Last updated: 18 September 2026
1. Who we are
Orderee is operated by [[COMPANY NAME]], registered in the Hashemite Kingdom of Jordan under commercial registration number [[REGISTRATION NUMBER]], at [[REGISTERED ADDRESS]].
We are the controller of the personal data described here.
Questions, or to exercise any right below: support@orderee-app.com
This policy covers orderee-app.com and the three Orderee apps: the customer app, the merchant POS, and the rider app.
2. What we collect
### Everyone with an account
- name, email address, mobile number
- password, stored only as a cryptographic hash — never in readable form
- profile photo, if you upload one
- preferred language and country
- whether your phone and email have been verified
### Customers
- delivery addresses, including a label, the street address, city, and the precise latitude and longitude of the pin you set
- your device’s location, when you allow it, to find nearby restaurants and to pre-fill an address. You can refuse this and enter addresses manually
- order history: what you ordered, from whom, when, for how much
- ratings and reviews you leave
- items you favourite, and your cart contents
- messages you send to support
### Riders
- the documents and details you submit during onboarding: identity documents, vehicle details, date of birth, home address, emergency contact
- your location while you are on shift, transmitted in real time so orders can be assigned and tracked, and so customers can follow their delivery
- shift attendance, deliveries completed, ratings, penalty points and earnings
### Partner Restaurants and their staff
- business details, licences and documents provided during onboarding
- staff accounts created under the restaurant, and the role given to each
- orders, payouts and cash-drawer records recorded through the POS
### Collected automatically, for everyone
- IP address and browser/device user agent, recorded with your sessions, our audit log of significant actions, and payment attempts
- device identifiers and push-notification tokens, so we can notify you about your order
- app usage and diagnostics — see §5
### Payment Where you pay by card or online, payment is handled by our payment provider. We do not receive or store your full card number. We keep the transaction reference, amount, currency, status, and the provider’s response, so we can reconcile and support your order.
Cash-on-delivery orders record only the amount and that cash was used.
3. Why we use it, and our legal basis
| What we use it for | Basis |
| Creating and running your account | Performance of a contract with you |
| Taking, preparing, delivering and supporting your orders | Performance of a contract |
| Sharing your name, phone and address with the Partner Restaurant and rider fulfilling your order | Performance of a contract |
| Real-time rider location while on shift | Performance of a contract with the rider; legitimate interest in delivering orders and customer safety |
| Verifying rider identity and right to work | Legal obligation and legitimate interest |
| Fraud prevention, abuse and security investigations | Legitimate interest |
| Product analytics and crash diagnostics | Consent, or legitimate interest where permitted |
| Marketing messages | Consent, which you may withdraw at any time |
| Keeping tax and accounting records | Legal obligation |
Your lawyer should confirm these bases against Jordanian data protection law, and against GDPR if you serve or market to anyone in the EU.
4. Who we share it with
Partner Restaurants receive what they need to fulfil your order: your name, order contents, and — for delivery — your address and contact number.
Riders receive your delivery address, contact number and order details while they are delivering to you.
Customers can see a rider’s first name, vehicle details and live location while that rider is delivering their order.
We also use these service providers (“processors”):
| Provider | Purpose | Data involved |
| Google Firebase | Push notifications | Device push tokens |
| Google Maps | Maps, address search, geocoding | Location and address entered or detected |
| Google Sign-In / Apple Sign In | Optional social login | Your identifier and email from that provider |
| Sentry | Crash and error reporting | Diagnostic data, which may include device and account identifiers |
| PostHog | Product analytics and session replay | App usage events and recordings of app screens and interactions — see §5 |
| Amazon Web Services | File storage and hosting | Uploaded images and documents |
| Payment provider (not yet enabled – cash only today) | Card and online payments | Payment details you enter, handled by them |
| OVH SAS | Servers and database | All of the above, at rest |
We do not sell your personal data.
We disclose data to authorities where required by law, and to advisers or an acquirer in connection with a corporate transaction, under confidentiality.
5. Analytics and session replay — read this
The apps include PostHog session replay, which records your interactions with app screens so we can see where the product fails people.
This can capture what is shown on screen and what you tap. We configure it to mask sensitive fields, and payment card entry happens in our payment provider’s own interface, not in ours.
Confirm and state explicitly: which fields are masked; whether replay is on by default or only after consent; and how a user turns it off. If it is on by default, you likely need consent before enabling it — check this with your lawyer. Do not publish this section without verifying what the app actually does.
Crash reports (Sentry) are diagnostic and may contain device information and an account identifier so we can reproduce a fault.
6. How long we keep it
| Data | Retention |
| Account details | While your account is open, then suggested 24 months (confirm) |
| Orders, invoices, tax records | the period required by Jordanian tax law (confirm with your accountant) |
| Delivery addresses | Until you delete them, or your account closes |
| Rider location history | suggested 90 days (confirm) |
| Rider verification documents | suggested 24 months (confirm) |
| Session and audit records, IP addresses | suggested 24 months (confirm) |
| Analytics and session replay | suggested 24 months (confirm) |
When you close your account we delete or anonymise your data within suggested 24 months (confirm), except where we must keep it for tax, accounting, fraud prevention or a legal claim.
7. Your rights
You can ask us to:
- give you a copy of the personal data we hold about you
- correct anything inaccurate
- delete your data, where we are not required to keep it
- restrict or object to a particular use
- withdraw consent you have given, such as for marketing or analytics
- provide your data in a portable, machine-readable form
Write to support@orderee-app.com. We respond within 30 days. If you are unhappy with our response you may complain to the Personal Data Protection Council, Ministry of Digital Economy and Entrepreneurship (confirm the current body).
Some things you control directly in the app: location permission, push notifications, saved addresses, and your profile details.
8. Children
Orderee is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.
9. Security
We protect your data with encryption in transit, hashed passwords, access controls and audit logging of significant actions.
No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authority where the law requires it.
10. Where your data is held
Our servers are located in the United Kingdom (OVH SAS). Some processors listed in §4 operate outside Jordan, which means your data may be transferred abroad. Where that happens we rely on contractual safeguards with each provider (your lawyer should specify the mechanism).
11. Cookies
The website uses cookies for sign-in, preferences and analytics. Describe your cookie banner here and how a visitor refuses non-essential cookies.
12. Changes
We may update this policy. The current version is always published here, with the date at the top. If a change materially affects you, we will take reasonable steps to tell you.
13. Contact
[[COMPANY NAME]] [[REGISTERED ADDRESS]] support@orderee-app.com