This policy explains what personal information Orion collects, why, who we share it with, how long we keep it and the choices you have. It covers the Orion website and dashboard, the guest pages of restaurants that use Orion and the emails we send.
1. Who we are
Orion is run by Valentyna Schaslyva, British Columbia, Canada (“Orion”, “we”, “us”). We are responsible for the personal information described in this policy. For questions and requests, email privacy@orionrestaurants.com.
Each restaurant that uses Orion decides what it publishes about itself on its guest pages and is responsible for how its team uses the reviews and other information it sees in its dashboard.
2. Information we collect
- Your account. Your name or username, email address, password (stored only as a one-way hash), and, if you add them, your phone number and profile picture; your language; and the restaurants and roles you have. If you sign in with Google, Google gives us your name, email address, profile picture and Google account ID.
- Restaurant content. What you add for a restaurant: its details, addresses, opening hours, menus, dishes, prices, photos, events and links, and the email addresses of the people you invite to its team.
- Sign-ins and security. For each signed-in device, its IP address, browser type and when it was last used. We also keep a log of changes to restaurants and accounts (who changed what, and when).
- Support. The messages and files you send us and our replies.
- Guest reviews. Guests can review a restaurant or a dish without an account: a rating, an optional comment and name, and the language of the page. Instead of the guest’s IP address we keep a keyed hash of it, which cannot be turned back into the address, to limit how often one person can post and to spot abuse. When it is turned on, Cloudflare Turnstile checks that a person, not a bot, sends the review. A published review, the name given with it and the restaurant’s reply are public.
- Google Business Profile. Only if you connect it; see Google user data.
- Restaurants we contact. Our team may prepare a menu for a restaurant before it signs up and email it an invitation. For this we keep the restaurant’s business details and business contact information, taken from public sources such as its website or map listing, or given to us; where we found them; the emails we sent; whether the prepared menu was opened; and any request to stop contacting it.
- Usage and errors. We count visits and the use of features with PostHog in cookieless mode: it stores nothing on your device, and we never link these events to you or your account. When something breaks, an error report with technical details goes to Sentry; we remove tokens and private links from it and never include passwords, cookies or what you typed into forms.
3. How we use it
- To provide Orion: your account and sign-in, your restaurants and their guest pages, translations, AI photos, reviews, emails about your account, your restaurants and your support requests.
- To keep Orion secure and fair: sessions, the change log, limits on reviews and on free features, and checks against abuse.
- To answer your questions and support requests.
- To improve Orion, from usage statistics and error reports that do not identify you.
- To tell restaurants about Orion. We email only business addresses that are published without a request not to be contacted, or that were given to us, and we stop when asked.
- To meet our legal obligations.
We do not sell personal information, we do not use it for advertising, and we do not build advertising profiles.
Where the GDPR (EU or UK) applies, we rely on: the performance of our contract with you (your account and restaurants); our legitimate interests in keeping Orion secure, improving it and telling restaurants about it, which you may object to; your consent where we ask for it, such as connecting Google, which you may withdraw at any time; and our legal obligations.
4. Translation and AI
Text you write for guests, such as restaurant details, menus and events, is translated automatically by DeepL, or by OpenAI when DeepL is unavailable, and the translations are cached. Please do not put personal information in this text.
When you use AI Image Studio, the dish photo you choose is sent to OpenAI to create the new photo. Results you do not save are deleted after 24 hours. AI photos are marked as such in Orion.
The dashboard’s assistant (“Ask Orion”) sends your question, the earlier messages of the chat, your role, the page you are on and the selected restaurant’s name and status to OpenAI to write the answer. We keep the chat, with your ratings of the answers, for 30 days after its last message, and you can delete it sooner with “New chat”. Orion’s team reads a chat only when you send it to support, or, to improve the answers, the answers you mark as not helpful. Please do not put personal information or passwords in your questions.
6. Where it is stored
Our database, files and servers are in the United States, and photos are delivered through a worldwide network; some providers, such as DeepL and PostHog, process information in the European Union. Your information may therefore be stored and processed outside your country, under laws that differ from yours and where local authorities may be able to access it. For information from the European Union and the United Kingdom we rely on the adequacy decisions for Canada and on our providers’ Standard Contractual Clauses or Data Privacy Framework certifications.
7. How long we keep it
- Your account and restaurant content: while your account exists. When you ask us to delete your account, we delete them within 30 days, except what the law requires us to keep.
- Sign-ins: each lasts at most 30 days; its record, with the IP address and browser, is deleted then.
- The change log: 180 days, or one year for security warnings; records of serious security events are kept as long as they are needed to protect Orion.
- Guest reviews: while they are published on the restaurant’s page. A guest can ask us to delete their review; tell us the restaurant, the date and the text.
- AI Image Studio results you do not save: 24 hours.
- Assistant chats: 30 days after their last message (sooner if you delete them).
- Google Business Profile information: see Google user data.
- Restaurants we contact: as long as needed to offer them Orion. If a restaurant asks us to stop, we keep its address on a do-not-contact list so that we can respect that.
- Support requests: as long as needed to handle and document them.
8. Your rights
Depending on where you live, you can ask to see the personal information we hold about you, to correct it, to delete it, to receive a copy in a common format, to restrict or object to how we use it (including for messages about Orion), and to withdraw a consent you gave. You can change most of your details yourself in your account settings; for anything else, email privacy@orionrestaurants.com. We answer within 30 days and may first need to confirm that the request comes from you.
You can also complain to a privacy regulator: in Canada, the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner for British Columbia; in the EU or the UK, the data protection authority where you live or work. We would appreciate the chance to help first.
10. Security
Orion is served over HTTPS only. Passwords are stored as one-way hashes, the Google access we are given is stored encrypted, and each person sees only the restaurants and data their role allows. No system is completely secure; if a breach affects your information, we will tell you and the regulators as the law requires.
11. Children
Orion accounts are for adults acting for a business. Guest pages are for everyone, but we do not knowingly collect personal information from children under 16; if you think a child has sent us some, email us and we will delete it.
12. Google user data
Sign in with Google. Orion receives only your name, email address, profile picture and Google account ID, and uses them only to create your account and sign you in.
Google Business Profile. When the owner or a manager of a restaurant connects its Google Business Profile, Orion asks Google for permission to manage that person’s business profiles. With it, Orion:
- reads the list of business profiles the Google account manages, to link the restaurant’s own listing, and then that listing’s name, address, place ID and review link;
- reads the listing’s reviews (rating, text, the reviewer’s public name and photo, dates and the business’s reply) and Google’s average rating and number of reviews;
- posts, changes or deletes the business’s reply to a review, only when the owner or a manager does so in Orion.
Orion never changes the listing’s details, never replies on its own, and requests no other Google data. It uses this information only to show the restaurant’s owners and managers their Google reviews in the dashboard and to send their replies. It is not shown to guests, not used for advertising, not sold, and not shared except with the hosting providers that run this feature or when the law requires it. People at Orion look at it only with your permission (for example, to answer your support request), for security, or when the law requires it.
Orion keeps the access Google grants encrypted. It keeps a copy of the reviews and listing details for at most 28 days after Google last sent them and refreshes it while the restaurant’s team uses the dashboard.
You can disconnect at any time on the Reviews page in Orion: we give the access back to Google and delete the copies at once. If you instead remove Orion’s access in your Google Account, the copies expire within 28 days, or email us to delete them sooner.
Orion’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
13. Changes to this policy
When we change this policy we will publish the new version here with its date. If a change is significant, we will tell account holders by email or in the dashboard before it takes effect. We will ask for your consent before using Google user data in any new way.
14. Contact
Valentyna Schaslyva, British Columbia, Canada. Email: privacy@orionrestaurants.com. Our Terms of Use explain the rules for using Orion.