1. Who we are
Xorda Ltd (“Xorda”, “we”, “us”, “our”) is a company registered in England and Wales. Registered address: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.
We provide a phone ordering and payment platform for UK restaurants and takeaways.
We are registered with the Information Commissioner's Office (ICO) as a data controller (registration number ZC181142). Contact us at: legal@xorda.co.uk
2. What data we collect and why
Restaurant operators (our subscribers)
- Name and email address — to create and manage your account
- Restaurant name and business details — to set up your service
- Payment information — processed securely by Stripe on our behalf
- Stripe account details — to enable you to receive payments from customers
- Phone number for call forwarding — to route customer calls correctly
End customers (your customers who call you)
- Phone number — captured when you call, used to send you a secure ordering link by SMS
- Order details — items, delivery address, order type
- Payment information — processed securely by Stripe; we do not store card details
3. How phone ordering works
When you call a restaurant that uses Xorda, we capture your phone number and send you a secure link by SMS to browse the menu, build your order and pay. Calls are not recorded and we do not use speech recognition or AI to listen to calls.
Your phone number and order details are used solely to take and fulfil your order. They are never sold, shared beyond the processors listed below, or used to train AI models.
4. Legal basis for processing
- Contract — processing necessary to deliver our service to restaurant subscribers, including account management, billing, and platform operation
- Legitimate interests — processing end customer data (phone numbers, order details, delivery addresses) to fulfil orders placed by that customer with the restaurant. Our legitimate interest is in enabling restaurants to accurately receive and fulfil orders. This does not override the rights and freedoms of end customers given the limited scope of processing and the direct benefit to the customer
- Legal obligation — where we are required to retain data for tax, accounting or regulatory purposes
5. Who we share your data with
We use the following third-party data processors. Each has been selected for their compliance with UK GDPR and we have Data Processing Agreements in place with each:
TwilioInbound call handling and SMS messaging
OpenAIOptional menu photo import — converting an uploaded menu image into text (not used for calls)
StripePayment processing and restaurant payout management
SupabaseSecure database storage for orders, menus and account data
We do not sell your data. We do not share it with any third party beyond those listed above.
6. How long we keep your data
- Order data — retained for 12 months then deleted
- Account data (restaurant operators) — retained while your account is active and for 6 years after closure for legal and tax purposes
- Payment records — retained for 7 years as required by HMRC
7. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request deletion of your data (“right to be forgotten”)
- Restrict or object to how we process your data
- Data portability — receive your data in a machine-readable format
- Withdraw consent at any time where processing is based on consent
To exercise any of these rights, email legal@xorda.co.uk. We will respond within 30 days.
8. Data security
All data is encrypted in transit (TLS) and at rest. Access to personal data is restricted to authorised personnel only. We conduct regular reviews of our data handling practices.
9. Complaints
If you are unhappy with how we handle your data, you can contact the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
10. Changes to this policy
We may update this policy from time to time. We will notify restaurant subscribers of material changes by email. Continued use of the service after changes constitutes acceptance of the updated policy.