Order-Makers Privacy Policy
16657338 Canada Inc. o/a Galaxy Hospitality Solutions
Effective date: October 14, 2026
1. Introduction
16657338 Canada Inc., operating as Galaxy Hospitality Solutions ("GHS", "we", "our", or "us") is committed to protecting the privacy, confidentiality, and security of the information entrusted to us by our customers.
This Privacy Policy explains how Order-Makers collects, uses, stores, safeguards, and discloses information when restaurants and authorized users access our platform.
Order-Makers has been designed specifically for the hospitality industry. We recognize that restaurant operational information—including sales performance, menu engineering, labour metrics, pricing strategies, inventory trends, and employee performance—is highly confidential and represents a valuable competitive asset.
Protecting that information is a fundamental part of our relationship with every customer.
This Privacy Policy applies to all users of Order-Makers and describes our handling of personal information. Separate customer agreements may provide additional protections, and in the event of a conflict will govern to the extent permitted by applicable law, without limiting any non-waivable individual rights.
2. Scope of this Privacy Policy
This Privacy Policy applies to:
The Order-Makers web application and iOS and Android mobile applications
Customer administration portals
AI-powered reporting and recommendations
Customer support interactions
Website forms that collect customer information
Communications regarding the Order-Makers platform
This Privacy Policy applies to restaurants, hospitality groups, franchise organizations, managers, administrators, employees, and other authorized users of the platform.
This Privacy Policy does not apply to information maintained solely within a customer's Point-of-Sale ("POS") system that is never transmitted to Order-Makers.
Individual Authorized Users must be at least eighteen (18) years old. Customers must ensure that the individuals they authorize meet this requirement.
This policy covers our services for Canadian and United States customers and users. GHS is not currently accepting restaurants located in Quebec. This service restriction does not waive any privacy law or individual right that applies to a particular situation.
3. Our Privacy Principles
Everything we do is guided by the following principles.
3.1 Your Restaurant Data Belongs to You
Your restaurant's operational information remains your confidential business information.
Galaxy Hospitality Solutions does not claim ownership of your restaurant's sales information, operational metrics, or business intelligence.
3.2 Confidentiality Comes First
We understand that information such as:
Sales performance
Menu mix
Labour percentages
Employee productivity
Pricing strategies
Promotional effectiveness
Operational trends
may represent significant competitive advantages.
Accordingly, we treat this information as confidential and use identifiable information for the purposes explained in this policy and for other compatible purposes permitted by applicable law. Our permitted use of genuinely anonymous information is described in Section 35.
3.3 We Do Not Sell Customer Data
Galaxy Hospitality Solutions does not sell personal information for monetary or other valuable consideration, or share personal information for cross-context behavioural advertising, as those terms are defined by applicable law.
3.4 We Do Not Share Restaurant Data with Competitors
We do not disclose identifiable restaurant information to other restaurants or competitors, except with the Customer’s authorization or as reasonably necessary to provide or protect the Services, enforce our agreements, complete a corporate transaction, or comply with law.
If Galaxy Hospitality Solutions publishes industry benchmarks, success stories, or marketing materials, the information will either:
be fully anonymized and aggregated so individual restaurants cannot be identified; or
be published only with the customer's express permission.
3.5 Security by Design
Order-Makers incorporates security measures intended to protect customer information, including:
encrypted communications;
encryption of stored data;
secure password hashing;
role-based permissions;
restricted administrative access; and
the hosting and administrative safeguards described in Sections 18–25.
4. Definitions
For purposes of this Privacy Policy:
Account means an individual Authorized User account or a Customer subscription account, as the context requires. These accounts have different closure processes, explained in Section 30.
Authorized User means any individual permitted by a customer to access Order-Makers.
Customer or Subscriber means the restaurant, hospitality group, franchise organization, or business that has entered into an agreement to use Order-Makers.
Operational Data means restaurant business information including sales, menu performance, labour information, transaction information, reporting data, and analytics generated through the platform.
Personal Information means information about, relating to, or reasonably capable of being linked to an identifiable individual, as defined by applicable law. Replacing a name with a code or random string does not make information anonymous if the individual can still reasonably be identified.
Anonymous Information means information altered so that an individual cannot reasonably be identified, directly or indirectly, including through combination with other reasonably available information. We apply any additional deidentification requirements imposed by applicable law.
POS System means a supported Point-of-Sale platform integrated with Order-Makers.
Services means the Order-Makers software platform and related services provided by Galaxy Hospitality Solutions.
Portable Achievement Record means a platform-generated record of badges, achievements, milestones, completion status, dates, and other high-level verification indicators earned by an individual Authorized User through participation in Order-Makers. A Portable Achievement Record does not include the underlying sales figures, transaction data, menu data, confidential operational information, or detailed employee performance data of a Customer.
5. Information We Collect
The information collected depends upon how customers and individual users use Order-Makers. We receive information directly from users, from their restaurant’s authorized administrators and connected POS system, from use of the Services, and from the service providers described in Section 27.
5.1 Customer Account Information
We may collect information including:
restaurant name;
company name;
contact names;
email addresses;
telephone numbers;
billing information;
account credentials; and
user role assignments.
5.2 Restaurant Operational Information
Order-Makers may receive operational information from supported Point-of-Sale integrations, including:
employee names;
menu items;
sales totals;
transaction timestamps;
check numbers;
table numbers;
guest counts;
discounts;
voids; and
other operational information required to provide reporting, analytics, and platform functionality.
Order-Makers integrates with supported POS systems in read-only mode.
The platform does not modify POS records.
5.3 Authentication and Acceptance Records
For web and administrative accounts, we process usernames, password hashes, session information and access permissions. Passwords are hashed using bcrypt with salted hashing and are not stored in plain text.
The mobile applications use a phone number and a one-time SMS verification code through Twilio Verify. We process the phone number, verification information, authentication tokens and permissions needed to establish and protect the session.
We retain the acceptance timestamp and associated user information to document acceptance and consent. GHS maintains dated copies of the applicable policy, Terms and consent wording. The available acceptance evidence is used to respond to privacy inquiries and demonstrate the notice or consent provided; acceptance does not waive statutory privacy rights.
5.4 AI Processing Data
Certain platform features use artificial intelligence to generate summaries, recommendations, and operational insights.
When necessary for these features, carefully curated operational information may be submitted to the OpenAI API.
The information transmitted is limited to what is reasonably necessary to produce the requested functionality.
5.5 Communications
If customers contact Galaxy Hospitality Solutions, we may retain communications necessary to:
provide customer support;
investigate issues;
improve services;
respond to inquiries; or
document customer requests.
5.6 Individual and Mobile Application Information
Depending on the features used, we process:
Name, email address, phone number and an optional profile photograph.
Employee identifier, restaurant or company code, role and language preference.
Employment history entered by a restaurant administrator.
Sales-related performance metrics, scores, rankings, streaks, manager feedback and AI-generated insights.
Achievements, badges, milestones and achievement history.
Support-ticket titles, descriptions and related correspondence.
Notification preferences, in-app notification history and Firebase Cloud Messaging notification tokens.
A hashed device identifier used by the application, authentication tokens, and technical crash and diagnostic information collected through Firebase Crashlytics.
Training-video viewing activity is handled on the device and is not stored on the Order-Makers server. Embedded YouTube processing is separate and is described in Sections 13 and 27.
5.7 Device Permissions and Optional Features
A profile photograph is optional. The application may request access to the camera or selected photos when a user chooses to add a photograph. Push notifications are optional and can be controlled through available notification settings and the device’s operating-system settings. Declining an optional permission may prevent the associated feature from working.
6. Information We Do Not Collect
As part of our commitment to privacy, Order-Makers intentionally limits the information collected.
The mobile applications do not request GPS location, contacts, microphone or clipboard access, advertising identifiers, or payment and financial details. Subscription billing is handled separately through Stripe on the web or directly with GHS.
The platform is not designed to collect government-issued identification numbers, banking passwords, biometric identifiers, health information or unrelated personal social-media information. Payment card details are handled by Stripe rather than stored by Order-Makers.
Users should not include unrelated sensitive personal information in support messages, feedback or other fields. Information supplied in such fields may be received even though it is not requested.
We strive to collect only the information reasonably necessary to operate and improve the Order-Makers platform. Employee identity, employment and performance information described in Section 5 is part of the Services and is personal information where it relates to an identifiable individual.
7. How We Use Information
Galaxy Hospitality Solutions uses customer information to operate, maintain, improve, secure, administer, and support the Order-Makers platform, enforce applicable agreements, comply with law, and pursue other purposes described in this Privacy Policy.
Information is processed for legitimate business purposes related to the Services and as otherwise authorized or required by applicable law.
These purposes include:
Delivering analytics and operational reporting
Generating AI-powered recommendations and summaries
Managing customer and individual accounts and restaurant access
Providing employee performance feedback, rankings, training content and achievement records
Maintaining portable achievements as described in Section 8.1
Authenticating authorized users
Processing subscription billing
Providing technical support
Monitoring platform security
Improving system performance and reliability
Handling privacy requests and maintaining necessary acceptance and request records
Complying with applicable legal obligations
We do not use restaurant operational information for unrelated commercial purposes.
8. Data Ownership
One of the core principles of Order-Makers is that your operational data belongs to you.
Restaurant customers retain ownership of:
Sales data
Menu performance
Labour information
Employee performance metrics
Operational reports
Historical reporting
Customer-created content
Business configuration information
Galaxy Hospitality Solutions receives only the limited rights necessary to:
Store information
Process information
Analyze information
Display reports
Generate recommendations
Provide customer support
Maintain the platform
Nothing in this Privacy Policy transfers ownership of customer information to Galaxy Hospitality Solutions. Business ownership and confidentiality provisions do not remove individuals’ rights in their personal information.
8.1 Portable Employee Achievements & Badges
Order-Makers may generate Portable Achievement Records for individual Authorized Users based on their participation in the Services.
Portable Achievement Records are distinct from the underlying restaurant operational information and employee performance data used to generate or substantiate them. They may remain associated with an individual's Order-Makers profile after the individual's employment or engagement with a Customer ends, or after that Customer's subscription ends.
The Customer's ownership and confidentiality rights in its underlying data are not affected by the creation or continued existence of a Portable Achievement Record. Neither the individual Authorized User nor any future employer receives access through a Portable Achievement Record to the originating Customer's underlying sales figures, transaction data, menu information, detailed performance data, or other confidential operational information.
An individual Authorized User may authorize a future participating employer to view the individual's Portable Achievement Record. Such authorization does not permit disclosure of the underlying data from any prior employer.
Galaxy Hospitality Solutions may correct, suspend, revoke, or remove any badge, achievement, or other element of a Portable Achievement Record where reasonably necessary to address data errors, incorrect employee attribution, fraud, manipulation, misuse, or the integrity or security of the Services.
Galaxy Hospitality Solutions may from time to time modify the names, categories, levels, visual presentation, criteria, or structure of badges, achievements, milestones, and other elements of Portable Achievement Records as the Services evolve. Where reasonably practicable, Galaxy Hospitality Solutions will preserve the substantive nature and historical significance of achievements previously earned, including by converting or mapping legacy achievements to substantially equivalent current achievements. No Authorized User is guaranteed the continued use of any particular badge name, level, icon, design, classification, or achievement framework.
If an individual Authorized User submits a verified request to delete the individual's Order-Makers profile, Galaxy Hospitality Solutions will delete or irreversibly anonymize the individual's personal information and Portable Achievement Record in accordance with this Privacy Policy and applicable law. This does not require GHS to alter records held independently in the originating Customer’s own POS system. Personally linked information retained within Order-Makers remains subject to Section 30; ownership of operational records does not, by itself, justify retaining identifiable information after an individual account-deletion request.
9. Confidentiality of Restaurant Information
We recognize that restaurant operational information represents confidential business intelligence.
Examples include:
Daily sales
Average cheque values
Menu mix
Food and beverage performance
Labour percentages
Employee productivity
Promotional effectiveness
Pricing strategies
Guest traffic trends
Seasonal performance
Galaxy Hospitality Solutions treats this information as confidential.
Except where required to provide our services, comply with law, or where expressly authorized by the customer, we do not disclose identifiable restaurant operational information to third parties.
10. Point-of-Sale (POS) Integration
Order-Makers integrates with supported Point-of-Sale systems to retrieve operational information required for reporting and analytics.
Current integrations are designed to operate in read-only mode.
This means Order-Makers:
cannot modify POS records;
cannot delete POS records;
cannot create POS transactions;
cannot alter menu information within the POS;
cannot change employee records in the POS.
The platform is configured to retrieve information reasonably necessary to provide, secure, support and improve the requested Services.
Examples of information received may include:
Employee names
Menu items
Sales totals
Check numbers
Table numbers
Guest counts
Discounts
Voids
Transaction timestamps
Other operational reporting information made available through supported POS integrations
Not every POS system provides identical information.
11. Artificial Intelligence (AI)
Order-Makers uses artificial intelligence to help customers better understand restaurant performance and identify opportunities for operational improvement.
The current features use the OpenAI API to generate monthly performance feedback, weekly employee feedback, pre-shift operational notes and daily motivational messages.
AI is intended to support management decision-making and should not replace professional business judgment. Customers remain responsible for reviewing outputs and for employment, staffing, coaching and other decisions they make. AI-generated statements can be inaccurate and should be checked against the underlying information.
11.1 Information Shared with AI Services
These features process selected performance and business information, including performance metrics, scores, sales information and achievements, as needed for the feature. User identifiers, employee identifiers and restaurant identifiers are excluded from OpenAI requests.
Removing direct identifiers does not necessarily make performance information anonymous. We treat information that can reasonably identify or relate to an identifiable individual as personal information.
Before personal information is shared with a third-party AI service, we provide any notice and obtain any consent required by applicable law, taking into account the sensitivity of the information and the reasonable expectations of the individual. This policy does not replace a required in-app disclosure or permission request.
11.2 OpenAI Data Usage
GHS will not introduce a materially different use of personal information through AI without providing the notice and obtaining any additional consent required by applicable law. Section 39 explains notice of material policy changes.
12. Communications
We may use customer contact information to:
Respond to customer inquiries
Provide technical support
Notify customers of service interruptions
Send billing communications
Provide important security notifications
Notify customers of significant platform updates
Customers may also receive service-related communications that are necessary for the continued operation of their accounts.
These communications are considered part of the services provided by Order-Makers.
13. Cookies & Session Management
Order-Makers uses secure technologies to authenticate users and maintain active sessions.
These technologies may include:
Secure HTTP cookies
Authentication session identifiers
Temporary security tokens
Our authentication and session technologies are used for operational purposes including:
Secure login
Session continuity
Authentication
Security protection
13.1 Analytics
At the time this Privacy Policy becomes effective, Order-Makers does not use third-party advertising analytics platforms such as:
Google Analytics
Microsoft Clarity
Meta Pixel
Firebase Crashlytics is used for crash reporting and diagnostics, and Firebase Cloud Messaging supports push notifications. These services process technical information, such as application or installation identifiers, device and operating-system information, notification tokens and crash information, as applicable to the service.
The platform may display embedded YouTube training videos. The embedded provider may receive information directly from the user’s device when its content is loaded or played, such as an IP address, browser or device information and associated identifiers. This processing is distinct from the Order-Makers application’s own collection.
Should these practices materially change, this Privacy Policy will be updated in accordance with Section 39.
14. Email, SMS and Push Communications
Galaxy Hospitality Solutions uses service providers to deliver account verification, password reset, billing, service and security communications required to support the Order-Makers platform.
14.1 SMS Verification
When an individual requests a verification code for registration, sign-in or another verified account action, we use Twilio Verify to send a one-time SMS code to the phone number provided. SMS is used for verification and authentication, not marketing. Message frequency depends on the verification requests made. Standard message and data rates may apply.
The applicable SMS disclosure and consent request are presented before the verification message is sent. Necessary evidence of that request or consent is retained. If you cannot use SMS verification, contact us for assistance with your privacy request; a loss of access to a phone number does not remove your privacy rights.
14.2 Push Notifications
Firebase Cloud Messaging supports optional service-related push notifications. Order-Makers processes the notification token and notification preferences needed to deliver them. Users can manage push notifications through the available app and device settings. Disabling push notifications does not itself delete an account or its information.
15. Translation Services
Where translation features are available, certain customer-selected content may be processed through Google Translate or similar translation services solely for the purpose of providing multilingual functionality.
Translation requests are limited to the content necessary to perform the requested translation.
16. Marketing Communications
We do not use customer operational information for marketing purposes.
Restaurant performance information will never be used in advertising, promotional materials, testimonials, benchmarking studies, or public presentations unless:
the information has been fully anonymized and aggregated; or
the customer has provided explicit permission.
Protecting customer confidentiality remains a core operating principle of Galaxy Hospitality Solutions.
17. Security Overview
Galaxy Hospitality Solutions is committed to protecting customer information using administrative, technical, and organizational safeguards appropriate to the nature and sensitivity of the information.
Our security program is designed to protect customer information against unauthorized access, disclosure, alteration, destruction, or misuse while supporting the reliable operation of the Order-Makers platform.
Although no system can guarantee absolute security, we continually work to maintain safeguards appropriate to the sensitivity of the information entrusted to us.
18. Cloud Infrastructure
Order-Makers uses Amazon Web Services (AWS) for application infrastructure and MongoDB Atlas for the production database.
The production application, primary database and routine database backups are hosted in Canada. This does not mean that all service-provider processing or administrative access occurs in Canada; Section 38 explains international processing and access.
Should hosting locations materially change, this Privacy Policy will be updated in accordance with Section 39.
19. Encryption
19.1 Data in Transit
All communications between users and the Order-Makers platform are encrypted using HTTPS/TLS.
This helps protect information transmitted between customer devices and our servers from unauthorized interception.
19.2 Data at Rest
Customer information stored within Order-Makers is encrypted while stored ("encrypted at rest").
Encryption at rest helps protect customer information in the event physical storage media were ever compromised.
20. Authentication & Password Security
Protecting customer accounts begins with secure authentication practices.
Order-Makers uses phone-number and SMS-code authentication for the mobile applications and username/password authentication for applicable web and administrative accounts.
Passwords are:
Never stored in plain text.
Hashed using bcrypt.
Protected using unique cryptographic salts.
Verified without revealing the original password.
Users are responsible for maintaining the confidentiality of their login credentials and verification codes. Users with password-based accounts should choose strong, unique passwords.
21. Role-Based Access Controls
Access to information within Order-Makers is governed by role-based permissions.
Depending upon the customer's configuration, permissions may include roles such as:
Administrators
Managers
Servers
Non-sales employees
Other customer-defined operational roles
In addition, Galaxy Hospitality Solutions maintains a restricted Super Administrator role for platform administration.
Individual employees can view the employee information made available to them through their account. Managers’ employee-management access depends on assigned permissions. Customer account owners and authorized GHS administrators have broader access to employee information for the customer’s administration of the Services and for GHS support and platform administration. This includes information that is not visible to other individual employees. Administrative access is governed by Section 22.
22. Administrative Access
Access to production systems is restricted to authorized personnel with a legitimate business need.
Examples may include:
Platform maintenance
Technical troubleshooting
Security investigations
Customer-requested support
Disaster recovery
Administrative access is granted according to the principle of least privilege wherever reasonably practical.
23. Database Security
Customer data is stored using MongoDB Atlas.
Production database access is restricted through authenticated connections.
At the time this Privacy Policy becomes effective:
Application servers communicate securely with the production database.
Database credentials are protected.
Direct production database access is restricted.
24. Operational Records and Diagnostics
Order-Makers maintains check and order reassignment records to support the integrity of allocations and reporting. These records can include the affected employees or POS identifiers, the approving administrator and the time of the change.
Firebase Crashlytics provides crash and diagnostic reporting to help investigate errors and improve reliability.
These records are not used for unrelated marketing. Personal information within them is subject to the retention and deletion provisions in Section 30.
25. Backups and Disaster Recovery
Order-Makers maintains encrypted daily database backups for disaster recovery and business continuity. Daily snapshots are retained for two months, and point-in-time recovery is available for the preceding seven days. Backups rotate and expire under that schedule.
Backups are restricted to authorized recovery use. They are not used to continue normal use of deleted accounts. If an earlier backup is restored, completed deletion requests must be reapplied before the restored personal information is returned to normal use.
26. Business Continuity
Galaxy Hospitality Solutions maintains operational procedures intended to:
Recover from infrastructure failures
Restore customer services
Protect customer information
Reduce service interruptions
While interruptions can never be entirely eliminated, reasonable efforts are made to maintain platform availability and recover services promptly following unexpected events.
27. Third-Party Service Providers
Order-Makers relies upon service providers to deliver portions of the Services. The current services identified for the platform are:
Amazon Web Services (AWS): application hosting and infrastructure.
MongoDB Atlas: database hosting, storage and the production backup and recovery configuration described in Section 25.
Cloudsprout: infrastructure administration and technical support, including authorized access from India.
Stripe: subscription billing and payment processing outside the mobile applications.
Postmark: transactional email delivery, which involves recipient contact information, message content and delivery-related records.
Twilio Verify: SMS authentication and verification, which involves phone numbers and verification-related delivery or service records.
OpenAI: the AI processing described in Section 11.
Google Firebase Crashlytics and Cloud Messaging: crash diagnostics and push notification delivery.
YouTube: embedded training-video playback, as described in Section 13.
Google Translate: optional translation functionality described in Section 15.
Silverware is a connected POS source when enabled by a Customer. Information received from that integration is described in Section 10.
Providers receive or process the information necessary for their applicable services. GHS remains accountable for personal information transferred to providers for processing on its behalf and uses appropriate contractual and other safeguards. A provider’s independent activities, where applicable, are also governed by its own privacy terms. Those terms do not remove GHS’s obligations for its own collection, use or disclosure.
Section 38 explains international processing; Section 30 explains retention and deletion.
28. Third-Party Links
Order-Makers may include links to third-party websites or services.
External websites that users choose to visit have their own privacy, security and content practices. This distinction does not remove GHS’s responsibility for its embedded services or providers processing personal information on its behalf.
Customers are encouraged to review the privacy policies of those third parties before providing personal information. Galaxy Hospitality Solutions may update its service providers from time to time and will provide notice of any new provider where required by applicable law or an applicable customer agreement. Any right to object to a new service provider, and the consequences of an objection, will be governed by the applicable customer agreement.
29. Security Responsibilities of Customers
Security is a shared responsibility.
Customers are encouraged to:
Maintain strong passwords.
Protect login credentials.
Limit administrator access.
Promptly remove users who no longer require access.
Keep workstations and devices secure.
Notify Galaxy Hospitality Solutions promptly of suspected unauthorized access.
These measures help reduce the risk of unauthorized use of customer accounts.
30. Data Retention and Account Deletion
Galaxy Hospitality Solutions retains personal information only for as long as reasonably necessary for the identified purposes, including providing the Services, fulfilling applicable legal obligations, resolving disputes and protecting security. Reporting continuity alone does not justify keeping identifiable information indefinitely after an account-deletion request.
30.1 Active Accounts and Ordinary Offboarding
While an account is active, information is retained as needed to provide the applicable services, reporting, support and achievement history. GHS reviews information for continuing necessity rather than treating an active subscription as permission to retain every record indefinitely.
A restaurant’s removal or disabling of an employee’s access is not an individual account-deletion request. An individual’s account and Portable Achievement Record may continue after leaving a restaurant or after that restaurant’s subscription ends, as explained in Section 8.1. Onboarding with another participating restaurant does not, by itself, create a right to disclose a prior restaurant’s confidential operational data.
30.2 Individual Account Deletion
An individual can request deletion in the mobile application under Profile → Settings → Delete Account, or through https://app.order-makers.com/delete-account. The individual confirms the request using phone-number and OTP verification. A person who cannot use these routes can contact us at the address in Section 40 for an appropriate alternative verification process.
Following successful verification and confirmation, GHS will initiate the applicable deletion process and may disable account access while the request is processed, subject to lawful retention, security and fraud-prevention requirements. Authentication and notification tokens are removed or invalidated as appropriate.
The deletion process also removes the stored profile photograph, associated feedback and support-message content, and personal links in performance, achievement, ranking, employment and historical records. The Portable Achievement Record is deleted or irreversibly anonymized. A future registration is treated as a new account and is not linked to the deleted account’s history.
Historical information may remain only if it is genuinely anonymous or falls within a specific lawful retention exception described below. Simply hiding an image, disabling a login or replacing a name while retaining a reconnectable identifier is insufficient.
We provide the expected completion period when a request is made and confirmation when the applicable deletion process is completed. Immediate loss of access does not imply that all provider or backup copies have already expired.
30.3 Customer Subscription Closure
A Subscriber submits a closure or deletion request through the Customer account’s Delete Account option. GHS reviews and approves that request after verifying authority and identifying any lawful retention obligations. Administrative approval is not a basis for indefinite delay or refusal to honor an individual’s applicable privacy rights.
Following verification and approval of a Customer account-deletion request, Galaxy Hospitality Solutions will permanently delete or irreversibly anonymize the applicable Customer Data, subject to specific lawful retention exceptions. We provide the expected completion period and confirmation of completion. Restricted backup copies expire separately under Section 30.6.
Termination does not, by itself, delete existing individual accounts or Portable Achievement Records that continue under Section 8.1. Information retained for those individual accounts is limited to the applicable individual service; it does not give a future employer the former Customer’s underlying operational data.
30.4 Limited Retention Exceptions
Where applicable law permits or requires it, we may retain limited information needed to meet a statutory recordkeeping obligation, protect against fraud or security incidents, establish or defend a legal claim, or demonstrate that a privacy request or consent was handled. For example, a law may require preservation of information used to make a decision affecting an individual so the individual can exercise access rights.
Any such retention is limited to the necessary information, purpose and period. Retained information is restricted from unrelated use and is deleted or anonymized when the applicable purpose expires. We explain an applicable exception in responding to the request unless prohibited by law. A general desire to preserve identifiable reporting history is not a blanket exception.
30.5 Service-Provider Records
Where a provider holds personal information on GHS’s behalf, we use the provider’s applicable deletion tools, instructions or retention controls to carry out the required action. The process depends on the service and the record involved. Providers may retain limited information under applicable legal obligations or justified security and service-integrity requirements; these exceptions must not be used to continue unrelated use of deleted information.
30.6 Backup Copies
Information in restricted recovery backups expires through the schedule in Section 25 rather than necessarily being removed from each snapshot immediately. These copies are not available for ordinary account use. If a backup is restored, previously completed deletions are reapplied as described in Section 25.
30.7 Anonymous Information
Information that satisfies the anonymity standard in Section 4 may be retained for the purposes in Section 35. Information that can still reasonably be linked to a person remains subject to the personal-information retention and deletion rules.
31. Individual Privacy Rights and Requests
GHS offers individuals a process to request access to their personal information, correction of inaccurate information and deletion, subject to applicable legal exceptions. An individual may also ask about how their information is used or disclosed, withdraw consent to processing based on consent, or raise a privacy complaint.
Depending on the applicable law, rights may also include receiving a portable copy, directing an authorized agent to act, appealing a refusal, or opting out of sale, targeted advertising or certain profiling. GHS does not sell personal information or share it for targeted advertising. We do not discriminate against individuals for exercising applicable privacy rights.
31.1 How to Make a Request
Contact the privacy address in Section 40. Individual account deletion is also available through the in-app and web routes in Section 30. Please describe the request and provide enough account information for us to locate the relevant records. Do not send passwords or verification codes by ordinary email.
We verify identity and, where relevant, an agent’s authority using a method proportionate to the request. We ask only for information reasonably necessary for that verification. A restaurant may assist with locating records, but employer assistance is not automatically a condition of exercising an individual’s rights.
31.2 Response and Review
GHS responds to verified privacy requests within the period required by applicable law and may extend that period where legally permitted and reasonably necessary. We comply with any applicable shorter deadline and provide any legally required acknowledgment or extension notice. This target does not replace the statutory rules or promise that every type of request can always be completed within thirty days.
If we cannot grant a request in whole or in part, we explain the reason and any available review or appeal process, unless law prevents us from doing so. To request a review or an applicable appeal, contact the same privacy address and identify the response you wish to challenge. We will handle the review within the applicable legal period.
You may also complain to the relevant privacy regulator. Canadian individuals may contact the Office of the Privacy Commissioner of Canada at www.priv.gc.ca or the relevant provincial commissioner. United States individuals may contact their applicable state Attorney General or privacy regulator. Contacting GHS first does not remove a right to approach a regulator.
31.3 Employer Records and Confidential Information
These rights apply, where applicable, to personal information in an individual’s profile, performance records and Portable Achievement Record. A Portable Achievement Record does not itself provide access to the originating Customer’s confidential underlying operational data. However, customer confidentiality cannot be used to deny access to personal information where the law requires access. We separate or redact other people’s information and protected business information only as permitted by law.
Where a Customer controls the relevant employment record and GHS processes it on that Customer’s behalf, we coordinate the request with the Customer as appropriate, without removing GHS’s own obligations. Records maintained independently in a restaurant’s POS system may require a separate request to that restaurant.
Withdrawal of consent may affect features that depend on the information. We explain the effect where applicable; withdrawal does not necessarily require erasure of records lawfully retained under Section 30.
32. Accuracy of Information
Customers are responsible for ensuring that information they provide to Order-Makers is accurate and current.
Customers may update account information at any time through authorized administrators or by contacting Galaxy Hospitality Solutions.
Maintaining accurate information helps ensure reliable reporting and platform performance.
33. Customer Responsibilities
Customers are responsible for:
Maintaining the confidentiality of account credentials.
Assigning appropriate user permissions.
Removing users who no longer require access.
Using the platform in accordance with applicable laws.
Ensuring that any information submitted to Order-Makers has been collected lawfully.
To the fullest extent permitted by applicable law, Galaxy Hospitality Solutions is not responsible for loss, harm or liability arising from customer misuse of the platform, a Customer’s failure to provide required notices or obtain required authority, or inaccurate, unlawful or unauthorized information supplied by or on behalf of a Customer, except to the extent caused by GHS’s breach of applicable law.
Customers are also responsible for appropriate notices to their employees, lawful use of workplace performance information and limiting authorized users to adults. These responsibilities do not remove GHS’s own obligations under applicable privacy law.
34. Data Confidentiality Commitment
Galaxy Hospitality Solutions recognizes that the information entrusted to Order-Makers often includes confidential commercial information that extends beyond traditional personal information.
This may include:
Revenue trends
Pricing strategies
Labour costs
Sales performance
Menu engineering
Promotional effectiveness
Employee performance
Operational processes
We treat this information as confidential business information.
Except as required to provide the services, comply with applicable law, protect the security of the platform, or with the customer's authorization, Galaxy Hospitality Solutions will not knowingly disclose identifiable customer operational information to other customers or third parties.
35. Aggregated and Anonymous Information
Galaxy Hospitality Solutions may generate anonymous statistical information to better understand hospitality industry trends and improve the Order-Makers platform. This may include restaurant-level statistics or records derived from individual activity, but only where individuals cannot reasonably be identified or reconnected to the retained information.
Such information may be used for product development, industry benchmarking, market research, educational content and marketing materials. GHS does not attempt to reidentify individuals from information retained as anonymous and requires equivalent protections where applicable when disclosing such information.
Before external publication, GHS applies reasonable measures designed to prevent individuals and individual restaurants from being reasonably identified from the information, taking into account reasonably available information and applicable law. Where a restaurant could reasonably be identified, GHS obtains the Customer’s prior authorization before publication. A Customer’s authorization does not replace an individual’s consent where consent is required for disclosure of that individual’s personal information.
If effective anonymization is unavailable for a category of personal information subject to deletion, that information is deleted unless a specific lawful retention exception applies. Retaining anonymous analytics is optional; it is not a reason to postpone required deletion.
36. Applicable Canadian and United States Privacy Laws
Galaxy Hospitality Solutions is committed to complying with applicable privacy legislation governing the collection, use, disclosure and protection of personal information.
This includes, where applicable, Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), applicable provincial private-sector privacy legislation, and applicable United States federal and state privacy requirements.
The law that applies can depend on the location of the individual, the nature of the information and relationship, the role of GHS and its Customer, and statutory applicability thresholds. The rights process in Section 31 is available even where a particular state privacy statute does not apply. It does not limit additional rights provided by law.
The decision not to onboard Quebec restaurants does not exclude a law that otherwise applies. As our operations or applicable legislation change, GHS reviews its practices and provides any additional notices required.
37. Adult Users and Children’s Privacy
Order-Makers is designed for adult users in the hospitality industry. Individual Authorized Users must be at least eighteen (18) years old, and Customers must not authorize younger individuals to use the Services.
GHS does not knowingly seek to collect personal information from children. If we learn that personal information has been collected contrary to this restriction, we investigate and take appropriate action, including deletion where required. Customers should not submit information about ineligible employees to Order-Makers merely because that information exists in their POS system.
Contact us using Section 40 if you believe that information about an ineligible individual has been included.
38. International Processing and Access
The Canadian hosting arrangement for the production application, primary database and routine database backups is described in Section 18. Canadian storage does not mean that every provider or person processing information is located in Canada.
Service providers may process information in the United States or other countries as necessary for AI, messaging, email, payment processing, diagnostics, video playback or translation. Authorized infrastructure administration and support can involve access from India through Cloudsprout.
Information processed or accessed in another jurisdiction may be subject to that jurisdiction’s laws and lawful access by its courts, law enforcement or other public authorities. GHS uses appropriate contractual and other safeguards for processing on its behalf and remains responsible for the protection required by applicable law.
For information about our practices concerning service providers outside Canada, contact the privacy contact in Section 40. Section 41 describes our handling of government requests. We do not promise that Canadian storage alone prevents foreign legal access.
39. Changes to this Privacy Policy
Galaxy Hospitality Solutions may update this Privacy Policy from time to time to reflect:
Changes in technology;
New platform features;
Changes to third-party service providers;
Security improvements;
Changes in applicable law; or
Operational requirements.
The "Effective Date" at the beginning of this Privacy Policy will be updated whenever material revisions are made.
Galaxy Hospitality Solutions will provide notice of material changes to this Privacy Policy as required by applicable law or an applicable customer agreement, which may include advance notice where appropriate to the nature of the change. Any Customer objection right regarding a material change will be governed by the applicable customer agreement and applicable law. If a customer objects to material changes, Galaxy Hospitality Solutions will work with the customer to address concerns. If no resolution is reached, any termination right and resulting fees or obligations will be determined under the applicable customer agreement.
Where a change requires fresh consent, GHS obtains that consent before the new processing begins. An update email or continued use is not treated as a substitute for consent where additional consent is legally required. GHS retains dated versions of this policy and related notices.
40. Contact Information
Questions regarding this Privacy Policy or our privacy practices may be directed to:
Galaxy Hospitality Solutions
Order-Makers Privacy Team
Email: info@order-makers.com
We are committed to responding to privacy-related inquiries in a timely and professional manner.
41. Law Enforcement and Government Requests
To the extent legally permitted, Galaxy Hospitality Solutions may notify an affected Customer of a binding law enforcement or government demand for that Customer’s data when GHS reasonably determines that notice is appropriate, taking into account legal, security and operational considerations. Galaxy Hospitality Solutions may challenge a request that it reasonably believes is unlawful or materially overbroad when GHS determines that a challenge is appropriate and proportionate in the circumstances. Only the minimum data necessary to comply with valid legal obligations will be disclosed.