Privacy Policy

1. Introduction

Welcome to OrderFlow ("we," "our," or "us"), developed and published by Vidit Sharma (accessible via https://orderflow.reeldukaan.com). OrderFlow is a smart, multi-tenant restaurant and kitchen management software application designed to streamline table-side food ordering, kitchen display systems (KDS), bill calculations, tax receipts, and payment settlements.

We take your privacy and the privacy of your guests very seriously. This Privacy Policy governs your access to and use of the OrderFlow mobile application, the web backend services, and any related software features (collectively, the "Application" or "Services").

2. Information We Collect

Depending on your user role (Super Admin, Restaurant Administrator, Chef, Waiter, or Dining Customer), we collect only the information necessary to fulfill our restaurant ordering and management services:

3. Device Permissions & How They Are Used

The OrderFlow Android application requests specific system permissions to deliver its operational features:

• Camera (android.permission.CAMERA): Used optionally by waitstaff or administrators to photograph customer payment slips or paper receipts as proof of payment for accounting verification. The camera is only triggered when explicitly clicked by the user.
• Storage & Media (android.permission.READ/WRITE_EXTERNAL_STORAGE): Used to temporarily store, display, and share itemized thermal-style PDF receipts and payment QR code assets.
• Notifications (android.permission.POST_NOTIFICATIONS): Used to display high-priority heads-up banners, sound, and vibration alerts when new food orders arrive in the kitchen or when kitchen tickets are marked "Ready" for floor delivery.
• Internet & Network State (android.permission.INTERNET, ACCESS_NETWORK_STATE): Required to maintain secure WebSocket (Socket.IO) connections with the centralized restaurant backend and monitor connectivity.

4. Third-Party Service Providers

We rely on trustworthy third-party infrastructure providers to run OrderFlow securely:

• Google Firebase (Firebase Cloud Messaging - FCM): We utilize FCM to push real-time notifications to staff devices. Subject to Google Privacy Policy.
• MongoDB Atlas: Industry-standard encrypted database hosting with data-at-rest encryption (AES-256) and TLS transit encryption.
• WhatsApp (Meta Platforms): The application utilizes standard Android Intents (via FileProvider) to share PDF receipts to customer phone numbers through WhatsApp when requested by the customer.

5. Multi-Tenant Data Isolation & Security

OrderFlow enforces strict multi-tenancy. All data (menus, categories, staff accounts, orders, payment QR codes, and sales records) is isolated by dedicated restaurantId partitions. Restaurant A cannot view, access, or modify records belonging to Restaurant B.

Security controls implemented include:

• Cryptographic Password Hashing: Passwords are encrypted using salted bcryptjs hashes before storage.
• JSON Web Tokens (JWT): API communication is authenticated with cryptographically signed tokens with expiration timeouts.
• Rate Limiting & Brute-Force Protection: Authentication attempts are rate-limited to shield accounts against automated attacks.
• Transport Layer Security: All client-server communications use HTTPS and WSS (secure WebSockets).

6. Data Retention & Account Deletion

We retain operational and account data only for as long as necessary to provide restaurant services and comply with local business accounting and tax obligations:

• Active Staff Accounts: Stored while your restaurant account remains active.
• Push Notification Tokens: Automatically expired and overwritten upon staff logout or token refresh.
• Account & Data Deletion: Any user or restaurant administrator may request complete deletion of their account, staff codes, and personal data at any time via our dedicated web portal at https://orderflow.reeldukaan.com/delete-account. Requests are fulfilled within 30 days.

7. Children's Privacy

OrderFlow is a commercial enterprise software solution created for restaurant operators, culinary staff, and hospitality personnel. Our Services are not directed to children under 13 (or under 16 in certain jurisdictions), and we do not knowingly solicit or collect personal information from children.

8. Updates to this Policy

We may update this Privacy Policy periodically to reflect enhancements to our features, operational workflows, or regulatory obligations. When changes are published, we will update the "Last Updated" date at the top of this document. Continued use of the Application signifies your acceptance of the revised policy.

9. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact our data protection team: