Mobile appPrivacy Policy
Last updated: 8 October 2026
This privacy policy explains how JIV Tech Oy processes your personal data when you use the Order-It app or its App Clip (the "App"). It is written under the EU General Data Protection Regulation (GDPR, 2016/679) and the Finnish Data Protection Act.
Controller
JIV Tech Oy (business ID 3381345-4)
Viestikatu 8 B 49, 90130 Oulu, Finland
https://www.order-it.fi
Privacy contact: kumppanit@try-order-it.fi
In short
- You use the App without registering. We create an anonymous user ID for you and never ask for your name or email address.
- We collect only what ordering, payment, delivery and keeping the App working require.
- We do not track you across other companies' apps or websites, and we do not sell or share your data for advertising.
- Your card details are handled by our payment provider Stripe. We never see or store your card number.
- You can delete your account from the App's profile screen.
What we process and why
| Data | Source | Purpose | Legal basis |
|---|---|---|---|
| Anonymous user ID (Firebase Authentication) | Created automatically when you start using the App | Linking orders, cart and order history to you | Contract (GDPR 6(1)(b)) |
| Order details: items, add-ons, price, restaurant, service type, order number, timestamp and status | You, when you order | Sending the order to the restaurant, status tracking, receipt and order history | Contract (6(1)(b)); accounting obligations (6(1)(c)) |
| Payment details: payment method type, payment ID and status | Stripe | Authorising, capturing and refunding payments, handling disputes | Contract (6(1)(b)); accounting obligations (6(1)(c)) |
| Phone number (optional, delivery only) | You | Letting the courier reach you if there is a problem with the delivery | Contract (6(1)(b)) |
| Delivery address, apartment number, courier instructions and address coordinates (delivery only) | You; address search through Google Places | Delivery, calculating delivery distance and fee, remembering the address for your next order | Contract (6(1)(b)) |
| Precise location | Your device, only with your permission | Showing nearby restaurants in the list and on the map. Location is used on your device and is not stored on our servers. | Consent (6(1)(a)), which you can withdraw in your device settings |
| Notification and Live Activity tokens (push tokens) | Your device, when you allow notifications | Order status notifications, for example when your order is ready for pickup, and the Lock Screen Live Activity | Contract (6(1)(b)); consent to notifications (6(1)(a)) |
| Usage data: screens viewed and in-app events | Firebase Analytics | Improving the App and measuring how it works | Legitimate interest (6(1)(f)) |
| Diagnostics: error and crash data, device model, OS and App version | The App and server logs | Fixing bugs, security and preventing misuse | Legitimate interest (6(1)(f)) |
| Camera (only if you use card scanning) | Your device, only with your permission | Reading card details into the payment form. The image is processed on your device and not stored. | Consent (6(1)(a)) |
We do not process special categories of data and do not make automated decisions or profiling with legal or similarly significant effects on you.
For orders containing alcohol, the restaurant checks your age in person. The App does not collect or store ID document data.
Who receives your data
Restaurants. When you order, the restaurant receives the order contents and the order number. For delivery, the restaurant and its courier also receive the delivery address, instructions and, if you gave it, your phone number. The restaurant processes this data as the seller under its own obligations, such as alcohol-serving and accounting rules.
Service providers (processors). These services process data on our behalf and under our instructions:
| Service | Purpose |
|---|---|
| Google Firebase (Google Ireland Ltd): Authentication, Firestore, Realtime Database, Cloud Functions, Cloud Messaging, Remote Config, Analytics | Sign-in, storing and passing on orders, notifications, configuration, analytics |
| Google Maps Platform and Google Places | Maps and address search |
| Apple (Apple Push Notification service) | Notifications and Live Activities on iOS |
| Expo (650 Industries, Inc.) | Delivering app updates |
Payment provider. Payments are processed by Stripe Payments Europe Ltd. Stripe also processes card and payment data as an independent controller under its own legal obligations (for example anti-money-laundering rules). For MobilePay payments, MobilePay also processes the payment details. Apple Pay and Google Pay are also subject to Apple's and Google's terms.
Authorities. We disclose data to authorities only when the law requires it.
We do not sell your personal data or share it for marketing.
Transfers outside the EU/EEA
We aim to keep data in the EU: our server functions run in Europe (europe-west1). Some providers (Google, Stripe, Apple, Expo) may also process data in the United States. These transfers rely on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
Retention
| Data | Retention |
|---|---|
| User ID, saved phone number and delivery address, push tokens | Until you delete your account |
| Unfinished cart | Deleted automatically within 7 days |
| Order and payment records | As long as Finnish accounting law requires, at most 6 years from the end of the year the order was made |
| Analytics data | Per the Firebase Analytics retention setting, at most 14 months |
| Server logs | At most 30 days |
When you delete your account, we delete your user ID together with its profile data and order history. Order and payment records already passed to restaurants are kept for the period accounting law requires, but the account they belonged to no longer exists.
Your rights
You have the right to:
- know what data we process about you and get a copy of it
- have inaccurate data corrected
- have your data erased (you can also delete your account yourself in the App's profile screen)
- restrict processing
- object to processing based on legitimate interest, such as analytics
- receive the data you gave us in a portable format
- withdraw consent at any time: location, camera and notifications can be turned off in your device settings. Withdrawal does not affect processing that happened before it.
Send requests to kumppanit@try-order-it.fi. Because the account is anonymous, include for example an order number and the order date so we can find your data. We reply within one month.
If you believe your data is processed unlawfully, you can lodge a complaint with the Finnish Data Protection Ombudsman (https://tietosuoja.fi/en).
Security
Data is encrypted in transit (HTTPS/TLS). Database access rules let each user see only their own orders and each restaurant only the orders placed with it. Card data is handled by PCI DSS certified Stripe and never passes through our servers.
Children
The App is not intended for children under 13. Only adults can order alcoholic drinks.
Changes
We may update this policy when the App or the law changes. We will tell you about material changes in the App or on our website. The current version is always available at https://www.order-it.fi.