Privacy policy

1. Who we are

OrderDM (‘OrderDM’, ‘we’, ‘our’, ‘us’) provides an AI chatbot and order automation services to small shops on Instagram. OrderDM is the trading name of ORDERDM.AI LTD, a company registered in England and Wales, company number 17395660, with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Contact: support@orderdmai.com.

2. What this policy covers

It covers the personal data of website visitors, people who contact us, shop owners who use the app, and customers who interact with the bot. For the data of visitors, people who contact us and app users (shop owners and team members) – including billing details – OrderDM is the controller. When we operate bots within our clients’ (shops’) Instagram accounts, OrderDM acts as a data processor on behalf of the client (who is the controller).

3. What data we collect

Data you give us:

• Sign-up / contact / account opening: name, email, Instagram account, business type, messages.
• App (shop owner): sign-in email, shop name and details, product catalogue.
• Through the bot (customers): the content of Instagram messages and comments, and the order details the customer provides themselves – name, phone number, delivery address.
• Instagram (when the owner connects an account): business account ID, username, profile picture URL and access token (stored on the server only — the app never reads it); posts, stories and comments to import products and recognise them. You can disconnect in Settings → “Instagram connection” → “Disconnect Instagram” — the token is deleted and access is revoked.
• Customer data (processed on behalf of the shop, which is the controller): the sender’s Instagram ID and username, message text and attachments, comments, name, phone number, delivery address and orders.
• Notifications (if you turn them on): the web push registration (delivery service address, keys, device/browser type) and, in the iOS app, the Apple device token — used only for order notifications and deleted when you turn notifications off or delete your account.
• Billing (when the owner turns on automatic card billing or agrees with us to pay by bank transfer): invoice details – company name or full name, address, city, postcode, country and invoice email, plus, if you enter them, PIB (tax ID), company registration number (MB) and VAT status; Stripe customer and saved-card references; statements, invoices and payment status. Invoice details are needed to issue invoices (a contractual and legal requirement) – without them billing can’t be turned on. Your card number and security code are entered directly on a Stripe page – we never receive or store them. Stripe gives us basic card details (brand, last 4 digits, expiry date and issuing country), and we keep only the card brand and the last 4 digits.
• A record of your acceptance of the authorisation for automatic payments: terms version, a fingerprint (SHA-256) of the text shown, IP address, browser and device details (user agent) and the time of acceptance.
• With billing we also keep technical records: the notifications Stripe sends us (only the event reference and type, the time and the reference of the invoice, card or customer they relate to – no card details or invoice details) and internal billing notes for our administrator (e.g. a failed payment, a dispute or an invoice awaiting approval), which may contain the shop name and the name or company name on the invoice.

Collected automatically: usage and device data (pages visited, approximate region, browser/device type, server logs) and cookies (see section 4).

We may also keep a pseudonymised fingerprint (HMAC with a secret key) of the Instagram business account ID, together with the dates the new-account benefits started and ended and the number of messages used, so that these benefits can’t be used more than once for the same Instagram account; the ID can’t be read back from the fingerprint.

We do not knowingly collect special categories of data. We never receive or store full payment card numbers – only Stripe processes them.

4. Cookies and similar technologies

We use essential cookies (to run the app and for sign-in – these cannot be switched off) and, on the website, optional analytics cookies that load only after you accept them in the banner. You can change your preferences in your browser settings.

The app (web and iOS) contains no third-party analytics or advertising tools and does not track you across other apps or websites; it only uses strictly necessary cookies and local storage for sign-in and settings.

5. How we use data and our legal basis

• Responding to enquiries, sign-ups and bot messages – basis: performance of a contract or steps taken at your request.
• Providing, maintaining, securing and improving the service – basis: our legitimate interests.
• Optional analytics – basis: your consent.
• Service messages and notifications – basis: consent or legitimate interests.
• Complying with legal obligations and enforcing our terms – basis: legal obligation or legitimate interests.
• Billing for the service – statements, invoices, charging the saved card via Stripe or an invoice for bank transfer, billing emails and technical payment records – basis: performance of a contract.
• Keeping invoices and statements (with invoice details) – basis: legal obligation (accounting and tax rules).
• The record of your acceptance of the authorisation for automatic payments (IP address, browser/device) – as evidence that the authorisation was given, in case of a payment dispute – basis: our legitimate interests and legal obligations.
• The Instagram account fingerprint – preventing abuse of new-account benefits – basis: our legitimate interests.

We do not sell your personal data or use it for targeted advertising based on tracking across different contexts.

6. Automated processing and artificial intelligence

The bot uses third-party AI (e.g. OpenAI) to generate replies, recognise intent and extract order details. The bot answers questions and refers you to a person when needed, but does not make decisions that produce legal or similarly significant effects on you. Please do not include sensitive personal data in messages.

Before the AI assistant starts processing customer messages, the store owner gives explicit consent in the app (Settings → “AI assistant & privacy”) and can withdraw it at any time — the assistant then stops sending messages to AI services. The same applies to the in-app “Help” chat: each user gives their own consent before asking the first question.

The in-app “Help” chat sends your question, earlier messages in that conversation and basic shop details (name, Instagram username, connection and pause status, ordering mode, tone) to OpenAI (USA) to write a reply. Don’t enter passwords or customer data in the chat.

7. Who we share data with

We do not sell your data. We share it only with service providers, under contracts that protect it, so that the service can function:

• Meta / Instagram – receiving and sending messages and comments via the Instagram Graph API.
• Supabase – database (orders, customers, catalogue, messages, billing details).
• OpenAI – the artificial intelligence model that generates the bot’s replies.
• n8n (on Hetzner infrastructure) – automation and message routing.
• Vercel – app hosting; other hosting/infrastructure providers.
• Apple (Apple Push Notification service) – delivering notifications in the iOS app.
• Stripe – card payments, storing your card, issuing invoices (including for payment by bank transfer) and the page for managing your card and invoices. You enter card details directly with Stripe; for some purposes (e.g. fraud prevention and legal obligations) Stripe also processes them as an independent controller, under its own privacy policy.
• Resend – sending billing emails (statements, invoices, payment notices) from naplata@orderdmai.com; processed in the EU region (Ireland).
• Cloudflare (USA) – forwarding emails sent to our @orderdmai.com addresses (e.g. support) to our Google mailbox.
• Google (Gmail) – our mailbox (emails sent to @orderdmai.com addresses, correspondence with support) and sending the sign-in code email for the app.
• On the website: Web3Forms (forms), Google (email, scheduling, analytics with consent), Microsoft Clarity (with consent).

Data may be disclosed where required by law, to protect rights or safety, or in the course of business transfers.

8. International data transfers

Our service providers operate globally, so data may be transferred outside your country. Where necessary, we rely on appropriate safeguards (e.g. the European Commission’s Standard Contractual Clauses). This also applies to Stripe, Resend, Cloudflare and Google: for transfers outside the UK and the EEA we rely on their data processing agreements with such safeguards (e.g. Standard Contractual Clauses with the UK Addendum, or the EU–US Data Privacy Framework).

9. How long we keep data

• Form and email enquiries: for the duration of our contact and up to 24 months afterwards, after which we delete or anonymise them.
• Bot messages: OrderDM automatically deletes messages older than 30 days; orders and customer data are kept for as long as the shop needs them to run its business.
• Statements and invoices (with invoice details): for as long as accounting and tax rules require – for a UK company, typically 6 years – including after account deletion; the same applies to invoices and invoice details held by Stripe.
• Technical records of Stripe notifications and internal billing notes: no longer than invoices.
• The record of accepting the authorisation: while automatic billing is active and afterwards for as long as needed for possible payment disputes and legal obligations (no longer than invoices).
• Your saved card (held by Stripe): until you remove it or delete your account (you can also ask support to remove it); invoice details in the app: until you delete your account. When you delete your account, the card is removed straight away – or, if there’s an unpaid invoice at that point (including the final statement created when you delete your account), 30 days after deletion, even if the invoice still hasn’t been paid.
• Instagram account fingerprint (with the dates and message count): no longer than 24 months from when it was recorded.
• Account deletion: in the app (Settings → “Account” → “Delete account”) — shops where you are the only owner are deleted immediately, with their products, orders, customers and messages. After deletion we keep only: an aggregate monthly message count (for billing), with no customer data; if billing was on (automatic or by bank transfer) – statements and invoices with invoice details, authorisation records, technical records of Stripe notifications and internal billing notes; and the Instagram account fingerprint, if one was recorded (periods above). System logs disappear within 7 days. More: Data deletion.
• Analytics: in line with the provider’s default retention periods.
• Some records are kept for longer where the law requires it.

10. How we protect data

We use encryption in transit (HTTPS), access controls and trusted service providers. No method of transmission or storage is completely secure, but we work to protect your data and to notify you and the relevant authorities of a data breach where the law requires it.

11. Your rights

EEA/UK residents (and similarly under Serbia’s Law on Personal Data Protection): the right of access, rectification, erasure, restriction of or objection to processing, data portability and withdrawal of consent. You also have the right to lodge a complaint with a data protection supervisory authority: in the United Kingdom (where ORDERDM.AI LTD is registered), the Information Commissioner’s Office (ICO); in Serbia, the Commissioner for Information of Public Importance and Personal Data Protection; and in the EEA, the supervisory authority in your country.

To exercise your rights, email support@orderdmai.com. We respond within the statutory time limits (up to 30 days under the GDPR).

12. Data we process on behalf of clients

When we operate bots in clients’ Instagram accounts, OrderDM acts as a processor on the documented instructions of the client (the shop). Customers who want to access or delete their data should contact the shop itself (the controller); OrderDM supports the controller in responding.

13. Children’s privacy

The service is not intended for children under 16, and we do not knowingly collect their data. If you believe a child has given us data, email support@orderdmai.com.

14. Third-party links

Links to third-party services (Instagram, Google) are governed by their own privacy policies, not this one.

15. Changes to this policy

When we make material changes, we update the ‘Last updated’ date and notify active clients. We recommend checking this page from time to time.

16. Contact

For any question, request or complaint about privacy: support@orderdmai.com.