Privacy policy
Version 1, in force since 16 October 2026.
German is the binding text.
Who is responsible
This policy applies to the people who use Ordeyo – restaurant owners, their teams and people who sign up for Ordeyo – and to visitors of the website ordeyo.com. The controller is Erhan Bulut (Ordeyo, company in formation), Greinergasse 53, 1190 Wien, Austria, reachable at privacy@ordeyo.com. The data of an online shop's customers is the responsibility of the restaurant concerned; its own privacy policy applies to it.
The website ordeyo.com
When you visit the website we set no cookies and store nothing on your device. To count visits we form a key from the IP address and browser details that is made with a new secret value every day and is not linked to you; we do not store the IP address itself. We store the pages visited, the approximate origin at city level, device type and language and, if there is one, the referring website and campaign details. The legal basis is our legitimate interest in improving the website. If you sign up from the website, we carry the campaign details, referring website and landing page over to your account.
What data we process
- Account: name, e-mail address, password (only as a secure hash), language and sign-ins.
- Security: second factor, passkeys, sessions and shortened device details.
- Organization: company details, billing address, contract and payment data.
- Use: which features are used and technical logs for troubleshooting.
Why and on what basis
We process the data to perform the contract with your organization, protect your account, issue invoices and meet legal obligations. We process technical logs based on our legitimate interest in running the service securely.
Recipients
We pass data only to service providers we need and who are bound by our instructions: hosting in Austria (netcup), storage and DNS (Cloudflare, stored in the EU), sending e-mail (Resend) and e-mail mailboxes (Google Workspace). Where a provider processes data outside the European Economic Area, we rely on the European Commission's standard contractual clauses.
How long we keep data
We keep account data as long as the account exists. We keep invoices as long as the law requires. We delete technical logs after a short time. Data on website visits contains no IP addresses and allows no conclusion about you; we keep it as statistics.
Your rights
You have the right of access, rectification, erasure, restriction, data portability and objection. Write to privacy@ordeyo.com. You can complain to the Austrian data protection authority.
Cookies
The website ordeyo.com sets no cookies. In the application Ordeyo only uses cookies needed for signing in and security. We set no tracking or advertising cookies.