Privacy policy
How we handle your personal data.
Last updated
1. Launch and early-access updates
If you use our coming-soon interest form, we store your first name, email and whether you want to buy, organise, or both. Last name, country and your reason for being interested are optional. Your permission covers emails about launch and early access. It does not create an account or place an order.
We keep these details in Convex for up to 365 days, then delete them in regular batches. Only deployment administrators can review the list. Email support@mygrouporders.com to withdraw permission, request a copy or have your entry removed. We confirm email ownership before sending invitations or campaigns.
Cloudflare Turnstile checks the form for automated submissions. Cloudflare processes technical browser and network information for that security check. Form fields are stored by MyGroupOrders; we do not send them to Turnstile.
2. Who we are
MyGroupOrders is run from the United Kingdom and is the data controller for the account, order and payment records described here. Write to support@mygrouporders.com for anything about your data. Each group order manager (GOM) is a separate independent seller and is a controller for what they do with your delivery details once you have joined their order.
3. What we collect
- Account: email address, password (stored as a hash by our authentication provider), display name, optional contact handle and profile photo. If you sign in with Google we receive your name, email and Google account id.
- Orders: which group orders you joined, the items and preferences you chose, notes you wrote to the GOM, and the terms version you accepted.
- Payments: what you owe and have paid, and for online payments the Stripe references, the payment method type and a fingerprint of the card or bank account. We never see or store card numbers.
- Delivery: your saved shipping address and phone number, the address copied onto each parcel, tracking numbers and any photo you attach when confirming delivery.
- Storefront (GOMs only): handle, public bio and Stripe Connect account status.
- Records: an audit log of actions on your account and orders, notification history and whether each email was sent.
4. Why we use it
To run the service you signed up for: showing GOMs who ordered what, taking and releasing payments, packing and shipping parcels and telling you what is happening. This is performance of our contract with you. We also keep payment and dispute records to meet tax and financial rules (legal obligation), and use account and payment fingerprints to spot people returning after a chargeback or ban (legitimate interest in preventing fraud). We do not use your data for advertising and do not sell it.
5. Who sees it
- GOMs whose orders you join see your display name, contact handle, what you ordered, what you have paid, and your delivery address and phone number once they pack for you. They may keep a private note about you across their own orders. Other GOMs and other buyers never see any of this.
- Other buyers see only the number of people in a group order, never names.
- Service providers that process data for us: Convex (database), our web hosting provider, Stripe (payments, with its own privacy notice), Resend (email delivery), Google (sign-in), and PostHog (optional analytics, technical error reports and session recordings when you allow them).
- Nobody else, unless the law requires it or you ask us to.
6. Where it is stored
Storage locations depend on the regions selected for our database, web hosting and service providers. We will confirm the production locations and applicable international transfer safeguards before opening the service to users. Stripe processes payments under its own privacy notice.
7. Technical error reports
If you allow analytics, PostHog receives technical reports of browser errors to help us fix failures. Reports contain an error category, compiled code location, application version and page category. We remove raw error messages, account details, order references, URL parameters and interaction history. Reports use the same random browser identifier as analytics. Recordings require your separate permission and remain limited to the demo and Explore. The provider receives your IP address as part of the network request; we disable IP enrichment in our SDK configuration.
8. How long we keep it
- Account details until you delete your account.
- Order, payment, refund, parcel and dispute records for as long as tax rules and chargeback windows require, which in the UK can be up to six years after the order. After you delete your account, account details and your saved address are removed. Addresses copied onto existing parcels and delivery evidence remain in the order history for recordkeeping and disputes.
- Packing and supplier proof that a GOM has deleted is hidden from everyone and kept only for fraud, chargeback and dispute investigation.
- Notification and email history until you delete your account.
9. Your rights
You can see and correct your profile and address on your account page at any time. From the same page you can download a copy of everything we hold about you, turn off email updates, and delete your account. Deletion removes your account email, name, photo, saved address, contact handle, inbox, GOM notes about you and every way to sign in. Order and payment records, parcel address snapshots and delivery evidence stay for the periods above. Deleting your saved address does not remove the address already copied onto a parcel.
Deletion waits while a group order you joined is still running, a payment is due, a parcel is on its way or a refund is pending, so that the GOM can still finish your order. If you cannot sign in, email support@mygrouporders.com from the address on the account and we will do it for you.
You also have the right to object to or restrict processing and to complain to the Information Commissioner’s Office (UK) or your local supervisory authority (EEA). We would rather hear from you first.
11. Optional analytics and recordings
With your permission, PostHog receives page categories, actions such as starting checkout, browser information and a random browser identifier. We use this to understand which steps people use, where they leave and whether they return on the same browser. We do not send your account id, name, email, address, order contents, payment details, search terms or the full page URL. We disable IP-based location enrichment. Analytics are optional and rely on your consent.
Session Replay helps us find usability problems by recording clicks, scrolling and page changes. It starts only when you allow both analytics and recordings, either through Allow all or by saving those preferences. Recordings cover only the landing page and Explore. Text and inputs are masked; images, private workspace screens, sign-in, account and checkout screens are excluded. Recordings do not include console messages, request headers or request bodies. PostHog processes this information in the region configured for our project, under its data-processing agreement and applicable international transfer safeguards.
Rejecting optional analytics stops future collection and clears the analytics identifier on this browser. Turning off Session Replay alone stops future recordings while leaving analytics on. Changes also apply to other open tabs on the same site. Your choice is specific to this browser and site, including subdomains. It does not delete information already received by PostHog, which follows the project's retention settings. Contact support if you want to ask about retained analytics data. We do not link this browser identifier to your account.
12. Children
MyGroupOrders is for people aged 16 and over. If you believe a younger person has created an account, tell us and we will remove it.
13. Changes
When this notice changes materially we will update the version above and tell signed-in users through the site. Read it with the buyer terms and, if you run orders, the GOM terms.
Questions about this policy? Email support@mygrouporders.com.