1. Data we collect

OrderGer is a tool for managing your restaurant's website orders on mobile. When you use the app we collect:

• Account info: email, business name, business phone, language preference, timezone.
• Order data: details of each order pushed by your website to OrderGer (customer name, phone, address, items, total). We pass this through to your restaurant team.
• Usage data: order history, staff actions (accept/reject/complete), timestamps.
• In-app purchase records: Wallet top-ups are processed by Apple via App Store In-App Purchase. We receive only: transaction ID + amount + product ID. We never see your payment card or financial details.
• Device data: push notification token (FCM/APNs) used solely to deliver new-order alerts.

2. What we do NOT collect

• Location.
• Payment-card data or sensitive financial information (Apple handles payment end-to-end).
• Browsing activity outside the app.
• Microphone, camera, contacts, photos — the app requests none of these permissions.

3. Why we collect it

• To run the core service (order delivery + notifications).
• Transparent pay-as-you-go billing ($0.05 per completed order; $0.01 per cancellation after the first 10/month).
• Diagnostics and performance improvements (anonymized logs, 30-day retention).
• Fraud prevention (e.g. abuse protection on repeated same-customer cancellations).

4. Who we share data with

Nobody except:

• Cloudflare (infrastructure host — D1 database, R2 storage, Workers compute).
• Apple (push notifications + IAP billing).
• Firebase Cloud Messaging (Google) — Android push delivery.

We do not sell your data and we do not share it for marketing.

5. Your rights

• Access your data anytime from the app's settings.
• Export your order history (available in the admin dashboard).
• Delete your account and all related data — email hamidalqwaysim@gmail.com, deletion within 30 days.
• Revoke MCP-client access via OAuth settings.

6. Data retention

• Order records: 24 months for accounting and diagnostics.
• Technical logs: 30 days.
• On account deletion: all personal data removed within 30 days (we retain anonymized transaction records as required by law).

7. Security

• HTTPS/TLS 1.3 for every connection.
• Passwords stored with PBKDF2 (100,000 iterations).
• Webhooks signed with HMAC-SHA256.
• Scoped API keys (per-branch, test mode, etc.).

8. Children

OrderGer is for restaurant owners and businesses — not for children under 13.

9. Changes

Any updates will be announced in-app and on this page. The date above reflects the latest change.

10. Contact

Privacy questions: hamidalqwaysim@gmail.com