Privacy policy
What we collect, why, who sees it and how long we keep it. Written for restaurant owners and their customers, not for lawyers.
Last updated 28 September 2026
1. Who we are
ChatOrder is run by Devzenix Ltd, a company registered in England and Wales. We provide an assistant that lets food businesses take orders on WhatsApp.
Data controller: Devzenix Ltd, United Kingdom. info@chatorder.co.uk
2. What we collect
If you run a business on ChatOrder
- your name, email address and phone number
- your business name, address, postcode and contact details
- your menu, prices, notes, hours and settings
- your Stripe keys, so payments can go to your account; card numbers never reach us
- your login details; passwords are stored hashed, never as plain text
If you order from a business on WhatsApp
- your WhatsApp phone number
- your name, if you give it
- your delivery address, if you order delivery
- your orders, and preferences you mention such as an allergy or a usual order
- the conversation with the assistant
Collected automatically
- for the dashboard: your IP address and browser type, in server logs
- on this website: which pages are viewed and which buttons are used, counted without cookies and without identifying you
- WhatsApp message metadata such as timestamps and delivery status
3. Finding restaurants near you
On our restaurants page you can sort restaurants by distance. To do that you either type a postcode, or tap a button that asks your browser for your location. Your browser will ask your permission first; the page works without it.
The postcode, or the position your browser gives, is sent to postcodes.io, a free public UK postcode service, to turn it into a map point and a town name. The distance to each restaurant is worked out in your browser. We do not receive, store or log your location, and it is gone when you leave the page.
4. What we use it for
- to take and manage orders and bookings, and to send order updates on WhatsApp
- to take card payments through Stripe, which pays the business directly
- to answer customers accurately: the assistant reads the business's menu and notes, and remembers a customer's preferences for 90 days after their last order so they do not have to repeat them
- to help businesses when they contact us
- to keep records the law requires, such as tax records
5. Our lawful basis (UK GDPR)
- Contract: taking and fulfilling orders and bookings, running your account
- Legitimate interest: order updates, preventing fraud and abuse, improving the service
- Consent: any marketing message a business chooses to send; you can withdraw it at any time
- Legal obligation: tax and accounting records
6. WhatsApp and Meta
Messages travel through the WhatsApp Business Platform run by Meta. Meta processes message metadata under its own privacy policy. We use WhatsApp for conversations about orders and bookings. A business may only send marketing messages to customers who have agreed to receive them, and you can ask the business, or us, to stop at any time.
7. The automated assistant
Conversations on a business's WhatsApp number are handled by an automated assistant. To produce replies, the text of the conversation, the business's menu and notes, and the current order are sent to OpenAI, whose GPT-4o models we use. We choose and configure the model; businesses do not. OpenAI processes this data under its business terms and does not use it to train its models.
The assistant answers only from the business's menu and notes and cannot set prices. Order totals and receipts are produced by our software. A business can take over any conversation from its dashboard, and the assistant hands over to a person for serious matters such as an allergic reaction or a refund request.
9. How long we keep it
- Orders and payments: 6 years, as UK tax law requires
- Conversations: kept while the business's account is open, and deleted with the account
- Customer preferences remembered by the assistant: 90 days from the last order, then dropped
- Customer profiles held by a business: until the customer or the business asks for deletion
- Business accounts: 30 days after closure, then deleted, except records we must keep
- Card details: never held by us
10. Your rights
Under UK GDPR you can ask us to:
- give you a copy of the data we hold about you
- correct it
- delete it (see our data deletion page)
- send it to you in a usable file
- limit or object to how we use it
- stop marketing messages
Email info@chatorder.co.uk and we reply within one month.
11. Security
- Everything between your browser, WhatsApp and our service travels over encrypted connections (HTTPS).
- Passwords are stored hashed, never as plain text.
- Card details are handled entirely by Stripe, which is certified to the card industry's highest standard (PCI DSS Level 1).
- Each business's data is kept separate from every other business's.
- Access to the service is by signed login tokens, and staff access is limited by role.
12. Data outside the UK
Some providers we use (Meta, Stripe, OpenAI, our hosting) process data outside the UK. Where that happens we rely on the UK's adequacy decisions and the providers' standard contractual clauses.
14. Children
ChatOrder is not aimed at children under 16 and we do not knowingly collect their data. If you think a child has given us personal data, please contact us and we will delete it.
15. Changes
We may update this policy. Registered businesses are told of material changes by email, and the date at the top shows the latest version.
16. Complaints
If you are unhappy with how we handle your data, email info@chatorder.co.uk.
You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113.