your posts or your contacts. For the venue's own account we read only the account and Page IDs, names and username, and we do not read the venue's posts.

Why we use it. To show the venue what its guests have asked, to draft replies and to send the replies the venue approves, with the whole conversation kept in one place. We do not use the content of guest messages for anything other than delivering the venue's own service, we do not use it for advertising, and we do not sell it.

Who sees it. People at the venue who have an OrdersUp login can read the conversation and approve replies. To read an enquiry and draft a reply, the digital team member passes the message text to Anthropic's commercial AI service, on the terms described above. Meta Platforms, which operates Instagram, handles the messages under its own terms as well as ours.

Replies. By default every reply to an Instagram guest is a draft that a person at the venue approves before it is sent. A venue can choose to let some kinds of reply go out without that step, such as a short acknowledgement that your enquiry has arrived or a booking confirmation, and the venue's own setting decides which. Where a venue uses online booking, a clear request for a table can be booked directly in the venue's system, and the confirmation follows the same rules. Instagram lets a business reply only for a limited time after a guest's last message, and we send in line with its rules; a reply that can no longer be sent is kept as a draft for the venue and is not sent. We cannot start a conversation with someone who has not messaged the venue first.

If you unsend a message. Unsending a message in Instagram does not remove our copy of it. You can ask us to delete it using our data deletion instructions.

What we hold about the venue's account. When a venue connects Instagram we store its Facebook Page and Instagram account IDs and names, the account username, who connected it and when, and an access token, which we keep encrypted. We ask Meta for these permissions, and use them only to receive and send that venue's messages: instagram_basic (the account's ID and username), instagram_manage_messages (receiving and sending its direct messages), pages_show_list (listing the Pages the administrator manages), pages_manage_metadata (subscribing the Page to message notifications), and business_management and pages_read_engagement (which Meta requires alongside the others to reach the assets the administrator chooses; we do not read posts).

Disconnecting. A venue can disconnect Instagram at any time. When it does, we remove our subscription to the account's messages at Meta and delete the access token we stored. Conversations already held stay in the venue's records until they are deleted or reach the retention periods below. A venue can also remove OrdersUp from the connected apps in its Meta account settings, which ends our access.

Instagram messages are kept for the periods set out below.

How long we keep data

We keep personal data only as long as we need it to run the service, then delete it:

• enquiries: 24 months;
• message contents: 12 months;
• voice transcripts: 6 months;
• quality-check data: 90 days;
• guest records: up to 36 months of inactivity;
• system logs: 18 months;
• anonymous usage counts (no personal data): kept indefinitely.

Where your data is processed

OrdersUp hosts its systems in Singapore. Some of the services we rely on to run the platform process data outside Singapore (for example, the AI service, the voice service and the WhatsApp Business Platform process data in the United States, and Meta's Instagram messaging service may also process data outside Singapore). Where that happens, we require those providers to protect your data to a standard comparable to the PDPA, as the PDPA requires for overseas transfers.

Sub-processors we use: Anthropic (AI processing), Vapi (voice telephony and transcription), DigitalOcean (application and database hosting, Singapore), Cloudflare (edge network and access control), Google (email, where a venue connects a Google mailbox), and Meta Platforms (WhatsApp and Instagram messaging, where a venue connects a WhatsApp Business number or an Instagram account).

Your rights

Under the PDPA you can ask to access the personal data held about you and to correct it if it is wrong.

• If you are a guest of a venue, ask the venue first. They control your data; we help them respond. The venue can pull an export of your data from us to answer you.
• If you are an operator or you deal with us directly, contact us at dpo@ordersup.ai and we will respond within the timeframe the PDPA sets.

You can also ask us to delete the personal data we hold about you, including messages you sent a venue on WhatsApp or Instagram. Our data deletion instructions set out what to send us and what happens next.

Marketing and do-not-call

We do not send marketing on our own account to a venue's guests. Where a venue uses OrdersUp to send its own marketing, we check the Singapore Do-Not-Call registry before any marketing message goes out, and the venue is responsible for having a lawful basis to contact you. Booking confirmations and replies you asked for are not marketing.

Data breaches

If something goes wrong and personal data is exposed, we act on it quickly. Where the data belongs to a venue's guests, we tell the venue without delay so the venue can meet its own legal duties, including notifying the PDPC and affected people where required. Where the data is our own (for example operator accounts), we handle the notifications ourselves.

Changes to this policy

We may update this policy as the platform grows. We will post the new version here with an updated date.