Privacy
What Orin stores, why, and what you can ask us to do about it. Written to be read, not to be survived.
Last updated:
Who this covers
Orin is shop software. Two different kinds of people appear in it, and they are not treated the same.
A shop's staff have accounts and sign in. Their employer decides what they can see and do. If you are a customer of a shop that uses Orin, you have no account here — the shop holds your details, and this page explains what happens to them.
What we store about people who sign in
Only what running the shop needs:
- Your name and email address, so the shop can invite you and you can sign in.
- Which shop you belong to and what you are allowed to do in it.
- A record of sensitive actions you take — cancelling a sale, changing a price, removing a member of staff — so the owner can see what happened and when.
- Sign-in events, so an owner can see if somebody is trying to get into their shop.
What a shop stores about its customers
If a shop records a customer, it usually holds a name, a phone number, and what that customer bought or owes. The shop decides what to record. Orin holds it on the shop's behalf.
If somebody sends the shop an order through its public catalogue page, we hold the phone number they typed and what they asked for, so the shop can call them back. That is the only thing we hold about a person who has no other relationship with the shop, and we delete it — see below.
Payments
Orin never holds anyone's money. When a shop takes a mobile-money or card payment through a provider, that provider handles the money and tells Orin whether it arrived. We store what was paid, by which method, and any reference number typed in — never a PIN, never card details, never anything that could be used to take a payment.
A shop's own credentials for its payment provider are stored separately from everything else, encrypted, readable by nothing except the code that talks to that provider, and deleted the moment the shop disconnects.
What we never do
Three things, plainly:
- We do not sell anyone's data, and we do not share it with advertisers.
- One shop can never see another shop's data. This is enforced by the database itself, not by our code being careful.
- We do not read your shop's data to build anything. Our support staff can see whether something failed, not what you sold.
Deleting and keeping
Two different answers, because two different things are true.
Anything with an accounting life is kept but anonymised. If a customer asks to be removed, their name and phone go and their purchases stay, with the person's identity stripped out. A shop cannot honestly delete last year's sales, and tax law does not let it.
Anything with no accounting life is deleted outright. An order sent through a catalogue page that the shop never fulfilled is just a request that came to nothing, so when a shop closes its account we delete those, phone numbers included.
If a shop leaves Orin, it can export everything it holds first. After that we remove its data on the schedule described in the account-closing screen.
Where your data lives
On servers in Mumbai, India, run by Supabase, and on Vercel, which serves the app. We chose those two because they are reliable and affordable at our size, not because of where they are. Email is sent through Resend.
Everything travels encrypted, and it is encrypted where it is stored.
Your choices
You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to remove it, subject to the accounting rule above. If you are a shop's customer, ask the shop first — it is their record. If you cannot get an answer, write to us and we will help.
Changes
If we change this page in a way that matters, we will say so in the app rather than quietly editing it. The date at the top always tells you which version you are reading.
Contact us
Questions about this page, or about your data? Email us and a person will answer. Orin is built and run in Moshi, Tanzania.