Who this covers
- Workspace users: business owners and the members they add to the dashboard. For your account data, Ordre is the controller.
- Clients: people who receive a board link from a business using Ordre. The business decides what to record about you and is the controller of that data; Ordre processes it on the business’s behalf. For questions about your data on a board, contact the business first. We’ll help them respond.
- Website visitors: anyone browsing
ordre.appand its subdomains.
What we collect
| Source | What | Why |
|---|---|---|
| You, at sign-up | Name, email, optional phone number, password (stored only as a hash), industry, business type and name | Create and secure your account and workspace |
| You, in settings | Business contact details, locations, logo, brand colour, working hours, notification preferences | Run your workspace as you configure it |
| Businesses, about clients | Client name, company, email or phone, address, job details, serial numbers or plates, photos, updates, approvals and messages | Show the board to the client and the business’s team |
| Clients, on a board | Approval responses, chat messages, reschedule requests | Deliver them to the business |
| Automatically | IP address, browser and device type, session records, request and error logs | Keep accounts signed in, prevent abuse, fix problems |
| Analytics | Page views and events, without cookies or cross-site tracking | Understand which pages and features are used |
| Billing, once launched | Plan, billing email, invoices. Card details go directly to Stripe; we never see or store them | Charge for paid plans |
When a client verifies their identity on a board, we compare the email or phone they enter with what the business registered. We don’t store the value they typed; we may log whether the attempt matched.
Don’t put health, financial account, or government ID information on boards. Ordre isn’t designed for it.
How we use it
- To provide Ordre: accounts, boards, notifications, messaging and support.
- To send service emails and texts, such as verification codes, password resets, board links and board notifications.
- To send product news and onboarding tips to workspace users. Every such email has an unsubscribe link.
- To keep Ordre secure: rate limiting, fraud and abuse prevention, debugging.
- To meet legal, tax and accounting obligations.
We don’t sell personal information, share it for cross-context behavioural advertising, or use customer content to train AI models.
Where a law such as the GDPR or Brazil’s LGPD requires a legal basis, we rely on performing our contract with you, our legitimate interest in running and securing the service, your consent (for optional emails, which you can withdraw), and legal obligations.
Where it’s stored
Ordre is operated from Brazil. Our providers store data mainly in the United States and process it in other countries where they operate. Information may therefore be processed outside your country, including outside Brazil or the EU. We rely on our providers’ contractual safeguards, such as standard contractual clauses, for those transfers.
How long we keep it
- Account and workspace data: while the workspace exists. After you close it, a 30-day grace period, then deletion.
- Boards: until the business deletes them or the workspace is deleted. Archived boards stay viewable by their link until then.
- Security and request logs: up to 90 days.
- Billing records: as long as tax law requires, typically 5 years under Brazilian tax law.
- Backups: overwritten on our providers’ normal backup cycle.
How we protect it
All traffic uses HTTPS. Passwords are hashed and never stored in plain text. Database access is limited to the Ordre API, and secrets are redacted from logs. No system is perfectly secure; if a breach affects your information, we’ll notify you and the relevant regulators as the law requires.
Your rights
Depending on where you live (for example under Canada’s PIPEDA, Quebec’s Law 25, Brazil’s LGPD, the GDPR, or US state privacy laws), you may have the right to:
- access the personal information we hold about you, and get a copy;
- correct it;
- delete it;
- object to or restrict some uses, or withdraw consent;
- move it to another service;
- complain to your data protection authority.
Workspace users can edit most data directly in the dashboard. For anything else, email legal@ordre.app. We’ll respond within 30 days and may need to verify your identity. Clients should contact the business that shared their board; if you can’t reach them, email us and we’ll pass your request on.
Children
Ordre is for businesses and isn’t directed at children. Workspace users must be adults. If a child’s information was added to a board, contact the business or us and we’ll help remove it.
Changes
We’ll post updates here and change the effective date. For material changes we’ll tell workspace owners by email or in the dashboard before they take effect.
Contact
Privacy questions and requests: legal@ordre.app. The person responsible for personal information at Ordre (Quebec Law 25 privacy officer and LGPD encarregado) is Ian Welerson.