Privacy Policy

Last updated: 5 October 2026

This Privacy Policy explains how Important Small Things Limited ("we", "us", "our"), trading as Orders Up, handles personal data. We are registered at 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ (company number 16431951). For any privacy question, contact us at support@ordersup.app.

1. Our role (controller vs processor)

  • Venue owner accounts. We are the data controller for the personal data of the people who sign up to run a venue (e.g. account email).
  • Guest order data. When a guest orders at a venue, the venue is the controller of that guest data and we act as the venue's processor, handling it on the venue's instructions to provide the Service.

We are registered with the UK Information Commissioner's Office (registration ZC005879). We are not required to appoint a statutory Data Protection Officer, but you can raise any data protection question with us at support@ordersup.app.

2. What we collect

  • Account data (owners): email address, a hashed password, your venue name, branding, settings, and whether you have opted in to product news.
  • Order data (guests): the name and table/area a guest enters, the items they order, any free-text note they add to an order, and order status/history. Notes are for things like "no ice"; please don't put health, allergy or other sensitive details in them unless the venue has asked for it, and venues should not ask guests for more personal data than they need.
  • Gift details (owners and recipients): if you give your venue as a gift (while buying it, or later from the Gift tab), the names and message you put on the card, and, if you choose to email it, the recipient's email address, which we use to send that one email. If you schedule the email for a later date we hold the address until it is sent (or you cancel it), and otherwise keep nothing beyond our record of the send.
  • Payment data: handled by Polar (see below). We receive confirmation of your subscription status and identifiers, but not your full card details.
  • Technical data: standard server and security logs (such as IP address, browser type, and timestamps) generated when you use the Service, used for security, abuse-prevention, and reliability.

3. How we use it and our lawful basis

  • To provide the Service (accounts, menus, ordering, queue) — performance of a contract.
  • To take payment via our payment provider — performance of a contract.
  • To secure and improve the Service and prevent abuse — our legitimate interests.
  • To send service emails (e.g. password resets, billing and account notices) — contract / legitimate interests.
  • To deliver a gift an owner asks us to send: one email to the recipient naming the sender, containing only the gift — our legitimate interests in delivering it. The recipient is never added to any list.
  • To send product news (occasional emails about new Orders Up features) — only if you opted in, on the basis of your consent. You can withdraw it at any time from your dashboard (Account → Emails) or the unsubscribe link in every such email; service emails are unaffected.
  • To comply with legal obligations (e.g. accounting, responding to lawful requests) — legal obligation.

Providing your account information is necessary to enter into and perform our contract with you. If you do not provide it, we cannot create your venue or provide the Service. Guests decide what to enter when placing an order.

4. Payments

Payments are processed by Polar (Polar Software Inc.), our Merchant of Record. Polar collects and processes your payment details under its own privacy policy. We do not store full card numbers.

Some account data is not collected from you directly but is provided to us by Polar (the source). The categories we receive are limited to your billing email, subscription status, and customer/subscription identifiers — we use these to activate and manage your venue's access.

5. Sharing and sub-processors

We do not sell your personal data. We share data only with service providers who help us run the Service:

  • Cloudflare — hosting, database (D1), file storage (R2), and security/CDN.
  • Polar — payment processing and billing (Merchant of Record).
  • Resend — sending transactional emails.

We may also disclose data where required by law or to protect our rights and users.

6. International transfers

Some of our providers process data outside the UK/EEA. Where they do, we rely on appropriate safeguards (such as UK/EU Standard Contractual Clauses or an adequacy decision) to protect your data.

7. Retention

  • Owner account data is kept while your account is active. After a paid plan lapses, venue data is kept for 14 days so you can reactivate, and is then permanently deleted by a scheduled job — unless you hold an Archive plan, which keeps it while that plan is active.
  • Guest order data is retained on behalf of the venue. Completed orders are deleted automatically 90 days after completion, and the venue activity log after 180 days; all of it is deleted sooner if the venue's data is deleted per the lifecycle above. Venues can delete individual orders or clear completed orders from their queue at any time, which also removes the guest's name from the venue's activity log; for any other deletion request, contact us at the address in section 1.
  • Venue activity log (who changed the menu, settings or an order's status, with the staff member's IP address) is kept while the venue exists and deleted with it.
  • Gifts (the names and message on a gift card) are kept until the owner withdraws the gift or the venue is deleted. A gift recipient's email address is held only while an email the owner scheduled is waiting to go, and is deleted when it is sent or cancelled; the record of the send (address, subject, delivery reference) is kept for 90 days.
  • Records of the notices we are required to send — renewal reminders and the warnings we send before a lapsed venue is deleted (the date, the address we sent to, the subject and the delivery reference — not the email itself) — are kept for six years, and are the one record we keep after a venue is deleted. They exist so we can show that notice was given if a renewal charge or a deletion is ever disputed, which is the limitation period for contract claims in England and Wales.
  • Records of other emails we send you (password resets, welcome and verification messages, service notices — again date, address, subject and delivery reference only) are kept for 90 days so we can investigate a message that did not arrive.
  • Other logs and records we must keep (e.g. for security or accounting) are kept only as long as necessary.

8. Your rights

Under UK/EU data protection law you have the right to access, correct, delete, restrict, or object to the processing of your personal data, and to data portability. To exercise these rights, contact support@ordersup.app. If you are a guest of a venue, please contact that venue (the controller) first; we will assist them as their processor.

Owners can change their venue's data at any time in the dashboard and delete orders from the queue. Full export or deletion of an account is handled by email at the address above; we respond within one month, and a venue can be deleted on request at any time.

You can also complain to the UK Information Commissioner's Office (ICO) at ico.org.uk, though we'd appreciate the chance to resolve concerns first.

9. Automated decision-making

We do not use your personal data to make solely automated decisions that produce legal or similarly significant effects, and we do not carry out profiling. We do not rely on consent as a lawful basis, so there is no consent for you to withdraw; where we rely on legitimate interests, you can object as described above.

10. Cookies and local storage

We use only essential browser storage needed to make the Service work. Session storage holds your access and cart until the tab is closed; local storage on a guest's device keeps a copy of that device's recent orders so "reorder" works, until the browser's site data is cleared; login cookies keep owners signed in for up to 7 days (super-admin, 24 hours), with a matching anti-forgery cookie; an operator-only preview cookie exists for pre-launch testing. We do not use advertising or third-party tracking cookies. Our providers (e.g. Cloudflare) may set strictly necessary cookies for security.

Our blog (ordersup.app/blog) sets no cookies and loads nothing from other companies when you read it; we count how many times each post is read per day, with nothing about the reader. Some posts include a video from YouTube or Vimeo. It shows as a still picture until you press play; only then does the video load from that provider (YouTube in its privacy-enhanced mode, Vimeo with tracking switched off), which receives your IP address and device details and may set its own cookies under its own privacy policy. Share buttons are plain links: nothing is sent to a social network unless you choose to share.

To see how people find us, we count visits to our public website (the front page, the blog and these legal pages) by the site they came from and the page they arrived on, for example "12 visits from google.com to the front page on 5 October". The count is taken from the web address your browser sends with the page request (the referring site, or a tag such as utm_source in our link); it uses no cookies or scripts, and we keep only the daily totals, never your IP address, device details or anything else that identifies you. The totals are deleted after 13 months.

11. Children

The Service is intended for businesses and is not directed at children. We do not knowingly collect personal data from children.

12. Changes

We review this policy regularly and may update it from time to time. We will post the updated version here and change the "last updated" date; material changes will be notified where appropriate. If we ever plan to use your personal data for a new purpose, we will update this policy and tell you before that processing begins.

13. Contact

Questions or requests: support@ordersup.app.