Privacy Policy

Last updated 2 November 2026

Dean Kendall trading as Order Dog (ABN 56 859 956 799) (“Order Dog”, “we”) follows the Australian Privacy Principles in the Privacy Act 1988 (Cth). This policy explains what we collect, why, where it goes and your choices.

Order Dog is an independent service, not affiliated with, endorsed or sponsored by Square or Block, Inc.

1. Whose information, and who’s responsible

• Customers order from a business’s Order Dog page. The business is the seller; we handle your details on its behalf so your order can be made, paid and collected. The business also has its own privacy obligations.
• Businesses (owners and staff) use Order Dog to take orders.

2. What we collect

From customers placing an order

• Name, mobile number and email address.
• What you ordered, your pickup time, and the order total.
• Payment: your card details are entered into Square’s secure payment form and go straight to Square. Order Dog never sees or stores your card number.
• Technical details: your IP address and browser type, used to protect against fraud (for example blocking stolen-card testing). Declined-payment records are deleted after one day.
• Your cart is kept on your own device (browser storage) until you order.
• Order again: after you order, your last few orders on that business’s page and your name, mobile and email are remembered on your own device (browser storage), so you can reorder quickly. They’re not sent to us. “Forget my orders and details on this device” clears them.
• News and offers (only if you tick the box at checkout): your name and email, the business page where you ticked it, when, the wording you saw, and your IP address. Used only to send you news and offers from Order Dog, including about local businesses on Order Dog. Unsubscribe any time (link in every email, order.dog/unsubscribe, or [email protected]).

From businesses

• Owner name and email, and a securely hashed password.
• A hashed staff PIN (we can’t read it back).
• Business details from Square: business name, location address, menu and prices. Access to Square is through an encrypted connection token.
• A record of the fee agreement: who agreed, when, IP address and browser.
• Sign-in records (for example failed sign-ins and IP address) for security.

From businesses applying to join

• Business name and type, ABN, suburb or town, website or Instagram, your name, your role in the business, email, mobile and chosen page address, any Ambassador code, when you applied, and the notice you read.
• Your IP address, kept for one day only to stop misuse of the form.
• Used to check your business, decide your application, set up your page, and contact you about it.

Owners asking for their sign-in links

• A one-way hash of the email entered and your IP address, kept for one day only to limit requests.

From businesses outside Australia joining our waitlist

• Business name, email, country, town or city, and whether you use Square.
• When you agreed to hear from us, and the wording you agreed to.
• Your IP address, kept for one day only to stop misuse of the form.
• We use this only to email you when Order Dog launches in your country.
• We don’t take waitlist sign-ups from the European Union, the European Economic Area or the United Kingdom yet.

From Order Dog Ambassadors

• Name, email, ABN, GST registration and bank account details (stored encrypted).
• The businesses you referred and when, the commission they earned, your statements and payments.
• Checks of your ABN and GST status (from the government’s ABN Lookup, our own checks and what you tell us).
• Our emails with you, and any information about complaints or possible breaches of the Ambassador agreement.
• Used to run the program, pay you, issue tax invoices and meet tax law.
• If an Ambassador introduced your business, they can see your business name and whether your page is live, but never your orders or sales.

Ambassador links

• If you follow an Order Dog Ambassador’s link, we store a cookie (od_ref) for up to 90 days so we know who introduced you. It holds only the Ambassador’s code.

From visitors to order.dog

• We don’t use advertising trackers. We use only the cookies needed to keep owners, staff and Ambassadors signed in, to show page previews, and the Ambassador link cookie above.
• We count visits to order.dog and to businesses’ ordering pages with Cloudflare Web Analytics. It uses no cookies and doesn’t identify you or follow you to other sites: it records the page, the site that sent you, your browser and type of device, and your country.

3. Why we use it

• To place your order with the business, take payment through Square, show the order to the business’s staff, alert them, and send your receipt.
• To run, secure and support Order Dog, and to prevent fraud.
• To meet legal obligations.

We don’t sell personal information. We send marketing emails only to people who ticked the “news and offers” box, and we don’t give that list to businesses or anyone else. We never use it to promote a similar business (same business type) within 5 km of the business where you ticked the box.

When we tell you: a short note at checkout, and on the Ambassador invitation page, says what we collect there and why. This policy has the detail.

4. Who we share it with

• The business you order from — your name, phone, email and order.
• Square (Block, Inc. and its affiliates) — your order and payment are created in the business’s Square account. Square handles your card under its own privacy policy.
• Telegram — new-order alerts to the business’s staff group include your name, phone number and order. If an order needs attention (for example a payment that couldn’t be confirmed), Order Dog’s own team gets a similar alert so we can sort it out.
• Postmark (ActiveCampaign) — sends our emails, such as your receipt.
• Our email marketing service — sends news and offers to people who ticked the box, never receipts. (We’ll name it, and where it stores information, before we send any marketing email.)
• Cloudflare — carries traffic to and from order.dog securely, and counts visits to our pages (Web Analytics).
• Hetzner — hosts our servers and backups.
• Others only where the law requires it.

5. Where it’s stored (overseas)

• Our servers and backups: Singapore (Hetzner).
• Emails (such as receipts): sent by Postmark from the United States, which keeps a copy for up to 45 days.
• Square: Australia and the United States.
• Cloudflare: a worldwide network, including the United States.
• Telegram: stores messages in several countries, which it doesn’t name.
• Our email marketing service: to be named before any marketing email is sent.

We take reasonable steps to make sure these providers protect personal information consistently with the Australian Privacy Principles.

6. How long we keep it

• Customer order details live in the business’s Square account (kept under the business’s own Square arrangements). Order Dog’s own database keeps order records (amounts, times, Square references) but not your name, phone or email. To send the staff alert and your receipt, your name, mobile and email are held on our server for up to 7 days, then deleted. Staff alerts stay in the business’s own Telegram group under its control.
• Applications not confirmed by email are deleted after 48 hours; declined applications after 180 days; approved ones become part of the business’s account.
• News and offers list: until you unsubscribe. We then keep only what’s needed to honour the unsubscribe and show you once consented.
• Waitlist entries are kept until Order Dog launches in your country and we’ve told you, or until you ask us to remove them.
• Ambassador records: tax records (statements, payments, ABN and GST checks) are kept for 7 years after the last payment, as tax law requires. Bank details are deleted once the final payment is made after the agreement ends, and each bank payment file is deleted once the bank has paid it.
• Backups are kept for up to 14 days.
• Business accounts are kept while the business uses Order Dog and for 7 years afterwards for legal and accounting purposes.

7. Security

Encrypted connections everywhere; passwords, PINs and session cookies stored only as hashes; Square access tokens encrypted; two-factor sign-in for Order Dog staff; web traffic reaches our servers only through Cloudflare; daily backups.

8. Your choices and rights

• You can ask for access to, or correction of, personal information we hold about you. For your order details, the business you ordered from can also help.
• You can ask us to remove your waitlist entry or application, or stop news and offers, at any time (unsubscribes take effect straight away): email [email protected] (or use order.dog/unsubscribe for news and offers).
• To make a request or complaint, email [email protected]. We’ll respond within 30 days. If you’re not satisfied, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).

9. Changes

We’ll update this policy when what we collect or how we use it changes, and post the new version here with its date.

Contact: [email protected]