Privacy Policy

1. Information we collect

1.1 Information you provide

When you sign up for Ordello and use the service, we collect information you give us:

• Account & business details: name, email, phone number, business name, business address, GST details (optional), business logo, and brand colors.
• Customer records you create: your customers' names, phone numbers, email addresses, delivery addresses, and order history. You are the controller of this data; we process it on your behalf.
• Product, order, payment and stock data entered into your Ordello workspace.
• Payment-gateway credentials — when you connect your own Razorpay account, we store API keys securely (encrypted at rest) so that payments can be routed directly to your bank.
• Support communications — messages you send to us via email, WhatsApp, or the contact form.

1.2 Information collected automatically

• IP address, device type, browser, operating system.
• Pages visited within the app, timestamps, and basic usage analytics.
• Application logs (for debugging and security).

2. How we use your data

We use your data only to:

• Provide the Ordello service — create accounts, manage orders, generate Magic Links, send WhatsApp/email notifications, generate PDF receipts.
• Process subscription billing through Razorpay.
• Provide customer support and respond to your queries.
• Improve the product — identify bugs, measure feature usage in aggregate.
• Send important service announcements (downtime, security, plan changes). You can't opt out of these while you have an active account, but they are infrequent.
• Comply with applicable law and prevent fraud or abuse.

We do not sell your personal data, ever. We do not use your data to train AI models. We do not share customer records you create with any third party except as described below.

3. Sharing & third parties

We share data only with service providers necessary to operate Ordello, and only the minimum required:

• Razorpay — for processing subscription payments and (where you connect your own account) for processing customer payments to you.
• WhatsApp Business API providers — for sending automated WhatsApp notifications to your customers on your behalf.
• Email delivery providers — for sending transactional emails (order confirmations, receipts).
• Cloud infrastructure providers — for hosting the application, databases, and backups.
• Analytics & error-monitoring tools — to keep the service stable.

We may disclose data when required by law, court order, or to protect Ordello, our users, or the public from harm or fraud.

4. Payments & Razorpay

Ordello uses a Bring Your Own Keys model for accepting payments from your customers:

• You connect your own Razorpay account.
• When a customer pays through a Magic Link, funds flow directly from the customer to your bank through Razorpay. Ordello never holds your money.
• We do not store full card numbers, CVVs, UPI PINs, or banking credentials. All payment instrument handling is done by Razorpay (PCI-DSS compliant).
• For our own subscription billing, Razorpay processes your payment to us, and we receive only a transaction reference and the amount paid.

5. WhatsApp & messaging

When you enable WhatsApp notifications, we send automated messages to your customers on your behalf via official WhatsApp Business API providers. Messages contain order information (status, amount, Magic Link). Your customers can opt out at any time by replying STOP.

6. Data storage & security

• Isolated databases. Each Ordello business gets its own dedicated database, so your orders, customers and revenue never sit alongside another business's data.
• Encryption in transit. All traffic between your browser, our servers and third parties is encrypted via TLS (HTTPS).
• Encryption at rest. Sensitive credentials (Razorpay keys, passwords) are encrypted at rest. Passwords are hashed using industry-standard algorithms.
• Backups. Automatic daily backups, retained for a rolling window.
• Access controls. Only authorised Alornix engineers can access production systems, and access is logged.

No system is 100% secure. If we discover a breach affecting your data, we will notify you without undue delay and follow applicable Indian and international notification requirements.

7. Retention

• While your account is active, we retain your data so you can use the service.
• If you cancel, your data remains available for at least 30 days so you can reactivate or export.
• After that, your workspace and customer data are deleted, except where retention is required by law (for example, tax records).
• You can request immediate deletion by writing to support@ordello.in.

8. Your rights

Subject to applicable law (including India's Digital Personal Data Protection Act, 2023), you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your account and personal data.
• Export your data (CSV / JSON).
• Withdraw consent for non-essential processing.
• Raise a grievance with our Grievance Officer (details below).

To exercise any of these rights, email support@ordello.in. We will respond within 30 days.

9. Cookies

We use a small number of cookies and similar technologies:

• Essential cookies — keep you logged in, remember preferences. Cannot be disabled without breaking the app.
• Analytics cookies — anonymous usage tracking to help us improve the product.

We do not use third-party advertising cookies.

10. Minors

Ordello is intended for adults (18+) running a business. We do not knowingly collect data from anyone under 18. If you believe we have, write to support@ordello.in and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email or via a notice inside the app at least 14 days before they take effect. The "Last updated" date at the top of this page always reflects the current version.

12. Contact & Grievance Officer

If you have questions, concerns, or want to exercise your rights under this policy:

Ordello is a product of Alornix Technologies.