Privacy policy

Who we are

OpenFork is operated by VJB Group Pty Ltd (ABN 93 160 255 416). We provide software that lets a restaurant take orders from its own website. We are based in New South Wales, Australia.

This policy explains what we do with personal information. Questions, corrections and complaints go to stelios@vjbgroup.com.au.

Two kinds of people, and why the difference matters

Restaurants are our customers. We decide what to do with their information, and we are answerable for it.

Diners who place an order are the restaurant’s customers, not ours. We hold their information on the restaurant’s behalf, and it is the restaurant that decides what happens to it. If you ordered food and want your details removed, the restaurant is the first place to ask — though you may also ask us and we will act on it.

What we collect from restaurants

Account details: business name, the name and email address of the person who signed up, phone number, trading address, website, and a password we store only as a hash — we cannot read it.

Operating details: your menu, prices, opening hours, and the settings you choose.

Payment credentials: if you connect Stripe with your own API keys, the secret key is encrypted before it is stored, never shown again, and never sent to a browser. Your card payments go directly to your own Stripe account. We take no commission and never hold your takings.

Usage information: which of your web pages the ordering button was used from, so you can see where your orders come from.

What we collect from diners

To place an order: name, email address, phone number, what was ordered, any note left with it, and the requested pickup time.

If the box was ticked to hear about offers from that restaurant: an opt-in marketing flag, and a record of orders placed with that restaurant so the restaurant can tell a regular from a first-timer.

Card details are never collected by us. They are typed into a frame served by Stripe and go straight to them.

Marketing email

A restaurant can only email a diner who ticked the box asking for it. Every such email carries a one-click unsubscribe, and unsubscribing takes effect immediately and permanently for that restaurant.

We do not sell, rent or share diners’ details with anyone, and a restaurant cannot see or email another restaurant’s customers.

Order confirmations, receipts and rejections are not marketing. They are sent because an order was placed, and they are not something to unsubscribe from.

Cookies

We set one cookie, and only after somebody signs in to a dashboard: it keeps them signed in. It is not used to follow anyone around the internet.

The ordering page sets no tracking cookies. There is no advertising network, no analytics tag and no third-party pixel on this site.

Who else sees the information

Only the services that have to, in order for the product to work:

Vercel — hosting and content delivery. Handles every request to the site.

Neon — the database the platform runs on, hosted in Sydney.

Stripe — card payments. Card numbers are entered directly into Stripe and never reach our servers or a restaurant. Where a restaurant uses their own Stripe account, their payments are governed by their agreement with Stripe.

SMTP2GO — sending email, including order receipts and any marketing a restaurant sends.

Twilio — sending text messages, such as the alert to a restaurant about an order nobody has answered.

Some of these operate outside Australia. We use them because they are necessary to run the service, and they are bound by their own agreements to handle the data only as instructed.

We do not sell personal information to anyone, in any circumstances.

Security

Traffic is encrypted in transit. Passwords are stored as hashes. Stored third-party secrets, such as a restaurant’s Stripe key, are encrypted at rest with a key held separately from the database.

No system is beyond reach. If a breach occurs that is likely to cause serious harm, we will notify those affected and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

How long we keep things

Order records are kept while the restaurant’s account is open, because they are the restaurant’s own business records and are needed for tax and dispute purposes.

If a restaurant closes its account, we delete its data within 90 days, other than anything we are required by law to keep.

A diner who unsubscribes stops receiving marketing at once; the record of their orders remains with the restaurant as part of its books.

Your rights

You may ask what we hold about you, ask us to correct it, or ask us to delete it. Write to stelios@vjbgroup.com.au and we will respond within 30 days.

If you are unhappy with how we have handled a privacy matter, tell us first and we will try to put it right. If you are still unsatisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Changes

If we change this policy in a way that materially affects you, we will tell account holders by email rather than quietly changing the page.