Privacy Policy

TheSimpleOrder (“we”, “our”) provides software-as-a-service for food businesses. This policy describes what personal data we collect, how we use it, and the rights you have over it. We aim to comply with the EU GDPR, the UK GDPR, and India’s DPDP Act, 2023.

What we collect

• Account data — name, email, organisation, role, chosen tax region and currency.
• Customer data you put in — leads, quotes, orders, subscribers, deliveries. You are the controller; we are the processor.
• Payment metadata — gateway IDs, charge events. Card numbers never touch our servers; they go directly to our PCI-DSS compliant payment gateway.
• Operational data — request logs, IP country code, error reports. Used to keep the service running and secure.

How we use it

• To run the service you signed up for.
• To send transactional email — quotes, receipts, phase approvals, welcome emails. We don’t do marketing email without explicit opt-in.
• To improve the product and detect abuse.
• To comply with legal obligations — tax filings, lawful court orders.

Who we share it with

• Sub-processors we use: Supabase (database / auth), Resend (email), and a PCI-DSS compliant payment gateway. Each is bound by a DPA at least as strict as this policy.
• We do not sell your data. Ever. Not to advertisers, not to data brokers, not to LLM training pipelines.
• We disclose data when legally compelled, and only the minimum necessary.

Where we store it

Primary database is in ap-south-1 (Mumbai). Backups are encrypted at rest. We follow the principle of least privilege — engineers don’t routinely touch customer data, and access is audited.

Your rights

• Access — request a copy of your data any time.
• Rectify — fix data via the dashboard or by emailing us.
• Delete — close your organisation; we’ll purge or anonymise within 30 days, except where retained by tax law.
• Portability — export quotes, orders, and subscribers as CSV.
• Object — opt out of any processing not strictly needed to run the service.

Cookies

We use one essential cookie for authentication. We don’t use third-party analytics, ad pixels, or session-replay tools.

Contact

Privacy questions: privacy@thesimpleorder.com. Data-deletion requests: same address. We’ll reply within five business days.