Your data, and your guests’ data, handled with care.

01Who we are and what this covers

Order Central (“Order Central”, “we”, “us”) makes restaurant software. This policy covers:

• Order Central — the Admin that owners and managers use, the online ordering, QR and pay pages guests use, reservations, receipts, loyalty and the AI phone assistant;
• Divine POS — the till app that runs on counter terminals, kitchen screens and expo screens;
• Divine Mobile — the phone app for owners, managers and staff;
• this website, ordercentral.us, and its quote form.

The Order Central Owner app has its own policy, linked at the end of this page.

02Restaurants and us

Restaurants use Order Central to serve their guests. For information about a restaurant’s guests — orders, reservations, loyalty, contact details — the restaurant decides what is collected and how it is used, and we process it on the restaurant’s behalf and under its instructions. In privacy-law terms the restaurant is the “business” or “controller”, and we are its “service provider” or “processor”.

For the accounts of our own customers (restaurant owners and their staff), and for visitors to this website, Order Central decides how the information is used and is responsible for it.

If you are a guest and have a question about your information, the restaurant is usually the right place to start. You can also write to us and we will help, or pass your request to the restaurant.

03What we collect

Restaurant owners, managers and staff

• Account details: name, e-mail address, phone number, role, the locations you work at and what you are allowed to do there.
• Sign-in details: your password, stored only as a one-way hash, and your till PIN.
• Work records: clock-ins and clock-outs, breaks, schedules, availability, time-off requests, tips, pay rates and payroll figures.
• What you do in the product: orders you ring up, refunds, voids, settings you change and approvals you give, kept in an activity log so the restaurant can see who did what.

Guests of restaurants

• Contact details a guest gives: name, phone number, e-mail address, and a delivery address with its instructions.
• Orders: items, notes, times, totals, tips and receipts.
• Reservations: date, time, party size and notes.
• Loyalty: points earned and spent, and the history behind them.
• Marketing consent: whether the guest said yes to texts, e-mail or notifications from that restaurant, when, and where they said it.
• Payments: the card brand, the last four digits and a token from the card processor — not the card number (see Card payments).
• Phone calls to the restaurant’s Order Central number: the caller’s number, call times and, where the restaurant has turned it on, a recording (see Phone calls).

Devices

• Divine POS: the terminal’s serial number and model (to pair it with the restaurant), the app version and battery level (so the restaurant can see a terminal is healthy), the name of the Wi-Fi network it joins, and the printers it finds on that network.
• Divine Mobile: a notification token so we can send alerts to your phone, your in-app preferences, and a copy of your business data kept on the phone so the app opens quickly.

Visitors to this website

• What you type into the quote form: name, e-mail, phone, restaurant name, number of locations, the system you use today and your message.
• Standard web server logs: IP address, browser type and the pages requested. We do not use analytics or advertising cookies on ordercentral.us.

04How we use information

• To run the service the restaurant signed up for: taking and routing orders to the kitchen, taking payments, printing and sending receipts, reservations, loyalty, scheduling, time clock, tips and payroll.
• To send messages a guest or staff member expects: order updates, receipts, reservation confirmations, verification codes and schedule or approval alerts.
• To send a restaurant’s marketing, only to guests who opted in to that restaurant on that channel.
• To keep accounts and payments secure, and to find and stop fraud and misuse.
• To give support, fix problems and improve the product.
• To meet legal, tax and accounting obligations.

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not show ads.

05Card payments

• At the counter, cards are read by a Dejavoo terminal and sent straight to the card processor.
• On our online pay pages, the card fields are provided by the processor (iPosPays by Dejavoo): the card number goes from the guest’s browser to the processor, not to us.
• When a card is typed in by hand, the number passes through our servers only to reach the processor (PayArc) and is not saved.
• If the internet is down, Divine POS can take a hand-keyed card and hold it encrypted on the terminal (in Android’s hardware-backed keystore) until the connection returns. The card is then charged, and the card number, expiry, security code and ZIP are deleted from the terminal after the charge attempt.
• What we keep: the processor’s token for the card, the card brand, the last four digits, amounts, tips and the outcome of each charge, so the restaurant can refund, reconcile and settle.

06Texts, e-mails and notifications

Texts are sent through Telnyx, e-mails through Amazon Simple Email Service, and app notifications through Google Firebase Cloud Messaging and OneSignal.

Marketing consent is off until a guest turns it on, and it is kept separately for each restaurant and for each channel. Replying STOP, STOPALL, UNSUBSCRIBE, CANCEL, END or QUIT to a text ends texts from that restaurant, and we record that choice. Messages about an order or a reservation you made are not marketing and are sent regardless.

07Phone calls and the AI phone assistant

Calls to a restaurant’s Order Central number are carried by Telnyx. A restaurant can let an AI assistant, run on Telnyx, answer calls and take orders; what the caller orders is saved as a normal order.

Calls are recorded only when the restaurant turns recording on for a call queue. Recordings are kept in private storage that only the restaurant’s authorized staff and our support team can reach.

08What the apps ask for

Each permission is asked for when a feature needs it. Saying no turns off only that feature.

09Who we share it with

We share information only with companies that help us run the service, under contracts that limit them to that work; with delivery platforms a restaurant chooses to connect; and when the law requires it.

We may also disclose information to comply with a law, court order or other legal process, to protect the rights and safety of people or of Order Central, or as part of a merger or sale of our business, in which case we will tell you first.

10How long we keep it

• Account and business records — orders, payments, payroll and tips — are kept while the restaurant’s account is open, and afterwards for as long as tax, accounting and employment law requires.
• Guest contact details and loyalty history are kept while the restaurant uses Order Central, unless the restaurant or the guest asks us to delete them sooner.
• Call recordings are kept for as long as the restaurant keeps them.
• Hand-keyed card details held on a terminal during an outage are deleted as soon as the charge has been attempted.

11How we protect it

• Everything between the apps, the web pages and our servers travels over HTTPS.
• Passwords are stored only as one-way hashes, never as plain text.
• Every person sees only the locations and the parts of the product their role allows.
• A till works only after it has been paired with the restaurant, and staff act on it with their own PIN.
• Card data is handled as described under Card payments, and is never saved on our servers.
• Only people at Order Central who need it to support you can reach customer data.

No system is perfectly secure. If we learn of a breach that affects your information, we will tell you and the affected restaurant as the law requires.

12Your choices and rights

Everyone

You can ask to see the information we hold about you, correct it, delete it, or receive a copy in a common format. Write to contact@ordercentral.us from the address we know you by. We will confirm it is you and reply within 30 days. We will not treat you differently for asking.

Guests

Most guest information is held for a restaurant, so we may pass your request to that restaurant, or ask you to contact it. To stop marketing texts, reply STOP. To stop marketing e-mails or notifications, ask the restaurant or us.

Owners and staff

Your account belongs to your restaurant’s Order Central account. Your manager can change your details and remove your access; to have your account deleted, write to us. Records the law requires the restaurant to keep, such as payroll, are kept for as long as it requires.

California residents

Under the California Consumer Privacy Act you have the right to know what personal information we collect, use and disclose; to correct it; to delete it; and not to be discriminated against for using these rights. We do not sell or share personal information as the Act defines those words, so there is nothing to opt out of.

European Union and United Kingdom residents

You also have the right to object to or restrict our processing, to withdraw consent at any time, and to complain to your local data protection authority. We rely on the contract with you or your restaurant, our legitimate interest in running a secure service, legal obligations and, for marketing, your consent.

13Children

Order Central, Divine POS and Divine Mobile are business tools and are not directed at children. We do not knowingly collect information from children under 13. If you believe we have, write to us and we will delete it.

14Where data is stored

Order Central is run from the United States, and our service providers process data there. If you use Order Central from outside the United States, your information is transferred to and processed in the United States.

15Changes to this policy

When we change this policy we update the date at the top. If a change is significant, we will tell restaurants by e-mail or in the Admin before it takes effect.

16Contact us

Questions or requests about privacy: contact@ordercentral.us

Order Central 200 Spectrum Irvine, California 92705 United States