Privacy policy and GDPR compliance

1. What data is being collected and where?

We collect information when you visit our website, when you contact us or book a meeting, and when you sign up for an account.

When you visit our website, we use cookies and similar technologies that you control, as described in section 4: analytics and marketing tags loaded through Google Tag Manager, and a first-party cookie that assigns you to a version of a page when we test page designs. When you allow them, they collect:

• IP address
• Approximate location
• Browser and operating system
• Browser language
• The source of your visit
• Pages you visit

Section 4 explains how to accept, refuse or change your choice.

We also use a first-party cookie of our own, od_attr, on ordering.co and accounts.ordering.co, with a random visit identifier. It keeps two contacts: the first one we saw from you (first touch) and the most recent one that arrived from outside with a campaign (last touch). Each contact stores the campaign tags of that link (UTM parameters), a click identifier if it came from Google Ads, Microsoft Advertising, Meta or LinkedIn, the page you landed on, the website that referred you and the date; the cookie expires 90 days after it was last updated. We use it to know which campaign brought each contact request, meeting booking or account sign-up: we send both contacts along with your request, and save the last touch with your lead and the first touch on your record in Attio. We do not send the visit identifier or your email address to Google Analytics. On www.ordering.co it is an analytics cookie (section 4): in the European Economic Area, the United Kingdom, Switzerland and California we do not store this information in your browser, or add it to your requests, until you accept analytics cookies. If your browser sends the Global Privacy Control signal, we do not set this cookie; we keep this information only in your browser's session storage for that tab, and it is deleted when you close it. On accounts.ordering.co, where you create an account, the cookie banner does not apply: the sign-up reads this cookie and can set it, on the basis of our legitimate interest (Art. 6(1)(f) GDPR), unless your browser sends the Global Privacy Control signal.

When you contact us through our contact form, we ask for:

• The topic of your message
• Name
• Work email
• Company (optional)
• Your message
• The page and campaign that brought you to our website, if any

Our website adds this last item to your request automatically, from the od_attr cookie described above. We add it to your request in Attio and to our internal notification email.

Cloudflare Turnstile checks that the form is sent by a person. To protect the form, we and Cloudflare process your IP address and technical information about your browser. Your request is recorded in Attio, the CRM we use to follow up on contact requests, and our confirmation email is sent through Resend. When you book a meeting with our team, Calendly processes the details you enter and receives the campaign tags and the visit identifier from the od_attr cookie, if any.

When you sign up for an account with us, we ask for similar information:

• Name
• Email
• Name of your company

Like contact requests, your account sign-up automatically includes the information from the od_attr cookie described above, which we save in Attio with the lead created for your account.

This information is stored on our Amazon Web Services servers. We have different instances for this, with locations in the USA, Europe, and Asia. You can check the locations of the servers directly with AWS: https://aws.amazon.com/about-aws/global-infrastructure/

If you no longer want to receive emails from us, let us know through our contact page.

2. Who is collecting your information?

• Ordering, Inc. (Ordering.co)
• Amazon Web Services, which hosts the Ordering.co platform
• Cloudflare, which hosts and protects our website, including Turnstile
• Google, through Google Tag Manager and Google Analytics
• PostHog, which measures how people use our product, loaded through Google Tag Manager and setting its own cookies
• HubSpot, which tracks marketing and manages our customer relationships, loaded through Google Tag Manager and setting its own cookies
• Intercom, which powers the chat on our website, loaded through Google Tag Manager and setting its own cookies
• Attio, our CRM for contact requests
• Resend, which delivers our emails
• Calendly, which schedules meetings you book with our team
• Our payment processor, which processes subscription payments

3. How is your data collected?

We collect your data through the forms you submit, the meetings you book, and cookies, tags and your browser's session storage on ordering.co and accounts.ordering.co. We also enter the data described in section 1 into the providers listed in section 2, automatically or manually.

4. Cookies and your choices

We group the cookies and similar technologies on www.ordering.co into three categories. Strictly necessary ones are always on. Analytics and marketing ones depend on your choice. PostHog, HubSpot and Intercom are currently turned off; if we turn them on again, they follow the same choice.

• Strictly necessary: your cookie choice (od_consent, about 6 months, for every ordering.co site), your light or dark theme (stored in your browser), Cloudflare Turnstile on the contact form, and Calendly when you choose to book a meeting.
• Analytics: Google Analytics (_ga cookies, up to 2 years), PostHog (ph_ cookies and browser storage, up to 1 year), our campaign attribution cookie (od_attr, 90 days, described in section 1), and our page-test cookie (od_page_exp_, 30 days), with the version of the page you saw kept in your browser for 30 minutes.
• Marketing: HubSpot (hubspotutk and __hstc, up to 6 months; __hssc, 30 minutes; __hssrc, until you close your browser) and the Intercom chat.

In the European Economic Area, the United Kingdom, Switzerland and California, analytics and marketing cookies stay off until you accept them in the cookie banner. Elsewhere they are on by default and you can turn them off.

You can change or withdraw your choice at any time with the Cookie settings or Your privacy choices link at the bottom of every page. When you withdraw it, we stop loading those tags and delete the cookies they set on our website. We treat the Global Privacy Control signal from your browser as a request to opt out of the sale or sharing of your personal information and turn marketing cookies off. You can also block or delete cookies in your browser settings; this does not affect your access to the website.

5. Why is your data being collected?

We use the information you send through our contact form or when you book a meeting to reply to your request, usually by email, and to follow up on sales conversations. We record sales, quote, custom project and migration requests in our CRM so our team can follow them up.

We use account information to provide the Ordering.co service, give support, bill you and send you service messages.

We use the data of our visitors to measure how our website and our advertising perform, and to evaluate the sources of traffic that we pay for, including which pages and campaigns bring contact requests, meeting bookings and account sign-ups.

6. Legal bases for processing

We process personal data on these legal bases: to reply to your contact request and to take steps you ask for before entering into a contract (Art. 6(1)(b) GDPR); to provide and bill your account under our contract with you (Art. 6(1)(b)); to protect our website and forms against abuse, including Cloudflare Turnstile and rate limiting, and to manage our customer relationships (our legitimate interests, Art. 6(1)(f)); to test and improve our website, measure our advertising and attribute contact requests, bookings and sign-ups to the campaign that brought them with the analytics and marketing cookies and tags in section 4, including our od_attr cookie, Google Analytics, PostHog, HubSpot and Intercom: on www.ordering.co, your consent in the European Economic Area, the United Kingdom, Switzerland and California (Art. 6(1)(a)), which you can withdraw at any time, and our legitimate interests elsewhere and on accounts.ordering.co (Art. 6(1)(f)); and to comply with legal obligations, such as tax and accounting (Art. 6(1)(c)).

Where we rely on our legitimate interests, we have balanced them against your rights. You can object at any time through our contact page.

7. How will your data be shared and who has access to it?

We do not sell your personal data. We disclose it only to the service providers listed in section 2, who process it on our behalf under written contracts, and where the law requires it.

Each provider processes the data only to provide its service to us, under a written agreement that requires it to protect the data and not use it for its own purposes. We may also disclose data where the law, a subpoena or a court order requires it.

8. International transfers

We and our providers may process your data in the United States and other countries outside the EEA and the UK. When we do, we protect it with the safeguards required by applicable data protection law.

9. Data retention

We keep personal data only as long as we need it for the purposes above, and longer only where the law requires it. The technical receipt of each contact request, which contains no name, email or message, is deleted after 48 hours. Account data is kept while the account is active and afterwards only as long as we need it for legal, tax or accounting obligations.

10. Your data rights and freedom.

Depending on where you live, you have the right to access your personal data, correct it, delete it, restrict or object to its processing (including for direct marketing), receive it in a portable format, and withdraw your consent at any time without affecting processing that took place before. If you are in the EEA or the UK, you can also complain to your local data protection authority or the UK Information Commissioner’s Office.

California residents have the right to know, correct and delete their personal information, to opt out of its sale or sharing, and not to be discriminated against for exercising these rights; an authorised agent may make a request for you. We will verify your identity before acting on a request.

We aim to reply to every request within 72 hours. We will complete your request without undue delay and within the time the law allows, after verifying your identity. We may keep data we are legally required to retain.

Send your request through our contact page, choosing the Support topic. We are happy to help you.

11. Data protection contact

Questions about this policy or your data are handled by the Ordering.co Legal Team. You can reach the team through our contact page; choose the Support topic.

12. How are we protecting that data from breaches?

We use the security available for our services at Amazon Web Services, where the Ordering.co platform runs: https://aws.amazon.com/security/

Our website runs on Cloudflare, which protects it and the contact form against abuse: https://www.cloudflare.com/trust-hub/

13. Breach reporting

If a personal data breach affects your data, we will start investigating immediately, take measures to contain it, and notify the competent data protection authorities within 72 hours of becoming aware of it where the law requires it, including in the EEA, the UK and the United States. Where the breach is likely to put your rights at risk, we will tell you without undue delay, and we aim to do so within 72 hours, by email where we have your address, with a clear summary of what happened, the likely consequences and the measures we have taken.

14. Restriction on children

Our website and services are intended for businesses and are not directed to children. You must be at least 18 years old to use our services. We do not knowingly collect personal data from children; if you believe a child has sent us personal data, contact us through our contact page and we will delete it.

15. Changes to this policy

We may update this policy. We will post the new version on this page with its "Last updated" date and, for material changes, tell account holders by email or in the product before they take effect.