Privacy
How the data is handled.
Whose data this is
The platform holds Creative Cuisine Group’s operational data — sales, inventory, documents, and the accounts of the people who use it. That data belongs to the group. Orkids Technologies operates the system on its behalf and does not sell, share, or repurpose it.
Who can see what
Access is enforced at the database with row-level security: every query is filtered by the signed-in user’s role and branch scope. A branch manager sees their branch; an owner sees the group. There is no view that bypasses these rules.
Where it lives
Application data is stored in Postgres on Supabase. Original document photographs are kept in a private storage bucket, reachable only through short-lived signed URLs. Credentials and API keys are held as encrypted environment secrets, never in the codebase.
Messaging
WhatsApp messages exchanged with the platform are processed to extract documents and answer questions. Media is copied into the group’s own storage rather than left on the messaging provider, and inbound requests are signature-verified.
Data residency
Application data is hosted on Supabase in the ap-southeast-1 (Singapore) region — the nearest production region to Cebu. Keeping data in-region means low latency for the people using it and a clear, single jurisdiction for where it physically lives.
Regulatory alignment
We handle personal data in line with the Philippine Data Privacy Act of 2012 (RA 10173) and the principles of the National Privacy Commission, and we apply GDPR principles — lawful basis, data minimisation, and the rights of access, correction, and erasure — wherever they are relevant.
Third-party trackers
None. This site and the platform run no third-party analytics or advertising trackers — no Google Analytics, no Hotjar, no Segment, no Mixpanel, and no advertising pixels. The only data we hold is the operational data the business puts in.
Contact
Questions about how data is handled go to hello@orkids.ph.