Ordinami.itPrivacy Policy
Data controller: Italyflow LLC (Ordinami.it) — contact: [email protected].
What data we collect
- Account data: email, name, VAT number/tax code and password (encrypted) when you sign up.
- Restaurant data: menus, dishes, photos, prices and settings you enter in the platform.
- Table orders: the content of the order, the table and any name given by the guest. We do not collect payment data from end customers.
- Newsletter: the email address you enter in the sign-up form.
- Contact requests: first name, surname, mobile number, email address, name and town of your business, type of venue and your answers to the form questions, if you ask to be called back from the page of one of our campaigns (see “Contact requests”).
- Subscriptions: payment is handled by a third-party payment provider; we receive the email address and the subscription status in order to activate the licence.
- Identity verification documents: only if you request a password change through the verified procedure, we ask you for a copy of an identity document (and, where applicable, a business document) and a selfie taken at that moment.
Identity verification for password changes
When you request a password change through the verification link, the documents and the selfie you upload are used exclusively to verify that you are the real owner of the business and to prevent unauthorised access to your account (legitimate interest in the security of the service). They are kept in a private storage area, are visible only to our team while the request is being reviewed and are deleted automatically as soon as the request is approved or rejected, i.e. once the password change has been completed (or denied). They are not used for any other purpose nor shared with third parties.
Service emails and newsletter
Service emails (address verification, password reset, subscription status) and the newsletter are sent through a European email delivery provider, which processes the recipient's address for the sole purpose of delivering the message. Every newsletter email contains an immediate unsubscribe link.
Where the data is stored
Data is hosted with a cloud infrastructure provider whose database is located in the EU region (Frankfurt) and is distributed through an international CDN network. Payments are processed by the payment provider under its own privacy notice, available at checkout. The up-to-date list of data processors is available on request by writing to [email protected].
Meta pixel (only with consent)
With your consent, given in the cookie banner, the site uses the Meta pixel (Meta Platforms Ireland Ltd.) to measure our advertising campaigns: Meta receives technical data about the visit (pages viewed, events such as sign-up, contact request, trial start or purchase, cookie identifiers) and may also process it in the United States under its own privacy policy. Legal basis: consent, which you can withdraw at any time from the “Cookie preferences” link.
Security and abuse prevention
To protect the service from automated sign-ups and abuse, registration and the contact request form use Cloudflare Turnstile, an anti-bot check that analyses technical browser signals without profiling cookies. We also record the IP address used to sign up, sign in, write to support and send a contact request: it is used to detect and block those who abuse the service (legitimate interest in security) and is kept for a maximum of 180 days.
Contact requests
If you fill in the “Richiedi ora la chiamata” (request a call now) form of one of our campaigns, we process your first name, surname, mobile number, email address, the name and town of your business, the type of venue, your answers to the form questions (what you need most and when you would like to start) and, if you choose it, the preferred time for the call, together with your IP address, browser data and the ad you came from. We use them to call you back, by phone, on WhatsApp or by email, present our service and plans to you and answer your request (pre-contractual measures taken at your request, Art. 6(1)(b) GDPR; without this data we cannot call you back); IP address, browser and origin are also used to block abuse and to understand which ads work (legitimate interest). Only if you have accepted marketing cookies on the campaign page do we tell Meta that the request was sent, in order to measure our campaigns, with your mobile number, email address, first name, surname and town hashed, the type of venue, IP address, browser and the identifiers of the ad click and of the _fbp cookie (consent, Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code, which you can withdraw from “Cookie preferences”): Meta Platforms Ireland Ltd. acts as joint controller for the collection and transmission of this data. We do not use this data for newsletters or other offers. We keep it for 12 months from the last interaction (24 months if you become a customer) and then delete it automatically; the IP address used against abuse is kept for a maximum of 180 days. The emails we exchange are kept in our mailbox (Hostinger) for as long as they are needed for our relationship with you; an AI-based assistant (Anthropic) helps us sort them and reply, and may process them outside the EU with the safeguards required by the GDPR. You can ask for earlier deletion by writing to [email protected].
Why we process it
To provide the service (performance of the contract), to send you service communications and — only if you subscribe to the newsletter — tips and news (consent, which can be withdrawn at any time).
For how long
For as long as your account exists. After cancellation, data is kept for 2 years so that if you come back everything is ready; you can request earlier deletion by writing to [email protected].
Your rights (GDPR)
You may request access, rectification, erasure, portability and restriction of processing, object to processing based on legitimate interest and withdraw any consent at any time by writing to [email protected]. You have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).
Last updated: 20 October 2026