Privacy Policy
Effective 24 October 2026
1. Who we are
OrderxPay ("we", "us") is operated by Alex Arkum Tantuo, trading as IQUTY, P.O. Box CE 11926, Tema, Ghana. We run the OrderxPay mobile app for merchants and the web pages their customers use to order and pay. You can contact us at support@orderxpay.com.
Two kinds of people have information with us:
- Merchants and their staff — people who use the OrderxPay app.
- Customers of merchants — people who order from a merchant's catalog link or pay a merchant's invoice. They do not need an OrderxPay account.
For information a merchant enters about their own customers (names, phone numbers, orders), the merchant decides what to collect and why; we store and process it for them.
2. Information we collect
From merchants and staff:
- Account: business name, your name, phone number, email address (optional), a password (stored only in scrambled form, never readable), and your role (owner or staff).
- Business details: business type, and the pickup and delivery locations and addresses you enter.
- Verification (to raise limits and be paid out): your Ghana Card number (we never photograph or store an image of the card); for a registered business, its registration number and a photo or PDF of its registration certificate; and a selfie taken during a liveness check in which you blink and turn your head.
- Payout details: the Mobile Money number or bank account you want to be paid into, and the name the bank or network holds for it.
- Sales records: items and prices, invoices, orders, payments, refunds, settlements, and the notes and statuses attached to them.
- Photos: item photos and your logo, which appear on your public catalog and checkout page.
- Customers you save: the names and phone numbers you add, pick from your phone contacts, or send invoices to.
- Device information: a notification token so push notifications reach your phone. Your language, theme and accessibility choices stay on your phone.
- Remembered sign-in (on your phone only): after you sign in, your phone remembers your phone number or email and your business name, so the sign-in screen can ask only for your password. If you turn on fingerprint or face sign-in, your password is also kept in your phone's protected storage, where only this app can read it. None of this is sent to us except when you sign in. Choosing "Use a different account", or turning the setting off, removes it.
- Location: only if you tap "Use current location" when adding a pickup location. We then save those coordinates with that location.
From customers of merchants:
- When they place an order request: name (optional), phone number or email, and the items they ask for.
- When they pay: the amount, the date, how they paid (Mobile Money or card) and a payment reference. Card numbers and Mobile Money PINs are entered on our payment partner's page, not ours; we never see them.
Collected automatically:
- Our servers keep ordinary technical logs (such as the time and the request made, and the IP address it came from) to keep the service running and secure.
- When the app is used on a phone, it asks our servers for what it shows; it does not download anything from other companies to draw its text (its typeface is part of the app).
We do not use advertising or analytics tools, and we do not track you across other apps or websites.
3. How we use it
To run the service you asked for (invoices, orders, payments, records, notifications); to verify identity and prevent fraud and money-laundering; to pay merchants out to the account they have verified as their own; to send you codes, alerts and receipts by SMS, in-app message or push notification; to give support; to keep the service secure; and to meet our legal duties.
4. The selfie and the liveness check
The blink-and-turn check runs on your phone using Google's ML Kit; the app does not send the video. At the end it uploads one still photo, which is stored privately and shown only to the OrderxPay staff who review verification requests. We do not build a face template from it, and we do not use it for anything except deciding that request, resolving disputes about it, and meeting our legal duties. It is deleted when your account is closed.
6. Where it is stored
Our servers are in France (Contabo's data centre in Lauterbourg, in the European Union). Some of the companies above process data in other countries. We choose providers that protect data to a similar standard and use them only for the purposes in section 5.
7. Security
Data travels over encrypted connections (HTTPS). Passwords are stored only in scrambled form. Verification photos and documents are kept in private storage that only authorised staff can read. Payout accounts must be shown to belong to the merchant, changes to them are held for a cooling-off period, and we text an alert when a password or payout account changes. No system is perfectly secure; if we learn of a breach that affects you we will tell you as the law requires.
8. How long we keep it
- Your account and what you added to it (items, saved customers, locations, staff logins, settings): while the account is open.
- If you ask us to delete your account, it becomes read-only for 14 days, during which you can change your mind. After that your business details, items, saved customers, locations, staff logins, notification tokens, logo and verification photos are permanently deleted.
- Records of payments, refunds, payouts, invoices and disputes, the verification decision (including the Ghana Card number), the payout account details they were paid to, and the audit trail are kept for 6 years after the account closes, because financial and anti-money-laundering rules require us to keep them. They no longer carry your business name, and they are deleted when that time is over.
- Backups: when data is deleted, copies of it can remain in our routine backups for up to 30 days, after which they are deleted with the backups themselves.
- Ordinary technical logs: kept in rolling files that are overwritten as they fill, so they hold only recent activity.
9. Your rights
You may ask us to give you a copy of your information, correct it, delete it, or stop using it for a purpose. Merchants can correct most details in the app (More → Account & Security). To delete your account, use More → Account & Security → Account → Delete account in the app, or go to https://shop.orderxpay.com/delete-account. You can also write to support@orderxpay.com; we will confirm it is really you first. Some records we are legally required to keep (section 8) cannot be deleted on request; we will tell you what we keep and why. If you are unhappy with our answer you can complain to Ghana's Data Protection Commission.
10. Children
OrderxPay is for businesses and is not meant for anyone under 18. We do not knowingly collect information from children.
11. Changes
If we change this policy in a way that matters, we will tell you in the app or by SMS before it takes effect. The date at the top shows the latest version.
12. Contact
Alex Arkum Tantuo, trading as IQUTY, P.O. Box CE 11926, Tema, Ghana — support@orderxpay.com