Privacy policy

Version 2026-10-21

This explains what OrderHero (ABN 49 413 175 440) collects and why, for diners who use a venue's menu and for venues. We handle personal information under the Australian Privacy Principles.

Diners

What we store: the dishes in an order, notes you type, the table number, and the time. We do not ask for your name, address or card details on the menu. We keep a random device code in a cookie for up to 12 hours so your table's basket stays together; we store only a one-way hash of it, different for each venue.
Language: a cookie remembers English or 中文 for up to a year.
Rewards: if a venue offers rewards, a cookie links your phone to a stamp or points balance at that venue only. Venues cannot see each other's diners.
Saving rewards on a new phone (optional): you may add a phone number or email. We store only a keyed hash of it, use it only to log you back in, never for marketing, and you can delete it with Forget my number.
Technical data: your IP address is used briefly to limit abuse (for example, too many orders a minute). It is not saved against your order.
Payments: if you pay online, the payment is handled by the venue's Stripe or Square account. We receive the result, not your card number.
Who sees it: the venue you ordered from sees your orders. We do not sell personal information or use it for advertising.

Venues

What we store: owner and staff emails and hashed passwords, your menu and settings, orders, reports, invoices and a change log of who changed what.
AI assistant: when an owner asks the assistant a question, the question and the relevant venue figures (sales, menu, tables) are sent to Anthropic, our AI provider, to produce the answer. Diners' personal information is not sent.
Hosting: data is stored on Cloudflare's infrastructure. Some of it may be processed outside Australia.

Keeping it safe

Passwords are stored hashed, table QR codes are signed so they cannot be forged, and staff access is limited to the work they do. No system is perfectly secure; if a breach is likely to cause serious harm we will notify the people affected and the regulator as the law requires.

Your rights

You can ask us to see, correct or delete personal information we hold about you by emailing support@orderhero.com.au. Diners who gave a phone number or email can delete it themselves. If you are not happy with our answer you may complain to the Office of the Australian Information Commissioner (oaic.gov.au).

Changes

If we change this policy we will update the version date above and, for a material change, tell you in the owner portal before it applies.

Questions: support@orderhero.com.au