Privacy notice

1. Who we are

Ordstage is an AI assistant and team inbox that businesses use to talk to their customers on WhatsApp, Instagram, Messenger and website chat. In this notice “Ordstage”, “we” and “us” mean Ordstage Ltd.

Send any question about this notice, or any request about your personal data, to privacy@ordstage.com.

2. Our two roles

We handle personal data in two different roles, and this notice treats them separately.

• As a controller, we decide how and why we use personal data about the people who sign up for and use Ordstage, pay for it, contact us, or visit our website. Sections 3 to 10 cover this data.
• As a processor, we handle data for the businesses that use Ordstage (our customers): the conversations their customers have with them, and the contact details, orders, bookings and leads that come out of those conversations. The business is the controller of that data and decides how it is used. Section 11 explains what that means for you.

3. Data we collect about you

When you sign up

Your name, email address, password, business name and, if you give them, your website, industry, team size, country, phone number and a note about what you want to do with Ordstage. We record when you accepted our terms, the code we email to confirm your address, and how you found us (campaign tags in the link you followed and the site that referred you). We store your password only as a one-way hash.

When you use Ordstage

• Your profile, role and the workspaces you belong to, and invitations you send or receive.
• Sign-in data: the browser and IP address of each signed-in session (you can see and end them under Settings, Security), two-factor login settings and recovery codes.
• An audit log of changes made in a workspace, such as who changed settings, members, assistants or channels.
• Your notification preferences and the messages you send to our support team.

When you pay

Your plan, invoices, credit purchases and billing contact. Card payments are handled by Stripe; we do not see or store full card numbers. If you installed Ordstage from the Shopify App Store, Shopify bills you and tells us your plan and charges.

When you visit our website

• Analytics. On some pages of ordstage.com (such as the home, pricing and sign-up pages) we use Google Analytics to count page views. We send the page address and title and the website that referred you, with Google signals and ad personalisation turned off. Google Analytics sets cookies in your browser, and it loads only after you accept it in the cookie banner. It does not run inside the Ordstage app.
• Bot protection. The sign-up form uses Cloudflare Turnstile, which checks signals from your browser and your IP address to tell people from bots.

4. Cookies and similar storage

• Strictly necessary: a secure, HTTP-only cookie that keeps you signed in to the app, and storage in your browser for your sign-in session and display settings (such as light or dark theme).
• Analytics: Google Analytics cookies on the marketing pages listed above, only if you accept them. You can change your answer at any time with "Cookie settings" at the bottom of every website page.

You can block or delete cookies in your browser settings. Blocking the strictly necessary ones will sign you out of the app.

5. Why we use your data, and our legal bases

We do not sell your personal data, and we do not use it for automated decisions that have legal or similarly significant effects on you.

6. Who we share it with

• Service providers that run parts of Ordstage for us, such as hosting, email delivery, payments and AI models. Business customers can ask us for the full list at privacy@ordstage.com.
• Other members of your workspace, who can see your name, role and the actions you take there.
• Professional advisers, and authorities when the law requires it.
• A buyer or successor if our business is sold or reorganised, under the same protections.

7. International transfers

Several of our providers are based in the United States or process data there. When personal data leaves the UK or the European Economic Area, we rely on an adequacy decision or adequacy regulations where one applies (for example the UK Extension to the EU-US Data Privacy Framework for certified providers), or on the European Commission’s Standard Contractual Clauses together with the UK International Data Transfer Addendum, or the UK International Data Transfer Agreement. Ask us at privacy@ordstage.com for a copy of the safeguards that apply.

8. How long we keep it

• Account and workspace data: while your account is open, then deleted or anonymised after it is closed, except what we must keep for the reasons below.
• Billing and tax records: as long as tax and company law requires (in the UK, generally six years).
• Sign-in sessions expire on their own, and you can end any session at any time.
• Data exports you download from Ordstage are deleted from our storage 24 hours after they are ready.
• Records we need to defend a legal claim: until the claim is resolved.

9. Your rights

Under the UK GDPR and the EU GDPR you can ask us to:

• give you a copy of your personal data (access);
• correct data that is wrong (rectification);
• delete your data (erasure);
• limit how we use it (restriction);
• stop using it where we rely on legitimate interests (objection);
• give you your data in a machine-readable format (portability);
• withdraw your consent at any time, where we rely on consent.

Email privacy@ordstage.com. We reply within one month, and we may ask you to confirm your identity first. These rights have some legal limits, and we will tell you if one applies.

You can also complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint. If you are in the European Economic Area, you can complain to the data protection authority where you live or work. We would appreciate the chance to sort out your concern first.

10. How we protect it

Data is encrypted in transit. Passwords are stored as one-way hashes, and channel and integration credentials are encrypted in our database. Access inside a workspace is controlled by roles, owners can require two-factor login for every member, and changes are recorded in an audit log. The data processing agreement lists our security measures in more detail.

11. If you are a customer of a business that uses Ordstage

When you message a business on WhatsApp, Instagram, Messenger or its website chat, and it uses Ordstage, we process your messages, name, contact details and any order, booking or enquiry on that business’s behalf. AI models may read your messages to write replies, and the business’s team can read the conversation.

That business is the controller of your data, and its own privacy notice explains how it uses it. To use your rights, contact the business directly. If you contact us, we will pass your request to the business and help it respond. Businesses can, for example, look up and delete what their assistant remembers about a customer and export their records, and they can ask us to delete other data.

12. Children

Ordstage is a service for businesses. It is not meant for anyone under 18, and we do not knowingly collect their data as a controller.

13. Changes to this notice

We will update this notice when the way we handle personal data changes, and change the “Last updated” date at the top. If a change matters to you, we will tell you by email or in the app before it takes effect.