Privacy Policy

1. Who we are

Gasty Systems Limited, trading as OrderCap ("OrderCap", "we", "us"), provides software for businesses to run day-to-day operations — including our mobile app, marketing website at staging.myordercap.com, business tools, and customer-facing pages such as public business websites (showcase), order status, and receipt submission.

This Privacy Policy explains how we collect, use, store, and share information when you use our services. If you have questions, contact us at [email protected].

2. Who this policy applies to

• Business users — owners and staff who create an OrderCap account and use the app to record orders, payments, and receipts.
• End customers — people whose details a business enters into OrderCap, or who use customer-facing OrderCap pages (for example a business showcase, order tracking, or receipt upload) without creating an account.
• Website visitors — people who browse our marketing site or contact us through forms.

If you are a business using OrderCap, you are responsible for telling your customers how you handle their information and for having a lawful basis to collect it. OrderCap processes that information on your instructions to provide the service.

3. Information we collect

Account and business information

• Business name and profile details you provide at registration
• Owner and staff names, email addresses, and login credentials (passwords are stored hashed, not in plain text)
• Staff roles and permissions within your business

Order and payment data

• Customer names and contact details you enter
• Services or products, amounts, order status, and order source (e.g. WhatsApp, phone, walk-in, Instagram)
• Payment method, amounts recorded, and who created or approved a payment
• Audit history — who changed an order, when, and what changed

Receipt uploads

When a customer submits a bank transfer receipt through a pay link or QR code, we collect the uploaded image (and any metadata needed to link it to the correct order). Customers do not need an OrderCap account to submit a receipt.

Device and usage information

• App version, device type, operating system, and general diagnostic logs
• Sync activity and error reports to keep the service reliable
• IP address and browser type when you visit our website or receipt pages

Support and contact

If you contact us by email, WhatsApp, or our contact form, we keep the information you send so we can respond and improve support.

4. How we use information

We use collected information to:

• Provide, operate, and maintain OrderCap — including offline sync, dashboards, and staff access
• Enable receipt collection, payment approval workflows, and audit trails
• Authenticate users and protect accounts from unauthorized access
• Send service-related messages (e.g. account or security notices)
• Respond to support requests and fix bugs
• Understand usage patterns and improve the product
• Comply with legal obligations and enforce our Terms of Service

We do not sell your personal information. We do not use order or customer data from your business to advertise to your customers.

5. Legal bases (where applicable)

Where data protection law requires a legal basis, we rely on:

• Contract — to provide the service you signed up for
• Legitimate interests — to secure, improve, and support OrderCap in ways that do not override your rights
• Legal obligation — where we must retain or disclose information by law
• Consent — where you have given clear consent (e.g. optional marketing, if offered)

For users in Nigeria, we aim to comply with the Nigeria Data Protection Act (NDPA) and related guidance from the Nigeria Data Protection Commission (NDPC).

6. How we share information

We may share information with:

• Service providers — hosting, database, email, analytics, or error-monitoring providers that help us run OrderCap, under contracts that limit their use of your data
• Within your business — owners and authorized staff can access data for the business account they belong to
• Legal and safety — if required by law, court order, or to protect rights, safety, and security
• Business transfers — in connection with a merger, acquisition, or sale of assets, with notice where required

We do not share your business order data with other OrderCap customers.

7. Data retention

We keep your business data for as long as your account is active and you continue to use the service.

You can delete your account at any time — from within the app, or from our account deletion page.

Owner account deletion (business closed)

• Access is disabled immediately — your account is closed and no one can sign in.
• Your data — including your name, email, business details, orders, and recorded payment status — is kept for up to 30 days so an accidental deletion can be reversed, and is then permanently deleted.
• Receipt uploads — customer-submitted receipt images (which may contain customer name or bank details) are deleted from our storage systems at the day-30 purge.
• Backup copies are overwritten on our normal backup rotation and are not restored.

Staff account deletion

When a staff member deletes their account, their login and personal information (name, email) are removed immediately. The orders and business records they worked on remain with the business, with their name removed from those records.

Export before deletion

Before deleting, you can download a copy of your data from within the app or via our account deletion page. Nigerian law generally requires businesses to keep financial records for six years; we provide this export so you can meet that obligation. We do not keep your records on our behalf beyond the retention periods described above.

8. Security

We use technical and organizational measures designed to protect your information, including encrypted connections (HTTPS/TLS), access controls, and hashed passwords. Receipt images are stored securely and are accessible only within the relevant business account.

No method of transmission or storage is completely secure. You are responsible for keeping your login credentials confidential and for managing staff access appropriately.

9. Your rights and choices

Depending on where you live, you may have the right to:

• Access a copy of personal information we hold about you
• Correct inaccurate information
• Request deletion of your account or certain data
• Object to or restrict certain processing
• Withdraw consent where processing is based on consent
• Lodge a complaint with a data protection authority

Business owners can manage much of their data directly in the app. For other requests, email [email protected]. We may need to verify your identity before responding.

If you are an end customer of a business using OrderCap, contact that business first about your order data. We can help where the business directs us to.

10. International transfers

OrderCap may process and store information on servers located outside your country. Where required, we use appropriate safeguards for cross-border transfers.

11. Children

OrderCap is a business tool and is not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will take appropriate steps to delete it.

12. Cookies, analytics and advertising

We use necessary cookies for sign-in and store your cookie choices. With your permission, PostHog helps us understand feature usage and receives account details such as your account ID, email and business role. With your permission, our marketing website and business signup flow use TikTok Pixel, Meta Pixel (Facebook and Instagram), and Google Ads to measure website visits and successful account registrations, attribute them to ads, and improve advertising. These providers may receive online identifiers, browser and device information, visited URLs, and advertising click identifiers. For consented website registrations, our server also sends TikTok a SHA-256 hash of your normalized email address and account identifier to help match the registration to an ad. Hashing does not make these identifiers anonymous. We do not send your name, phone number, password, or business records in these registration events.

Advertising scripts load only after you accept optional advertising cookies. Use the Cookie settings button below to change your choice. Your preference is shared across myordercap.com subdomains for six months. Rejecting advertising cookies does not affect signup or sign-in. Withdrawing permission stops future advertising events; it does not remove information already received by a provider. A registration authorized at signup may be retried by our server for up to 24 hours if delivery fails. Pending delivery data is removed after successful delivery or on the next processing pass after that retry period expires. Browser settings can remove existing cookies.

In iOS app versions with TikTok app measurement enabled, we request permission through Apple's tracking permission prompt before starting TikTok's SDK. If you allow tracking, the SDK shares device and advertising identifiers, installation and app-open activity, successful account registration, and technical diagnostic information with TikTok to measure our advertising and support relevant advertising. This integration does not send account email addresses, names, phone numbers, business records, or customer orders to TikTok, and automatic purchase reporting is disabled. Declining tracking does not affect app functionality. You can change permission in iOS Settings; we check it again when the app returns to the foreground. TikTok's processing is subject to its privacy policy. The app's Settings page includes an Advertising privacy shortcut.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised version on this page and update the "Last updated" date. Material changes may also be communicated through the app or by email. Continued use of OrderCap after changes take effect means you accept the updated policy.

14. Contact

Privacy questions or requests: [email protected] or our contact page.