Privacy Policy

Effective 06-01-2026 · Updated 10-29-2026

This Privacy Policy describes how Order Local, LLC ("Order Local," "we," "us," or "our") collects, uses, and shares information when you use our website, our local ordering and pickup platform, and related services (collectively, the "Service"). By using the Service, you agree to the practices described in this Policy.

1. Who We Are

Order Local is a software platform that lets small businesses ("Vendors") — including bakers, makers, growers, and other producers — take orders for local pickup and drop-off, sell in person at markets and events, and offer recurring subscriptions. When a customer ("Customer") places an order on a Vendor's storefront or at a Vendor's booth, the Customer is purchasing from the Vendor; Order Local provides the technology that makes the transaction possible.

For most Customer information, Order Local acts as a "data processor" on behalf of the Vendor (who is the "data controller"). For information collected directly from Vendors when they sign up and use the Service, Order Local is the data controller.

2. Information We Collect

From Vendors

• Account information: name, email address, business name, business address, and phone number. Order Local accounts have no password — you sign in with a one-time code sent to your email, or with Google.
• Authentication data: if you sign in with Google, we receive your name, email, and profile photo from Google. We do not receive your Google password.
• Business details: your catalog (product names, descriptions, photos, prices), pickup and drop-off locations and hours, brand assets (logo, colors, photos), social links, promo codes and loyalty program settings, and similar storefront content you upload.
• Stripe Connect information: when you connect your Stripe account, we receive identifiers and account status from Stripe so we can route payments to you. We do not store your bank account or tax ID numbers — those live with Stripe.
• Platform fee billing: once your monthly sales pass the free level, our payment processor (Stripe) stores your payment method. We keep your monthly sales totals, fee level, invoices, and billing status — never your card number.
• Payment app handles: if you offer Venmo, Cash App, or Zelle, the usernames or handles you enter are shown to Customers at checkout so they can pay you directly.
• Team members: the name and email of anyone you invite to help run your shop.

From Customers

• Order information: name, email address, phone number, items ordered, option selections, pickup or drop-off window, order notes, and order total. For drop-off orders, the delivery address you provide. For custom order requests, the description, date, and any photos you attach.
• Payment information: card, Apple Pay, and Google Pay payments are processed by Stripe directly in the Vendor's own Stripe account; we receive a payment reference and status, never your card number. If you choose Venmo, Cash App, Zelle, or cash, you pay the Vendor directly outside the Service — we record only that the Vendor marked the order as paid.
• Subscriptions and loyalty: if you subscribe to a recurring item, Stripe stores your payment method for future charges. If a Vendor runs a loyalty program, we track your stamps or points by email address so the Vendor can reward you.
• Communications: if you reply to an order confirmation email or SMS, we receive your reply.

Automatically

• Device and usage data: IP address, browser type, operating system, referring URL, pages viewed, and timestamps.
• Cookies and similar technologies: see Section 9 below.

3. How We Use Information

We use information to:

• operate and improve the Service;
• process and fulfill orders, including sending order confirmations, pickup and drop-off reminders, status updates, custom order quotes, balance reminders, and loyalty rewards;
• bill recurring subscriptions and Vendor platform fees via Stripe;
• on a Vendor's behalf, send the Customer emails that Vendor chooses to send — review requests after an order and marketing broadcasts (see Section 6);
• send Vendors product and onboarding emails about Order Local, which you can unsubscribe from;
• communicate with you about your account, including security and policy updates;
• provide customer support;
• monitor for fraud, abuse, and violations of our Terms of Service;
• comply with legal obligations.

4. Legal Bases for Processing

For Customers and Vendors located in jurisdictions that require a legal basis for processing personal data (such as the European Economic Area and the United Kingdom), we rely on the following bases:

• Contract: processing necessary to provide the Service you've requested.
• Legitimate interests: operating, improving, and securing the Service.
• Consent: for optional marketing communications (where applicable).
• Legal obligation: complying with applicable laws.

5. How We Share Information

We share information only as described below. We do not sell personal information.

With Vendors

When a Customer places an order, we share the order details with the Vendor whose storefront the Customer ordered from. The Vendor is responsible for handling that information in accordance with the Vendor's own privacy practices and applicable law.

With Service Providers (Sub-Processors)

We use the following service providers to operate the Service. Each is contractually required to protect information consistent with this Policy and applicable law:

• Stripe — card, Apple Pay, and Google Pay processing, subscription billing, Vendor payouts, and Vendor platform-fee billing.
• Vercel — application hosting.
• Resend — email delivery.
• Twilio — SMS delivery for order notifications.
• Cloudflare R2 — image and file storage.
• Neon — database hosting.
• Google — Google Sign-In authentication, when used.
• Google Analytics and PostHog — usage analytics and, on the marketing site and Vendor dashboard, session replay (see Section 9).

This list may change as we add or replace providers.

For Legal Reasons

We may disclose information if required by law, subpoena, or other legal process, or if we believe in good faith that disclosure is necessary to protect rights, property, or safety.

In a Business Transaction

If Order Local is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction. We will notify Vendors of any change in ownership or control of personal information.

6. Email and Text Messages

Email

Customers receive order emails from the Vendor's shop — confirmations, status updates, custom order quotes, balance reminders, subscription notices, and loyalty rewards. A Vendor may also choose to send you a review request after an order, and marketing broadcasts about their shop. Every broadcast includes an unsubscribe link; unsubscribing stops that Vendor's marketing email but not the order emails you need to receive your purchase.

Vendors receive account, billing, and order emails, plus occasional product and onboarding emails from Order Local. Those product emails carry an unsubscribe link and honor your choice; account and billing email does not stop while your account is open.

Text messages (SMS)

If you provide a mobile phone number when placing an order on a Vendor's storefront, when submitting a custom order request, or — for Vendors — in your Order Local account settings, we may send you transactional text messages about that order or your account. These include order confirmations, order status updates such as "in progress" and "ready for pickup", custom order quotes, balance reminders for custom orders, and, for Vendors, alerts when a new paid order comes in.

Message frequency varies with order activity; most Customers receive between one and five messages per order. Message and data rates may apply. You can opt out at any time by replying STOP to any message, and opt back in by replying START. Vendors can also turn text alerts off in notification preferences. Opting out of text messages does not affect order confirmation emails or your ability to place or receive orders.

We do not sell, rent, or share mobile phone numbers or SMS opt-in consent with third parties for their own marketing purposes. Mobile numbers are shared only with our SMS delivery provider (Twilio) for the sole purpose of delivering the messages described above. We do not send marketing or promotional text messages.

Our Text Message Program page documents each place a mobile number can be provided, the consent language shown there, and sample messages.

7. Data Retention

We retain Vendor account information for as long as the account is active and for a reasonable period after closure for record-keeping, legal compliance, and dispute resolution. We retain Customer order information for as long as the associated Vendor account is active. Vendors can close their shop themselves from account settings. Session replay recordings are kept for a limited time by our analytics provider. Backups may persist for a short period after deletion.

Vendors can request deletion of inactive Customer records at any time by contacting us.

8. Your Rights and Choices

Depending on where you live, you may have rights regarding your personal information, including:

• Access a copy of the information we hold about you.
• Correct inaccurate information.
• Delete information, subject to legal retention requirements.
• Port your data to another service.
• Object to certain processing or withdraw consent.
• Opt out of certain marketing communications.

To exercise these rights, email us at hello@getorderlocal.com. For information you provided to a Vendor's storefront, please contact the Vendor directly; we will assist the Vendor in fulfilling valid requests.

9. Cookies and Tracking

We use cookies and similar technologies to keep you signed in, remember your preferences, and understand how the Service is used. You can control cookies through your browser settings; blocking some cookies may affect Service functionality.

We use essential cookies for authentication and session management, and analytics cookies to understand how the Service is used. We do not use third-party advertising cookies. Two small first-party cookies are worth naming: on first visit to our marketing site we store where you came from (a referral source) for up to 90 days so we know which channels bring Vendors to us, and when you open a Vendor's shop through a location-specific link or QR code we remember that pickup location on that shop for up to 30 days.

Product analytics. We use Google Analytics and PostHog to measure page views and, on our marketing site and Vendor dashboard, interactions such as clicks and form submissions. For signed-in Vendors, this activity is associated with your account so we can understand where setup is difficult and improve the Service. Analytics on Vendor storefronts and checkout pages is limited to page views and a small number of named events (for example, that an order was placed); shoppers are not identified.

Session replay. On our marketing site and the Vendor dashboard, we may record how the screen changes during a session — clicks, scrolling, and navigation — so we can see where visitors and Vendors get stuck. Text typed into form fields is masked and never recorded. Visitors to the marketing site are not identified. We do not record Vendor storefronts or checkout sessions. Recordings are kept for a limited time and are used solely to improve the Service.

You can limit analytics by blocking cookies in your browser or using a content blocker; essential Service functionality will continue to work. To ask that we delete analytics data associated with your account, contact us at the address in Section 14.

10. Security

We use commercially reasonable technical and organizational measures to protect information, including encryption in transit (TLS), encryption at rest, one-time sign-in codes instead of stored passwords, and access controls. No system is perfectly secure; we cannot guarantee the security of information transmitted to or stored on the Service.

11. Children's Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn we have collected such information, we will delete it. If you believe a child has provided us information, please contact us.

12. International Data Transfers

Order Local is based in the United States. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States. By using the Service, you consent to such transfer.

13. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will notify Vendors by email and update the Effective Date at the top of this page. Continued use of the Service after a change indicates acceptance of the updated Policy.

14. Contact Us

If you have questions about this Policy or our privacy practices, contact us at hello@getorderlocal.com.