Privacy Policy

Section 1Who we are and who this covers

PostOrder is operated by Lion Tech Innovations Ltd, registered in England & Wales, Company No. 17068390. In this policy, “we” means Lion Tech Innovations Ltd when providing PostOrder.

This policy covers website visitors, merchants and business account users, their authorised staff, buyers using order links, recipients using confirmation links and people contacting support. It describes PostOrder specifically; other LionTech products have their own notices.

Section 2Who is responsible for the information

We are generally the controller of account, website, support, subscription and service-administration data: we decide why and how that information is used to run PostOrder.

The merchant is normally the controller of customer and order information it enters. We generally process that transaction data on the merchant’s instructions to provide the service. Roles can depend on the purpose and circumstances; we may separately act as controller where processing is needed for our own security or legal obligations.

Merchants must have an appropriate basis for entering and sharing personal information, give their customers relevant privacy information and handle requests concerning their records. Contact the merchant first about its order data; we can help route a request and support the merchant’s response.

Section 3Information we may process

• Account names and email addresses, authentication information, authorised-user roles and account settings.
• Business profiles, contact information, logos and service settings supplied by the merchant.
• Buyer names and contact details, recipient details where supplied, order items, quantities, amounts, currency and delivery or collection information.
• Transaction references, payment claims and uploaded claim evidence, merchant payment confirmations and connected-provider status information.
• Fulfilment updates, merchant-reported delivery, recipient acknowledgements and the record of changes to an order.
• Support correspondence and information provided when reporting a problem.
• Technical and security information such as IP addresses, device/browser information, request times, session activity and error or abuse records.
• Subscription and billing metadata such as plan, billing-provider identifiers, payment/subscription status and relevant billing dates.

Information can come from you, the merchant, another authorised participant, connected payment services or your use of PostOrder. A recipient may therefore receive a link for a record created by the merchant or buyer rather than creating an account themselves.

Only provide information needed for the transaction. Avoid unnecessary identity documents, sensitive personal details or information about children. Do not upload material you are not entitled to share.

Section 4Payment information has limits

PostOrder may connect to payment providers. Where a processor handles card payment, card details are entered into that processor’s payment flow and its terms and privacy notice also apply. PostOrder is not a bank, escrow service or money-transfer service.

Full card numbers, security codes, banking passwords and one-time authentication codes must not be stored in PostOrder notes, uploads or support messages. Remove unrelated financial information from evidence before uploading it. If sensitive information was included accidentally, contact the merchant and support promptly.

Section 5Why we use data and our legal bases

We use service data to authenticate users, create and share order records, show transaction status, support fulfilment and acknowledgement, administer subscriptions, answer support requests, improve the service, protect accounts, prevent abuse or fraud and meet legal obligations.

• Contract: where processing is needed to provide the service you have asked for, manage your account or administer your subscription.
• Legitimate interests: where appropriate, for service security, abuse prevention, operational support and improvement. These interests are balanced against the rights and interests of the people concerned.
• Legal obligation: where records or disclosures are required by applicable law.
• Consent: where a particular optional use requires it. You can withdraw that consent without affecting earlier lawful processing.

For merchant-controlled transaction data, the merchant determines its applicable basis and instructions. Required account and transaction fields let us provide the relevant feature; leaving them out may prevent that action from being completed.

We do not sell personal information to advertisers. Order status changes are service records, not automated decisions about a person’s legal rights or creditworthiness.

Section 6Who can see information

Authorised merchant users can access the business and order information their role permits. Buyer links show the order and payment-status information intended for that buyer. Recipient-only confirmation links show a narrower delivery/receipt view and do not include private payment evidence.

When one person is both buyer and recipient, a combined customer link can include the buyer’s information as well as receipt confirmation. Treat any order link as private: a person who receives or is forwarded a working link may be able to use its permitted view. Do not publish it or forward a buyer link where only recipient access is needed.

Authorised PostOrder personnel and service providers may process information where needed to operate, secure, administer or support the platform. Tenant and link-access controls are used to separate merchant records and participant views; this is not a guarantee that a user cannot disclose information themselves.

Section 7Service providers and international processing

PostOrder uses service providers for hosting, authentication, databases, file storage, email/support and billing. The service uses Vercel and Supabase infrastructure and Stripe for PostOrder paid-plan billing. Customer order payments are made directly to the merchant outside PostOrder; PostOrder stores the payment claim and evidence the customer chooses to submit for merchant verification.

We may disclose information where lawfully required, to address abuse or protect legal rights, or as part of a business transfer with appropriate protection for affected information. We do not grant another merchant access to your business records simply because it also uses PostOrder.

Providers and authorised participants may be outside the UK. Where UK international-transfer rules apply, an appropriate legal basis and safeguards are required, such as an adequacy arrangement or approved contractual safeguards. Contact us for information about the locations and safeguards relevant to your data; this policy does not promise UK-only storage.

Section 8Cookies, browser storage and worksheets

Authentication cookies and similar session information support sign-in and security. Browser storage can remember interface preferences. You can manage cookies and local storage through your browser, although disabling essential features may prevent sign-in or normal operation.

The installable app provides a public offline notice when a connection is unavailable. It does not make private orders, receipts or payment proofs available offline through the app’s service-worker cache.

The public Zimbabwe library worksheets keep entries in the current page and let you download a text file. Those entries are not submitted by the worksheet and are lost on reload. A downloaded copy is then under your control. We do not use advertising trackers in the PostOrder public page experience.

Section 9How long information is kept

Retention depends on the record and its purpose, rather than one fixed period for everything. Relevant factors include whether an account or order remains active, the merchant’s instructions, support needs, disputed transactions, security investigations and accounting or other legal requirements.

Account closure or subscription cancellation does not necessarily erase every record immediately. Some information may need to be retained for a valid legal or operational reason. Where deletion is appropriate, recovery copies may remain until the relevant backup cycle expires and should not be restored for ordinary use without applying the deletion again.

Ask the merchant about its customer/order retention and contact us about account or service records. We do not promise an automatic deletion deadline that the service has not implemented.

Section 10Keeping information secure

Controls include encrypted transport, authentication, merchant and role-based access restrictions, scoped order links and restricted payment-proof storage. Access is intended to be limited to what is needed for the relevant purpose. Security and abuse checks support these controls.

No internet service is risk-free. Protect your account, use only authorised staff access and keep order links private. Report suspected disclosure or unauthorised access using the contacts below. We assess incidents and make notifications where required by applicable law.

Section 11Your privacy rights and complaints

Depending on the applicable law and processing basis, you may request access, correction, deletion, restriction or a portable copy of your personal data. These rights have conditions and exceptions, including where information must be kept by law.

We may need to confirm your identity and authority before sharing or changing records. Requests concerning merchant-controlled order information may need to be handled by the merchant, with our assistance. We respond under the applicable legal requirements.

You can raise a concern with us and have the right to complain to the UK Information Commissioner’s Office. See the ICO complaints page. Other local supervisory rights may also apply.

Section 12Contact and policy changes

Support and privacy requests: support@liontechinnovations.co.uk.

Website/app corrections and PostOrder enquiries: postorder@liontechinnovations.co.uk.

Describe the issue and provide a safe reference that lets us identify it. Do not email passwords, card security codes or private payment evidence. We will explain if further information is needed through an appropriate channel.

We update this notice when the service or our processing changes. The date at the top identifies the current published version; material changes are communicated as required.