Privacy Policy

This policy explains what personal data OrdaBook handles, why, who we share it with, how long we keep it, and the rights you have. We’ve written it in plain English. If anything is unclear, write to privacy@ordabook.com.

Who we are

OrdaBook is a product of ORDABOOK TECHNOLOGY SERVICES, a business name registered in Nigeria with the Corporate Affairs Commission (BN 9910686), at No. 2, Dr Howard Edafe Street, Ilasan, Lekki Phase 2, Lagos, Nigeria. “OrdaBook”, “we” and “us” mean it.

For privacy and data requests, write to privacy@ordabook.com. For anything else, write to support@ordabook.com.

Who is responsible for which data

OrdaBook is used by custom-order businesses, such as tailors, bakers and carpenters.

• Your account (owners and staff): OrdaBook decides how your account data is used, so we are its controller. This covers your name, email address, phone number, password and PIN (stored only as one-way hashes), your photo if you add one, the devices you sign in on, your language, what you state about your age, and your own work record.
• A business’s records: each business owns the records it keeps in OrdaBook about its customers: names, phone numbers, measurements, orders, photos and payments. The business is their controller, and OrdaBook processes them on the business’s behalf and on its instructions, to run the service.
• If you’re a business’s customer: please contact the business first about your details. It decides what it records about you, and can correct or delete it. If you can’t reach the business, write to us and we’ll help where we can.

What we collect, and why

Your account

• Your name, and the email address and phone number you sign in with, to create your account, sign you in, and send codes, invites, password resets and notices about your account.
• If you’re the first owner of a business on OrdaBook, someone at OrdaBook may also email you a tip now and then on getting more from it, in your language. It uses your first name and your business’s name. You can stop tips at any time, with the link in any tip, your mail app’s own unsubscribe button, or the Tips From OrdaBook switch in Account; everything else still comes. Until your account is deleted, we keep a record of each tip sent, of when you stopped or restarted them, and the random key their stop link uses.
• Your password and PIN, kept only as one-way hashes (argon2id). Nobody at OrdaBook can see them, and nobody, business owners included, can see or set another person’s password.
• The devices you sign in on, with the description your browser sends (we show it as “Android · Chrome”, say), so you can see them and remove one; and a log of changes to how you sign in, to keep your account safe. Each entry in that log also holds a shortened form of the network address it came from and a label for the browser.
• What you state about your age when you join a business or own one, and when you stated it, never your date of birth. See “Age” below.
• If you suggest an idea for OrdaBook, we keep what you wrote, any screenshot you add, and who sent it, so we can answer.
• If you choose Continue with Google, Google shares your name, email address and profile photo’s address with us. We keep your name, your email and Google’s id for you, never the photo or any Google token.

What a business records

• Customers and the people their orders are for: names, phone numbers, measurements, notes, optional portraits (only with the customer’s consent), orders, prices, payments and the photos of the work. A business that takes transfers also records its bank account’s name and number. Staff can take an order without setting its price, for someone else in the business to price; it’s the same order and the same details.
• Staff work: the tasks each person did, the approvals, and the pay worked out from them. A copy of each approved task and paid statement goes into the worker’s own work record, which belongs to the worker and holds no customer data.
• A record of who changed what and when, for money, pay, approvals, measurements, roles and permissions, so a business can trust its own records. Each entry also holds a shortened form of the network address the change came from (the first part only, not your exact address) and a label for the browser.
• A practice shop, if an owner makes one to try things out: it’s kept apart from the real business, and what’s typed into it is kept only as long as it says under “How long we keep it”.

Customers who use our public pages

• A tracking link shows the order’s stage, ready dates and items, who each item is for, any visits booked, and the business’s contact person’s name and WhatsApp number, if it has chosen one. After a check (the customer’s phone digits or a code), it also shows the customer’s name, the prices and balance, and photos to approve, and takes their answer. It sets no cookies. When a customer opens it, the order records that it was seen and how many times, so the business knows its customer has the news. Opens from a network the business’s own team has recently worked from aren’t counted, and nothing about the customer’s device or network is kept.
• A business that lists itself on our workshops page chooses to, and can stop at any time. The page shows the business’s name, trade and place, never anything about its customers. If we ever show figures about how a business works, such as how often its orders are on time, they will be worked out from orders like these, and we will update this policy first.
• A business’s request page and group join links take the details and photos a customer chooses to send, and pass them to that business.
• A business’s shop page is public. It shows what the business chose to put there: its name, its words, its WhatsApp, Instagram and TikTok, and photos it picked, which may be copied from an order. A copy from an order goes when that order is erased.

Our website

• If you accept on the cookie notice, Cloudflare Web Analytics counts visits to ordabook.com without cookies and without following you across sites. We see totals, such as visits per page, not who you are. Decline, and it doesn’t load (see our Cookie Policy).
• If you write to us, by email or the contact form, we use your message and contact details to answer you. Messages sent through the form are kept for a year in our database. A copy of each goes to our support inbox, as does any email you send us; see the Google row under “Who we share data with”.
• If you ask for our launch news, we keep your email address, the words you agreed to and when, and send it only once you’ve confirmed it from the email we send you. Every news email has a link to unsubscribe, which forgets your address at once; an address never confirmed is forgotten after 30 days.

Keeping the service safe and working

• We limit how often codes, passwords and PINs can be tried, using the network address a request comes from, to stop people guessing. The counts are kept under a keyed hash of the address, and forgotten within about two days.
• Our server’s logs record each request’s network address and what was asked for, leaving out names, phone numbers, emails, measurements, photos, codes and tokens. They’re kept for up to a month.
• When a business invites another business, we check the invite is genuine (for example, that the new business isn’t the inviter’s own). We compare keyed hashes of customer numbers and of the network address a business signed up from, within one inviter’s invites only. Nothing is shown to anyone, and the address’s hash is forgotten once the invite is settled.
• We’ve built in two outside services that we haven’t switched on as of the date at the top of this page. Sentry would receive reports of errors on our server: the error’s type, its message with anything that looks like a secret or a person’s details taken out, and where in our code it happened, never what was sent or by whom. PostHog would count how invitations to a bigger plan do, in its EU cloud: the event, the plan, the screen, and a random id made for that phone and kept on it, never a name, an account, a business or a customer. It would use no cookies and no screen recording, and make no profile. Trying a bigger plan with Explore Plans is otherwise saved nowhere.
• People at OrdaBook look at how businesses use the service, to decide what to build and who might welcome a tip. They see counts, and a list of businesses by name with their plan, trade, country, when they were last active, and how many staff, customers and orders they have. See “What OrdaBook’s own team can see”.

Our legal bases

We follow the Nigeria Data Protection Act 2023 and, for people in the European Union or the United Kingdom, the EU GDPR and the UK GDPR. We rely on:

• Contract: to provide the service you or your business signed up for.
• Legitimate interests: to keep accounts and the service secure, prevent fraud, fix errors and improve OrdaBook, in ways you would expect; and to email a business’s first owner an occasional tip on using OrdaBook, at most once every 14 days. You have the right to object to these tips at any time, at no cost: use the link in any tip, or the Tips From OrdaBook switch in Account, and they stop.
• Consent: for portraits, which a business takes only with its customer’s consent, and for passing a customer’s details to another business, which needs the customer’s agreement, recorded with the date.
• Legal obligation: where the law requires us to keep or share something.

Who we share data with

We don’t sell personal data, and we don’t use it for advertising. We share it only with the service providers that run OrdaBook for us, under contracts that require them to protect it and use it only for us. The one exception today is our support inbox, described in the Google row:

Between businesses. Businesses working on the same event (a wedding, say) see the event’s name and date, which businesses take part and, if the host chooses, the guests’ names and their progress. They never see each other’s prices, measurements, photos, customers or phone numbers. A business passes a customer to another business only with that customer’s agreement.

WhatsApp. When someone in a business taps to message a customer, the app opens WhatsApp on their own phone with the words ready, and they press send. The customer’s number and those words go to WhatsApp from that phone. OrdaBook sends nothing to WhatsApp itself.

When the law requires it. We may share data with authorities if the law requires us to, and we’ll tell the business or person concerned where we’re allowed to.

Where your data is kept

Our database, photos and backups are stored in the European Union. The exceptions are the support inbox and, once our move is finished, the encrypted backup on Google Drive, both with Google, whose storage may be elsewhere. Some of our providers may process data in other countries, such as the United States, to provide their service. Where data leaves Nigeria or the EU, we rely on safeguards the law recognises, such as the European Commission’s standard contractual clauses, and on the EU’s strong protection as a basis for the transfer from Nigeria.

How long we keep it

• Customers, the people their orders are for, and orders that a business deletes disappear from the app at once, and are erased for good about 30 days later, with their forms and photos, and any copies of those photos on a shop page. Where a payment, an approval or a pay line points at them, that ledger line stays, with the personal details cleared, so the business’s accounts still add up.
• A photo that’s removed or replaced is usually deleted from storage within the hour; an upload never finished goes after a day.
• Requests sent to a business through its request page are erased 30 days after it answers them or they run out.
• A practice shop is erased when it goes 30 days unused, when its real business is deleted, or when its owner resets it.
• A business that its owner deletes is closed to its staff at once, and its owner can restore it for 7 days; then everything it held is erased. Its only owner can also choose to erase it at once, which can’t be undone.
• Your account, when you delete it, goes as soon as no business still counts you as a member: your sign-in details, devices, photo, work record, and your own account log. A staff member’s owner approves first, and an owner must first delete their business or hand it on. The businesses you worked for keep their own records, with your name only. That includes their activity log entries, with the shortened network address and browser label each one holds.
• The activity log has no time limit: it stays as long as the business does, and goes when the business is erased. When a customer or order is erased, their personal details are taken out of it.
• Sign-in codes and reset links are forgotten within about two days; the records that stop a request being applied twice, within about eight days; the record of a session, including its browser’s description, about a month after it ends.
• Messages from our contact form are kept for a year; launch news subscriptions until you unsubscribe, or 30 days if never confirmed.
• Backups: we keep encrypted copies of the database for at most 35 days, and our host may keep its own for a few days, so erased data leaves them within about 35 days.

Before deleting a business, its owner can download its records, as spreadsheets and one complete backup file, from Settings → Your Data. The backup lists its photos but doesn’t hold the pictures themselves.

What stays on your phone

So the app works on a weak connection or none, it keeps records in your browser’s own storage on the phone or computer you use it on: the customers and orders you’re allowed to see, including names and phone numbers, other records you’ve opened, your recent news, small copies of photos, and changes and photos waiting to be sent. Searching in the app looks through what’s already there, and asks our server nothing for customers and orders.

We don’t encrypt this copy ourselves, so please keep your phone locked. It’s cleared when you sign out, or when someone else unlocks a shared phone; changes still waiting to be sent are kept for you until they can go. On a colleague’s phone, the app saves only your own record and your changes. Your language, appearance and similar choices stay on the phone until you clear your browser’s data. Our Cookie Policy says more.

What OrdaBook’s own team can see

Our back office is open only to the owner of OrdaBook’s account, after confirming who they are in the last 10 minutes. It shows accounts (name, email, language, whether a phone number is on them but not the number, when they last signed in, and their account log), businesses in outline and as counts, which kinds of change a business made and when but not the details, launch news sign-ups, contact messages, suggestions and invites. It doesn’t show a business’s customers, measurements, phone numbers or orders. Every change made there, and every look at personal details, is written to a log.

How we protect it

Connections between your phone and OrdaBook are encrypted. Each business’s records are kept apart, both in our code and by the database itself (row-level security). Staff see only what their role allows, and every change to money and pay is logged. Read more on our security page. If a breach puts people’s rights at risk, we’ll report it to the Nigeria Data Protection Commission within 72 hours, and tell the businesses affected.

Your rights

You have the right to:

• see the personal data we hold about you, and get a copy;
• have it corrected if it’s wrong;
• have it deleted;
• object to how we use it, or ask us to restrict it;
• get it in a portable form; and
• complain to a regulator: the Nigeria Data Protection Commission (NDPC), the UK’s Information Commissioner’s Office (ICO), or the data protection authority where you live in the EU.

Much of this you can do yourself in the app:

• See and correct: your name, email, phone number and devices are in Account, where you can change them or remove a device. Changing how you sign in asks you to confirm it’s you first, and a password is changed from a link sent to your email.
• Get a copy: a business’s owner downloads its records from Settings → Your Data, and anyone can see their own work record from Account. For a copy of anything else we hold about you, write to us.
• Delete: choose Delete My Account in Account. Our page on deleting an account says what goes and what stays.
• Object: stop tips with the link in any tip, your mail app’s unsubscribe button, or the Tips From OrdaBook switch in Account. Turning the switch back on starts them again. To object to anything else, or ask us to restrict it, write to us.

For anything else, write to privacy@ordabook.com. We reply within 30 days. If you’re a business’s customer, ask the business first: it holds your records.

Age

A business’s owner must be 18 or over. The app asks owners to state this themselves when they start a business or become an owner, and asks owners already on OrdaBook once.

Staff and managers may be younger. The app asks each person joining a business as staff or a manager to state either that they’re 18 or over, or that they’re under 18 and have a parent’s or guardian’s consent. Someone who stated they’re under 18 is asked again the next time they join a business. Someone who had a staff or manager account before we began asking is asked only when they join another business or become an owner. Someone a business lists by name, with no account of their own, isn’t asked.

We keep the statement, when it was made, and a line in the person’s account log each time they make one, and these go with their account. We don’t check it, we don’t ask for or keep a date of birth, and we collect nothing about the parent or guardian. You can see your own in Account. If someone stated they’re under 18, the owner and managers of a business they’re in see that on their staff page; it isn’t in a business’s downloads. Our own team sees it only in that person’s account log. A business keeps a staff member’s work record, and their pay, whatever their age.

Businesses may record the measurements of children they make things for, as part of an order, and are responsible for those records.

Changes to this policy

If we change this policy in a way that matters, we’ll tell businesses by email before the change takes effect, and update the date at the top.