Privacy and your data.

What we keep

We store your account name, email, password hash, venue and team details, roles and permissions. We also store the supplier contacts, products, account references, prices, orders, stocktakes and invoice information you add or capture. Invoice records can include extracted document text, names, addresses and account or banking details.

We use this information to provide ordering, review, team access, recovery and support. Activity and security records help us diagnose problems and protect access. Passwords are salted and hashed; we do not store your account password as readable text.

Where information goes

The current hosted service is on Render in Singapore. Authorised service operators can access stored information for operation and support; this is not end-to-end encryption. Resend sends verification, invitation and recovery emails and processes the recipient address and email content. Its published security information describes storage in the United States.

Supplier websites operate independently. Their pages handle supplier sign-in, baskets and payment details under their own policies. OrderSprig does not implement a payment-card store, but invoice text may contain financial information.

Optional AI assistance

AI tools ask permission to send selected information through OrderSprig to DeepSeek. Catalogue tools send product identifiers, names, brands, packs and categories rather than account prices or credentials. Other tools may send supplier About text, your help question, order quantities, product evidence or invoice text and images. Review and redact sensitive information before sending an invoice or free text.

Enabling AI navigation help authorises up to three guidance requests per scan using observed navigation labels and page paths. Suggestions need review; AI does not receive permission to place orders.

We have not established a contractual no-training or zero-retention guarantee for this integration. Do not assume AI input stays in Australia or is immediately deleted. You can use manual workflows without enabling AI.

Your device and shared catalogues

Supplier browser profiles can retain sign-in cookies on the Windows device. Use separate Windows accounts on shared computers. A failed-save draft is protected with encryption in updated clients and can be recovered by the same authorised staff account. Older clients may have left readable drafts until that account opens the updated app and migrates its own draft. Supplier sessions are not automatically erased by signing out of OrderSprig.

Shared catalogue contributions require explicit submission and review. Shared product fields exclude your account prices, private invoices, credentials and account URLs. Eligible product photos use a shared cache.

Retention, access and removal

Operational records are retained to provide the service and its history. Removing a team member disables access; archiving a venue preserves its records. Neither action erases personal information. Backup copies and exports may retain older information. A complete automated account-erasure process and fixed retention schedule for every record type are still being developed.

To request access, correction, export or deletion, email shinybrew@outlook.com. We will verify your authority and explain what can be removed, what needs to be retained and how backups are affected. Please do not send passwords, API keys or payment-card details. You can also contact us there about a privacy concern.

Security and service providers

We use HTTPS, server-side venue and staff permissions, password hashing and backups. No service can guarantee absolute security. Some protections require an updated Windows app. We will revise this notice when data practices change.

Provider information: Render storage, Resend security, DeepSeek Open Platform terms.