Sure! Your method will work just fine, and it's certainly reasonable considering your options.
But, you will want to find a clever way to store your data (away from the prying eyes of mere mortals). If a database (like MySQL) is available, then that would be my first choice. Have your "order retrieval" script be password protected too.
If that is not an option, you could certainly store your data using
Storable. Save a hash of the records in a Storable file. That way no one can read your records as plain text.
Keep in mind that these aren't fool proof options. But, what is? :)