Privacy across the Orves platform

This Privacy Policy explains how Orves ("Orves," "we," "us," or "our") collects, uses, discloses, stores, and protects personal information through the Orves website, RestaurantOS, Orves Point of Sale ("Orves POS"), Orves Shifts, guest ordering, kitchen displays, loyalty programs, gift cards, scheduling, workforce management, timekeeping, payroll calculations, inventory management, reporting, artificial-intelligence features, mobile applications, APIs, and related services (collectively, the "Services").

This policy applies to Restaurant owners, operators, administrators, and prospective customers; Restaurant employees, contractors, managers, and team members; Restaurant guests, customers, loyalty members, gift-card users, and delivery recipients; suppliers, delivery drivers, and business contacts; website visitors; and anyone who communicates with Orves or uses the Services.

Restaurants and other businesses that subscribe to Orves are referred to as "Restaurants." A Restaurant generally decides why and how personal information about its employees, contractors, guests, customers, delivery drivers, suppliers, and transactions is collected and used. In these circumstances, the Restaurant is generally responsible for the information, and Orves processes it to provide the Services according to the Restaurant's instructions.

Orves is responsible for information we collect for our own customer accounts, subscriptions and billing, website and application operations, support, security, fraud prevention, service communications, product development, and legal compliance.

Restaurants are independent businesses and may have their own privacy notices, employment policies, employee-monitoring notices, and retention requirements. Restaurant employees and guests should contact the relevant Restaurant first when a request concerns information controlled by that Restaurant.

The current Services are not designed to collect Social Insurance Numbers, Social Security numbers, government identity documents, employee bank-account information, employee tax forms, benefits elections, marital status, dependent information, ethnicity, religion, political opinions, union membership, genetic information, or biometric templates. Restaurants and users should not enter this information into general notes, messages, uploads, attachments, or other free-text fields.

Orves does not use guest-order location verification for continuous background tracking. Refusing location permission may prevent location-restricted guest ordering.

Orves uses OpenAI to provide certain AI-assisted features. When an authorized user invokes one of these features, Orves may send the prompt, question, image, recipe, menu, ingredient, inventory, cost, sales, labor, or other Restaurant information needed to complete the request to OpenAI. OpenAI processes that information under its applicable privacy terms and agreement with Orves.

Users should not submit complete payment-card information, government identifiers, medical records, unnecessary confidential employee information, photographs of guests or employees unrelated to the requested feature, or other unnecessary sensitive information to an AI feature.

AI results may be incomplete or inaccurate and require human review. They are not a substitute for food-safety and allergy controls, payroll verification, accounting, legal or human-resources advice, or professional judgment. Orves does not use AI by itself to make legally significant employment or customer decisions.

Orves does not create faceprints, voiceprints, or other biometric identifiers from profile photos, dish photos, or voice-ordering input.

Information handled through the Services that may be considered sensitive under some laws includes account credentials and employee PINs; precise guest-order location; employee pay, salary, payroll, tip, and home-address information; transaction, gift-card, and subscription-billing information; and health-related details voluntarily included in time-off reasons, dietary requirements, allergy notes, or other free-text fields.

Orves uses sensitive information only to provide the requested Services, secure the Services, comply with law, or for another properly authorized purpose. We do not sell sensitive personal information or use it for targeted advertising.

Orves may use email addresses to send product announcements, special offers, promotions, newsletters, onboarding information, and information about Orves Services. We send promotional communications with consent or where otherwise permitted by applicable law.

Orves uses Resend to prepare and deliver transactional and promotional email. To provide this service, Orves may disclose recipients' names, email addresses, communication preferences, message content, and delivery information to Resend.

Resend may also process delivery, bounce, spam-complaint, and unsubscribe information and, when email tracking is enabled, whether a message was opened or a link was clicked together with related device, browser, IP-address, and timestamp information. Resend processes this information under its applicable privacy terms and agreement with Orves.

Recipients can unsubscribe from promotional email using the unsubscribe link in each promotional message or by contacting getorves@gmail.com. Unsubscribing from promotions will not stop necessary transactional communications such as security notices, password resets, invoices, subscription notices, receipts, order information, schedules, shift assignments, or service announcements.

Orves uses Stripe to process subscription payments, recurring charges, invoices, payment-method updates, cancellations, refunds, and other subscription-billing activity.

When a Restaurant purchases a subscription, Stripe may collect and process the subscriber's name, email address, billing address, business information, tax information, payment-card details, payment method, transaction amount, currency, IP address, device information, fraud-prevention information, and transaction history.

Complete payment-card numbers and card security codes are collected directly by Stripe through Stripe-controlled or secured payment fields. Orves does not receive or store complete card numbers or card security codes.

Orves may receive the Stripe customer, subscription, invoice, and transaction identifiers; payment status; invoice information; billing contact details; card brand, expiration date, and last four digits; renewal date; cancellation status; refund information; and payment history. Stripe processes information under its own privacy policy and its agreement with Orves.

Restaurants and guests may also use payment terminals or external payment providers selected by a Restaurant. The relevant provider's privacy notice applies to its independent processing.

Orves does not currently sell personal information for money. The Services do not currently use third-party advertising cookies, advertising-network profiling, or cross-context behavioural advertising. Disclosure to Resend, Stripe, OpenAI, and other providers for the purposes described above is not a sale of personal information.

If Orves later introduces activity legally treated as a sale, sharing, or targeted advertising, we will update this policy and provide required notices and opt-out controls before beginning that activity.

We may create and use aggregated or de-identified information that cannot reasonably identify a person. Where required by law, we will maintain it in de-identified form and not attempt to reidentify it.

Orves uses cookies, local storage, secure storage, and similar technologies to sign users in; maintain web, POS, kiosk, device, and guest-order sessions; pair and recognize devices; remember Restaurant, location, language, theme, date, time, landing-page, sidebar, notification, and interface preferences; confirm guest-order location verification; protect accounts; prevent abuse; and store mobile-app and printer configuration.

Some technologies last only for the current session, while others remain until they expire or are removed. Disabling essential cookies may prevent login, guest ordering, location selection, device pairing, or other Services from functioning.

If Orves introduces non-essential analytics, advertising, or session-replay technologies, we will update this policy and provide any cookie-consent controls required by law.

Orves retains personal information only as long as reasonably necessary to provide the Services, follow a Restaurant's lawful instructions, administer accounts and subscriptions, maintain security and backups, prevent fraud, resolve disputes, keep business records, and meet employment, payroll, tax, accounting, financial, and legal obligations.

Retention depends on the record, sensitivity, purpose, Restaurant relationship, risk, and applicable law. Employee, payroll, timekeeping, transaction, tax, gift-card, refund, and audit records may need to be retained after an account closes. Authentication credentials and active session information are retained while needed for access and security, while some audit and incident records may be kept longer.

When information is no longer required, we delete, de-identify, or securely dispose of it. Deletion from active systems may not immediately remove encrypted backup copies. Backups are removed under the applicable rotation schedule and are restored only for continuity, security, or disaster recovery.

Orves uses safeguards appropriate to the nature and sensitivity of the information. These may include password and PIN hashing, secure sessions, role-based permissions, Restaurant-location access controls, device pairing, encrypted network connections where supported, rate limiting, audit histories, restricted administrative access, backups, and provider security requirements.

No system can guarantee complete security. Restaurants and users must protect passwords, PINs, devices, printer networks, exported files, and account access and promptly report suspected unauthorized activity.

Orves and its providers, including Resend, Stripe, OpenAI, and infrastructure providers, may process or store information in Canada, the United States, and other countries where they operate. Privacy laws in another country may differ, and courts, regulators, law-enforcement organizations, or national-security authorities may lawfully access information there. Where required, Orves uses contracts or other legally recognized safeguards for cross-border processing.

Depending on applicable law, a person may have rights to know whether their information is processed; learn how it is used and disclosed; request access, a copy, correction, deletion, restriction, or portability; withdraw consent; object to certain processing; opt out of sale, sharing, targeted advertising, or qualifying profiling if applicable; appeal a denied request; and complain to a privacy regulator.

Restaurant employees and guests should normally submit requests to the Restaurant responsible for their employment, order, loyalty, gift-card, or customer information. Requests concerning Orves-controlled information may be sent to getorves@gmail.com.

We may verify identity, account ownership, Restaurant relationship, and authority before responding. A request may be limited or denied where permitted by law, including where it would reveal another person's information, interfere with security, conflict with law, or require deletion of a record that must be retained.

Users may update available account information, change notification and device permissions, unsubscribe from promotional email, and follow the account-deletion instructions at www.getorves.com/delete-account. Signing out, clearing app data, or uninstalling an app may remove local information but does not automatically delete server records.

The Services are intended for Restaurants, authorized Restaurant personnel, and Restaurant guests and are not directed to children under 13. Orves does not knowingly create a direct consumer account for a child under 13 without legally sufficient authorization.

Restaurants may employ younger workers where permitted by law. The Restaurant is responsible for required employment and privacy notices and parental or guardian authorization where required. Orves may process a younger worker's account, schedule, timekeeping, and payroll information at the Restaurant's direction.

The Services may link to or work with app stores, Stripe, Resend, OpenAI, delivery services, maps, weather services, social networks, Restaurant websites, or other services not controlled by Orves. Their privacy notices and terms apply to their independent processing.

We may update this policy when our Services, providers, practices, or legal requirements change. We will publish the revised policy at www.getorves.com/privacy with a new effective date and provide additional notice or request consent where required by law.

Questions, privacy requests, and complaints may be sent to the Orves Privacy Team at getorves@gmail.com or mailed to Orves, 8260 Rosehill Dr, Richmond, British Columbia, Canada.

Use "Privacy Request" as the email subject and identify the relevant Restaurant when applicable. Do not send passwords, PINs, complete payment-card numbers, government identifiers, medical documents, or unnecessary sensitive information by email.

Individuals may also contact the privacy regulator responsible for their jurisdiction, including the Office of the Privacy Commissioner of Canada or the applicable provincial regulator.