Privacy Policy
Website: www.orderezee.com | Effective Date: 26 September 2026 | Last Updated: 26 September 20261. Introduction
OrderEzee Technologies Private Limited (“OrderEzee”, “Company”, “we”, “us” or “our”) respects the privacy of individuals and businesses that access or use our website, applications, software platforms, portals, dashboards, APIs, integrations, communication tools, artificial-intelligence-enabled services and related services (collectively, the “Services”).
This Privacy Policy explains how we collect, receive, use, process, store, share, disclose, retain and protect personal data when you access or use OrderEzee Services.
OrderEzee is primarily a business-to-business (“B2B”) technology platform designed to enable manufacturers, brands, distributors, wholesalers, retailers, sales teams and other businesses to digitise and automate business processes including ordering, invoicing, inventory, sales-force management, communication, analytics and other commercial workflows.
By accessing or using our Services, you acknowledge this Privacy Policy. Where applicable law requires consent for processing personal data, OrderEzee will seek appropriate consent.
We request the understanding and patience of our users and business customers. We will use commercially reasonable efforts to provide reliable Services and to protect personal data, and we will work in good faith to resolve issues that arise. Absolute guarantees of uninterrupted availability, zero defects, or immunity from all third-party or external incidents are not realistic for any technology platform and are not offered under this Policy.
2. Scope
This Privacy Policy applies to personal data processed through:
- www.orderezee.com and related sub-domains;
- OrderEzee web and mobile applications;
- manufacturer and brand dashboards;
- distributor and wholesaler interfaces;
- retailer interfaces including ORDERBOX;
- sales-force and field-force management modules;
- customer-support systems;
- WhatsApp and messaging integrations;
- Meta/Facebook integrations;
- payment integrations;
- accounting and ERP integrations;
- APIs;
- AI-enabled services including conversational and voice assistants;
- demonstrations, enquiries and registrations;
- marketing and communication services; and
- any other OrderEzee product or service that refers to this Privacy Policy.
Third-party services integrated with or used by OrderEzee are governed by their own privacy policies and terms. OrderEzee is not responsible for the privacy or security practices of independent third-party providers beyond the contractual and operational control we reasonably exercise.
3. Information We May Collect
Depending upon how you interact with OrderEzee, we may collect or process the following categories of information:
3.1 Identity and Contact Information
- name;
- mobile number;
- email address;
- business address;
- organisation/company name;
- designation;
- authorised representative details; and
- other information necessary to identify or communicate with you.
3.2 Account Information
- username, user ID, account credentials;
- organisation ID, retailer/distributor/manufacturer identifier;
- account permissions, account settings; and
- login and authentication information.
Passwords are intended to be stored using appropriate security controls and not as readable plain text.
3.3 Business Information
- GST and business registration details;
- product catalogues, SKUs, inventory, and prices;
- offers and schemes, customers and suppliers, sales territories;
- retailer and distributor information, employee/sales-force information;
- orders, invoices, returns, refunds, delivery information;
- digital ledger information, sales information; and
- other commercial records uploaded or generated through the platform.
3.4 Transaction Information
- order history, invoice information, transaction amount, payment status, payment reference;
- refunds, credit information associated with enabled services, and reconciliation information.
OrderEzee does not ordinarily store complete card numbers, CVVs, UPI PINs, internet-banking passwords or equivalent payment authentication credentials. Such sensitive payment data is handled by authorised third-party payment gateways under their own terms and security controls.
3.5 Sales-Force Information
Where enabled by the relevant organisation, OrderEzee may process: sales representative details, attendance/activity information, territory information, customer visits, order activity, field reports, photographs uploaded through the platform, travel or route information, and location information where the feature is enabled and lawful permission has been provided.
3.6 Technical Information
We may automatically receive: IP address, browser information, device information, operating system, application version, device identifiers, login time, access logs, security logs, feature usage, error and diagnostic information, cookies, and similar technical information.
3.7 Communications
We may process communications made through or relating to OrderEzee, including: emails, WhatsApp communications, chat, customer-support tickets, feedback, surveys, complaints, enquiries, and voice communications where voice-enabled services are used.
4. Meta, Facebook and WhatsApp Integrations
OrderEzee may integrate with services offered by Meta Platforms, Inc. and/or its affiliates, including Facebook, WhatsApp and related business services, APIs and technologies.
When a user or business chooses to connect an authorised Meta or WhatsApp account to OrderEzee, we may receive or process information permitted by the relevant user, business and platform. Depending upon functionality, this may include profile/business info, page info, WhatsApp business account info, phone numbers, message metadata, delivery/read statuses, and tokens.
Important limitation: Meta, WhatsApp and related platforms operate independently. OrderEzee has no control over their internal systems, availability, policy changes, message delivery, account suspensions, API changes, or data-handling practices. Any interruption, restriction, data loss, or compliance issue arising from Meta/WhatsApp or similar platforms is outside OrderEzee’s reasonable control. Users and business customers remain responsible for complying with the applicable Meta/WhatsApp terms and policies.
5. Third-Party Permissions and Integrations
Where OrderEzee requests permission to connect to a third-party service, we seek permissions reasonably required to provide the selected functionality. Users may revoke third-party permissions through the applicable third-party service. OrderEzee does not acquire ownership of third-party accounts merely through integration.
OrderEzee’s role is limited to facilitating the integration. We do not control how third-party providers structure their own partnerships, security architecture, data retention, subprocessors, or incident response. We cannot provide visibility into, or guarantees regarding, the internal operations of independent third parties. Business customers and users acknowledge this inherent limitation of modern cloud and API-based platforms.
To the maximum extent permitted by law, OrderEzee shall not be liable for any loss, damage, interruption, data breach, unavailability, or claim arising from or attributable to any third-party service, API, cloud provider, messaging platform, payment gateway, AI provider, or similar external service, except to the extent directly caused by OrderEzee’s own wilful misconduct or gross negligence in integration.
6. How We Use Information
We process information to:
- administer accounts and provide the Services;
- process orders, transactions, invoices, returns and refunds;
- manage inventory, business relationships and sales-force activity;
- provide customer support and technical assistance;
- authenticate users and maintain platform security;
- detect, prevent and investigate fraud, abuse or security incidents;
- provide analytics and improve the Services;
- comply with applicable law and respond to lawful requests; and
- resolve disputes and enforce our agreements.
7. Consent
Where processing requires consent under applicable law (including the Digital Personal Data Protection Act, 2023), OrderEzee seeks affirmative consent. Consent may be withdrawn at any time by contacting the Grievance Officer, subject to legal and contractual retention requirements and technical feasibility. Withdrawal of consent may affect the ability to continue using certain features of the Services.
8. Marketing Communications
Users may opt out of promotional communications. Opting out does not prevent essential transaction, security, account, or service-related notices that are necessary for the operation of the Services or required by law.
9. AI and Automated Services
OrderEzee may provide artificial-intelligence, machine-learning and automation functionality. AI outputs are generated automatically and can occasionally be inaccurate, incomplete or inappropriate. Users and business customers should independently verify important AI-generated information before relying on it for commercial or operational decisions.
OrderEzee does not guarantee the accuracy, completeness, reliability or fitness for purpose of any AI-generated output. To the maximum extent permitted by law, OrderEzee disclaims liability for any decisions, losses or consequences arising from reliance on AI-generated content or automated recommendations.
10. Payment Services
Payments are processed through authorised third-party banks and payment gateways. Those providers separately process information under their own privacy policies, terms and security standards. OrderEzee does not control and is not responsible for the payment-processing systems, security, settlement timelines, chargebacks, or data practices of such independent payment providers.
11. Third-Party Integrations – General Limitation
OrderEzee may offer or enable integrations with third-party services (ERP, accounting, logistics, CRM, communication, analytics, cloud hosting, AI providers and others). Each such service is operated independently.
OrderEzee makes no representation or warranty regarding the availability, security, accuracy, legality or performance of any third-party service. Any claim, loss or dispute arising from a third-party service should be directed to that provider. OrderEzee’s liability is limited to its own acts or omissions under its direct control.
12. Cookies and Similar Technologies
OrderEzee uses cookies and similar technologies for essential platform operation, authentication, security, analytics and (where consented) marketing. You may manage certain cookie preferences through your browser settings; however, disabling essential cookies may affect the functionality of the Services.
13. Sharing of Personal Data
OrderEzee does not sell personal data. Information is disclosed only:
- to verified service providers and subprocessors who assist in delivering the Services (under contractual obligations of confidentiality and security appropriate to the relationship);
- to business customer administrators and authorised users within the relevant organisation;
- to authorised third-party integrations selected or enabled by the business customer;
- to professional advisers (legal, accounting, compliance) under confidentiality obligations;
- to legal, regulatory or governmental authorities where required by applicable law or valid legal process; and
- in connection with a corporate transaction (merger, acquisition, restructuring) subject to appropriate confidentiality protections.
14. OrderEzee as Data Processor / Data Fiduciary
OrderEzee is a B2B SaaS provider. For certain categories of information (especially business customer data and end-user data processed on behalf of a business customer), OrderEzee acts as a data processor / data fiduciary under the instructions of the relevant business customer.
In such cases, the business customer remains primarily responsible for: (a) the lawfulness of the data it uploads or causes to be processed; (b) obtaining any required consents from its own employees, retailers, distributors or other data principals; (c) determining the purposes and means of processing; and (d) responding to data-principal requests that relate to data under its control.
OrderEzee will process such data in accordance with the business customer’s documented instructions and this Privacy Policy, subject to the technical and operational limitations inherent in third-party infrastructure and integrations.
15. Security
OrderEzee implements commercially reasonable technical and organisational security measures appropriate to the nature of the data processed, the state of the art, the costs of implementation, and our size and resources as a growing technology company. These measures may include access controls, encryption where appropriate, logging, monitoring, and backups.
No method of transmission or storage is completely secure. Absolute security, uninterrupted availability, or complete immunity from cyberattacks, zero-day vulnerabilities, or third-party infrastructure failures cannot be guaranteed by any organisation. OrderEzee does not warrant that the Services will be free from vulnerabilities, unauthorised access, or interruptions.
Business customers and users are responsible for maintaining the confidentiality of their own credentials, configuring access permissions appropriately within their organisation, and promptly notifying OrderEzee of any suspected unauthorised access to their accounts.
16. Data Breaches and Security Incidents
In the event of a personal data breach affecting data under OrderEzee’s control, we will investigate and, where required by applicable law (including the Digital Personal Data Protection Act, 2023 and rules thereunder), notify the relevant authority and affected individuals within the timelines prescribed by law, subject to the practical constraints of investigation, third-party cooperation, and law-enforcement requirements.
Where a security incident originates from or is primarily attributable to a third-party provider, cloud infrastructure, messaging platform, or other external service, OrderEzee’s ability to investigate and remediate is limited by the information and cooperation provided by that third party. OrderEzee will use commercially reasonable efforts to coordinate with such providers and to keep affected business customers informed.
17. Data Retention
Personal data is retained only for as long as necessary for the purposes described in this Policy, or as required by business, tax, accounting, contractual or legal obligations. When data is no longer required, we will delete or anonymise it using commercially reasonable methods, subject to residual copies in backup systems that are overwritten in the ordinary course of operations and subject to any retention required by third-party systems that we do not control.
18. Your Privacy Rights
Subject to applicable law (including the Digital Personal Data Protection Act, 2023), individuals may request access, correction, erasure, or withdrawal of consent by emailing grievances@orderezee.com. We will respond within the timelines required by law, subject to verification of identity, technical feasibility, and any overriding legal or contractual obligations.
Where OrderEzee processes data solely on behalf of a business customer, certain requests may need to be directed to, or coordinated through, that business customer.
19. Data Deletion Requests
Users may request deletion of eligible personal data by emailing grievances@orderezee.com with the subject line “PERSONAL DATA DELETION REQUEST”. For data received through Meta/Facebook integrations, the subject line “META/FACEBOOK DATA DELETION REQUEST” may be used.
Deletion will be completed within a reasonable period, subject to legal retention requirements, technical constraints (including residual copies in backups and third-party systems), and verification of the requester’s identity and authority.
20. WhatsApp Opt-Out
Recipients may opt out of WhatsApp marketing communications by following the instructions provided in the relevant message or by contacting us. Opt-out does not affect transactional or service-related messages necessary for the Services.
21. Children
OrderEzee is a B2B platform and is not directed at or intended for use by children. We do not knowingly collect personal data from children.
22. Limitation of Liability – Privacy and Security
To the maximum extent permitted by applicable law:
- OrderEzee’s total aggregate liability arising out of or relating to this Privacy Policy or any personal data processing shall not exceed the fees paid by the relevant business customer to OrderEzee in the twelve (12) months preceding the claim, or INR 1,00,000 (One Lakh Rupees), whichever is lower;
- OrderEzee shall not be liable for any indirect, incidental, special, consequential, punitive or exemplary damages, or for loss of profits, data, goodwill or business opportunity;
- OrderEzee shall not be liable for any claim, loss or damage arising from third-party services, cloud infrastructure, messaging platforms, payment gateways, AI providers, external cyberattacks, zero-day vulnerabilities, or other events outside OrderEzee’s reasonable control; and
- nothing in this Policy excludes or limits liability that cannot be excluded or limited under applicable Indian law (including liability for fraud or wilful misconduct).
23. Governing Law and Compliance
This Privacy Policy is governed by the laws of India, including the Digital Personal Data Protection Act, 2023, the Digital Personal Data Protection Rules (as notified), the Information Technology Act, 2000 and rules thereunder, and other applicable Indian legislation.
OrderEzee will use commercially reasonable efforts to comply with applicable data-protection requirements. As a growing company, we may need reasonable time and flexibility to implement evolving regulatory requirements, technical upgrades, or process changes. We request the cooperation and patience of our business customers in this regard.
24. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements or business operations. The updated version will be posted on www.orderezee.com with a revised “Last Updated” date. Continued use of the Services after the effective date of changes constitutes acknowledgment of the updated Policy. Where material changes require consent under applicable law, we will seek such consent as required.
25. Grievance Officer and Contact
Questions, complaints or grievances relating to privacy or personal-data processing may be submitted to:
Entity: OrderEzee Technologies Private Limited
Website: www.orderezee.com
Privacy & Grievance Email: grievances@orderezee.com
We will endeavour to acknowledge and respond to grievances within the timelines prescribed under applicable law.
26. Acknowledgement
By accessing or using the Services, you acknowledge that:
- you have been provided access to this Privacy Policy;
- you understand that OrderEzee relies on third-party service providers and that certain aspects of data processing, security and availability are outside OrderEzee’s direct control;
- you understand that absolute security and uninterrupted service cannot be guaranteed;
- you will use the Services in accordance with applicable law and any applicable Terms of Service or customer agreement; and
- you will cooperate in good faith to resolve any privacy or security issues that may arise.
Consent Matrix
Annexure AThis matrix details mandatory versus optional consent modules collected during registration, platform operation, and integration execution.
| Activity / Feature | Purpose | Type | Withdrawal Permitted |
|---|---|---|---|
| Account Registration & Auth | Create and maintain business user account | Mandatory | No (requires account deletion) |
| Acceptance of Terms of Use | Contractual formation | Mandatory | No |
| Privacy Policy Acceptance | Processing of personal & business data | Mandatory | No (requires account deletion) |
| Payment & Invoicing Processing | Subscription settlements, invoices & ledgers | Mandatory | No |
| WhatsApp Transactional Updates | Order and delivery confirmations via Meta APIs | Conditional (Customer Opt-in) | Yes |
| WhatsApp Marketing Campaigns | Promotional offers, launches and schemes | Optional | Yes (Opt-out anytime) |
| Field-Force Location & Visits | Route tracking, attendance and visit verification | Consent-based / Operational | Yes (Via Device Settings) |
| Camera & Media Permissions | Upload invoices, KYC & field photographs | Optional | Yes (Via Device Settings) |
| Microphone Access | Voice commands, assistant & voice search | Optional | Yes (Via Device Settings) |
| AI Insights & Assistant | Personalized business forecasting & automation | Optional | Yes |
| Essential Cookies | Security and session functionality | Mandatory | No |
| Analytics Cookies | Performance improvement tracking | Optional | Yes |
Data Retention Schedule
Annexure BSubject to statutory mandates and the Digital Personal Data Protection Act/Rules, datasets are retained under the following schedules:
| Category | Retention Baseline Period | Legal / Operational Basis |
|---|---|---|
| User Account Records | Duration of active commercial relationship + 5 years | Limitation Act, 1963 / Contractual claim defense |
| Orders, Invoices & Ledgers | 8 years | Companies Act, 2013 / Income Tax compliance |
| GST & Tax Records | As prescribed by GST statutes (approx. 72 months) | Statutory Taxation compliance |
| Customer Support & Enquiries | 3 years | Quality assurance and dispute resolution |
| Authentication & Access Logs | 2 years | CERT-In Directions / IT Act cybersecurity logs |
| Field-Force Geo-Logs | 12 months (or as configured by Business Customer) | Operational verification & payroll auditing |
| Backup Archives | Up to 180 days (rolling purge) | Disaster recovery & business continuity |
Cookie Notice
Annexure COur platform uses cookies and localized storage mechanisms. Essential cookies (identifying sessions and validating account logins) are strictly required for platform operability. Functional and analytical cookies (such as measuring application performance and dashboard latency) are optional and can be toggled through your browser settings or directly via the account settings panel of Ozie.
Information Security Framework
Annexure DOur technical infrastructure incorporates defense-in-depth protocols appropriate to our operating stage:
- Cryptographic Controls: Data in transit is protected using modern TLS encryption; stored databases and sensitive commercial attachments are secured using AES-256 standards.
- Access Governance: Granular role-based access controls (RBAC) are enforced alongside multi-factor authentication (MFA) across administrative portals.
- Security Assessments: Periodic external vulnerability assessments evaluate platform resiliency against unauthorized access.
- Credential Security: Passwords and API secret keys are securely hashed using modern cryptographic algorithms and are never stored in readable plain-text format.
Data Principal Rights Request Procedure
Annexure ETo exercise rights under the DPDP Act (such as Access, Correction, Erasure, or Grievance Redressal), Data Principals may follow this procedure:
- Step 1 (Submission): Send a formal written email to grievances@orderezee.com specifying the nature of the request.
- Step 2 (Identity Verification): Confirm account ownership via OTP verification or authorised company identity documentation.
- Step 3 (Processing & Response): OrderEzee will evaluate statutory applicability and fulfill the request within the turnaround windows below.
| Request Type | Acknowledgment Window | Resolution Window |
|---|---|---|
| Data Correction / Updating | Within 3 business days | Within 15 business days |
| Consent Withdrawal | Within 3 business days | Within 7 business days |
| Account / Personal Data Deletion | Within 3 business days | Within 30 business days (subject to statutory retention) |
| Meta / Facebook Data Deletion | Within 3 business days | Within 15 business days |
Categories of Personal Data Processed
Annexure FThe following mapping outlines our specific processing categories:
| Data Category | Sample Elements | Processing Purpose | Legal Basis | Classification |
|---|---|---|---|---|
| Identity Data | Name, User ID, Designation | Account creation & operations | Contract / Consent | Confidential |
| Contact Data | Phone, Email, Business Address | Communications & notifications | Contract / Consent | Confidential |
| Commercial & Financial | GSTIN, Invoices, Ledgers, Txn IDs | Order processing, invoicing & tax compliance | Contract / Legal Obligation | Restricted |
| Sales-Force & Geo-Data | GPS Location, Route, Visit logs | Field-force management & attendance | Consent / Legitimate Interest | Confidential |
| Integration Metadata | Meta Page IDs, WhatsApp tokens | Social & omnichannel messaging | Consent / Integration Auth | Restricted |
| Technical / Audit Logs | IP Address, Device ID, Access Logs | Security monitoring & fraud prevention | Statutory Requirement | Confidential |
Third-Party Sub-Processors
Annexure GOur approved sub-processors and external integrations are limited to verified providers that facilitate our core SaaS functionality:
- Amazon Web Services (AWS): Cloud hosting, database clusters, secure storage, and disaster recovery.
- Meta Platforms, Inc. (WhatsApp Cloud API): Omnichannel messaging, transactional updates, and WhatsApp Business integrations.
- Payment Gateways & Banks (e.g., Razorpay): Payment processing, checkout infrastructure, and settlement management.
- ERP & Accounting Providers (e.g., Tally, BUSY): Synchronisation of business transactions, invoices, and stock data.
- Telephony & SMS Partners: OTP verification, transactional alerts, and customer communication.
AI Governance & Responsible AI Principles
Annexure HOur deployment of AI, automated business agents, and voice assistants follows these core directives:
- Human-in-the-Loop: AI features operate as advisory tools; material financial, operational, and commercial commitments require human confirmation.
- Model Insulation: Proprietary Business Customer data and uploaded invoices are isolated and are not utilised to train public large-language models.
- Transparency: Automated responses, conversational agents, and machine-generated forecasts are visibly identified within the user interface.
- Prohibited Use: AI conversational features may not be used to produce malicious, fraudulent, defamatory, or deceptive content.
Privacy by Design & Data Governance
Annexure IIn adherence to the DPDP Act 2023, OrderEzee embeds privacy safeguards across our engineering lifecycles:
- Privacy by Default: Non-essential tracking and optional marketing opt-ins are turned off by default upon platform provisioning.
- Data Minimisation: Features are architected to request only the exact device permissions (Camera, Location, Mic) required to execute the user-initiated action.
- Privacy Impact Assessments (PIA): System architecture modifications or third-party integrations undergo internal privacy audits prior to production deployment.
- Workforce Training: Internal engineering, customer support, and operations teams undergo regular privacy compliance and data-handling governance workshops.