Privacy Policy

Last updated: 23 October 2026

This Privacy Policy explains how Ordina Ltd (“Ordina,” “we,” “us,” or “our”), a company based in Lagos, Nigeria, collects, uses, shares and protects information in connection with the Ordina platform: an AI Secretary, booking, ordering and payments service for businesses (the “Service”), and our website.

If you used Ordina before 14 October 2026, these changes apply to you from 13 November 2026.

1. Who this policy covers

  • Business users: the owners of businesses who create an Ordina account, and the team members they invite into it.
  • Customers: the customers of those businesses, who reach a business through its Ordina page or booking form, a chat widget on its website, WhatsApp, Instagram, Messenger, Telegram, email, a phone call, or an AI assistant, and who may book, order, pay, fill in a form or leave a review.
  • Partners: people or organisations we invite to refer businesses to Ordina through a share link or a partner code, under our Partner Program Terms.
  • Website visitors: people who visit our website, help centre and blog.

2. Our role

For business users’ accounts, partners, website visitors and our own marketing, Ordina decides how information is used (we are the “controller”).

For information about a business’s customers (their conversations, bookings, orders, payments, forms, reviews and the messages and emails the business sends them), the business is the controller and Ordina processes the information on its behalf and on its instructions. If you are a customer and want to access, correct or delete your information, you can ask the business, or ask us and we will help. Ordina also uses some customer information for its own purposes: to keep the Service secure and prevent abuse, to honour messaging opt-outs, to collect online payments as the business’s agent (and, for payments through Bachs, as merchant of record), and to meet our legal, tax and accounting obligations.

Our Merchant Data Compliance Agreement sets out what each business is responsible for when it handles its customers’ information through Ordina, and the data protection law and authority it is bound by.

3. Information we collect

Business users and team members

  • Account and profile: your name, email address, phone number, business name and details, address, services, prices, opening hours, language, currency and country. We sign you in with a one-time code sent to your email, so we do not store a password.
  • Sign-in and devices: the devices you sign in on (device name, browser, operating system and when last active), a device identifier kept in your browser, and the approximate city and country of your sign-up and latest sign-in, worked out from your connection (we do not store the IP address for this). When you sign in on a new device, we email you its device, browser, operating system and time. If you turn on two-step sign-in, we keep your authenticator setup and hashed recovery codes. When you change your sign-in email, we keep a record of the old and new address.
  • Your business page and knowledge: the text, images and links on your page (including drafts the Service writes for you), and the text you enter, documents you upload and website addresses you add as knowledge for your Secretary. We extract and store their text.
  • Your own Secretary: the conversations you have with your Secretary in the dashboard, including Live Mode turns (section 5), and the notes, insights and questions it prepares for you. If you link your WhatsApp number to your Secretary in Secretary settings, we also keep that number, when it was linked, and the messages you and your Secretary exchange on Ordina’s WhatsApp number, which appear in your Secretary conversation in the dashboard. Where learning is switched on for your business, the Secretary also saves short lessons from quiet conversations (each a sentence or two, sometimes with a short quote), with a searchable representation of each made by Google. Only the owner can see lessons, and you can review, edit or delete them, or switch learning off or to “ask me first”. You can clear your Secretary conversation at any time.
  • Business verification: if you apply for the verified badge, your legal business name, registration number and up to three registration documents, kept in private storage.
  • Identity verification (KYC): to take online payments, you verify your identity through our provider, Dojah, using a photo of a government ID and a liveness check that films your face while you follow on-screen prompts. We store your name, date of birth and address; your ID type and number (encrypted); the ID photo, in private storage; Dojah’s reference for the liveness check and its results, which include links to the selfie and verification report Dojah holds; and the IP address and browser you submitted from. Our team may run a further check of your ID number with Dojah. While you fill in the form, a draft of your name, date of birth and address (no images) is kept in your browser for up to 7 days.
  • Payout details: the bank or mobile money account details needed to pay you, shared with Bachs or Flutterwave, which hold your payout account. We keep only the bank name, the account name and the last four digits of the account number.
  • Billing: your plan, payments, invoices, discount codes, and the customer and subscription references our payment providers give us. For a saved card, we keep its brand, last four digits and expiry date and a token that lets Flutterwave charge it, and we record when you agreed to renewals. We never see or store full card numbers.
  • Phone lines: your numbers, your usage balance and its transactions (which include callers’ numbers), and the references Twilio gives us for documents you submit to buy a number (the documents themselves go straight to Twilio).
  • Integrations: the access credentials for services you connect, stored encrypted, and API keys, stored only in hashed form.
  • Team members: each team member’s name, email address and status. When a team member acts on a booking or order, we record what they did, when, the type of device and browser they used, and their approximate city and country worked out from their connection, so the owner can see who did what. The IP address itself is not stored.
  • Support and preferences: messages you send our support team, and your notification and marketing preferences.
  • Usage data: how you use the Service, such as the visits to your booking link. A switch in Settings, “Usage analytics”, which is on by default and applies to your whole business, also controls three things: a record of each setup step you reach, which only Ordina’s team sees; performance measurements of about 1 in 10 page loads and page changes, sent to Sentry; and telling Intercom which dashboard pages you move between. When you switch it off, all three stop. Error reports to Sentry continue, because we need them to fix problems. We do not use a separate analytics service.

Customers of businesses

  • Conversations: the messages you exchange with a business’s Secretary, with the name, email address and phone number you give. On WhatsApp, Instagram, Messenger, Telegram and email we also receive the identifier that channel uses for you (for example your WhatsApp number, Instagram or Facebook app-scoped ID, or Telegram name, username and chat ID). Attachments sent on Instagram or Messenger are noted but not stored.
  • Phone calls: see section 5. Calls are not recorded; we keep a written transcript and call details.
  • AI assistants: if you ask an AI assistant, such as ChatGPT or Claude, to book with a business on Ordina, the assistant sends us the details you gave it, such as your name and phone number. Your conversation with the assistant is handled by its provider under its own terms.
  • Bookings and orders: your name, email address, phone number, the services or items, dates and times, notes, answers to the business’s questions, delivery or home-visit address, and payment references. Payments are made through our payment providers; we do not receive card numbers.
  • Booking form activity: on a business’s booking form we record what a visitor does (for example the services viewed, the cart, the time picked, reaching checkout, or a failed payment), with an approximate city and country worked out from the connection (the IP address is not stored). Once you complete the contact step, the contact details you entered are saved and shown to the business as an unconfirmed contact, even if you do not finish booking, and the business may follow up about the unfinished booking.
  • Recognising returning customers: Ordina links a customer’s conversations, bookings and orders with a business across channels using contact details (email addresses, compared without capitals or spaces, and phone numbers, compared on their last 10 digits) and channel identities. Records are merged automatically only when the evidence is strong, such as the same phone number confirmed by the channel itself; weaker matches are only linked or suggested. Every merge is logged and the business can undo it. The Secretary uses this history when replying, but only refers to your past interactions when you are confirmed through the same channel identity or the same confirmed phone number or email address: a web browser alone never reveals anyone’s history. On a business’s booking page, a random identifier kept in your browser lets the Secretary continue your chat. A business can block a customer, after which the Secretary stops replying to them on every channel.
  • Leads, forms and reviews: when the Secretary passes a question to the business, it may ask for your contact details. If you fill in a business’s form, we keep your answers, send you a copy by email and notify the business. If you leave a review, we keep your rating, text and name; the review is published on the business’s page, and may appear in search results, only after the business approves it.
  • Messages and follow-ups: the messages the Service sends you on the business’s behalf (see our Messaging Policy) and any opt-out you make.
  • Visits to booking pages: the referring website, campaign tags, device type and approximate city and country, without the IP address.

Partners

  • Partner applications: if you apply to the Partner Program on our website, the details you send: your name, email address, country, optionally a phone or WhatsApp number, what you do, who your audience is, optionally links to your website or social pages, how you would introduce Ordina and anything else you add, with the date and the type of browser you sent it from. We use them only to review your application and to contact you about the Partner Program. Applying does not create an account or an invitation, and the application page does not load Google Tag Manager or the Reddit advertising pixel.
  • Partner details: for partners, the details given when setting up a partner account, which we review: name, partner and company name, email address, phone number, country, a photo, and optionally a logo, a website or social page and how they plan to refer businesses. Also the partner’s payout details (a bank account or a stablecoin wallet address; account numbers and wallet addresses are stored encrypted and shown only by their last four characters), whether two-step sign-in is on, and records of the partner’s codes, referrals, earnings, refund adjustments and payouts, including the exchange rates and fees of each payout.
  • Partner referrals: if a business signs up through a partner’s link, we record which partner’s link it was, with the click details from the ordina_ref cookie (section 7); if it applies or pays with a partner’s code, we record that too. Our team uses the click details to check the quality of a partner’s link; partners do not see them. At a business’s first payment, we work out which partner, if any, referred it. To prevent self-referral, we compare a partner’s email address, the browsers they have signed in from and their payout details with the business’s sign-in and contact email addresses, the browser it signed up or applied the code in, its payout account, verified name and phone number. A business whose sign-in email address is the partner’s own cannot become their referral; any other match puts the referral under review by our team. The business’s details are never shown to the partner.

Perk providers

  • Perk providers: if your company offers a perk through Ordina Perks, we keep what you send (your company’s name, website and country, your name and work email, the offer and its terms, any codes and your logo) with a record of the one-time code that proved your email. That email signs you in to the Ordina partner portal, where you manage your perks, so we also keep the sign-in records any Ordina account has. We use all of this only to review and show your perk, to let you manage it and to email you about it, under our Perk Provider Terms. We never share information about businesses, owners, partners or their customers with a perk provider, who sees only how many times its perk was claimed.

Website visitors

  • Page views: we count visits to our marketing pages ourselves, recording the page, the referring website, campaign tags, device type and country, with a random identifier for the visit that is not linked to you. No IP address is stored.
  • Blog: if you comment, we keep your name, your optional email address and your comment, which is published once approved. Likes are counted using a salted, one-way code made from your IP address and browser, so the same visitor is not counted twice.
  • Advertising measurement: see section 7.

Collected automatically from everyone

  • Device and log data: IP address, browser type, pages requested and timestamps, used to run and secure the Service. Our hosting provider keeps request logs, and our security systems keep counters, keyed by IP address or email address, to limit abuse.
  • Approximate location: the country and city our hosting provider works out from your connection. We use it to show prices in your currency and, where this policy says so, store it without the IP address.
  • Cookies and browser storage: see section 7.

4. How we use information

  • To provide the Service and your account, which is how we perform our contract with you.
  • To power the Secretary: answering customers, taking bookings and orders, preparing notes and insights for the business, and drafting text when asked (section 5).
  • To publish business pages and reviews, and to list paid businesses in the Ordina directory unless they turn the listing off.
  • To send booking and order messages and notifications by email, SMS, WhatsApp, Telegram and push notification, on businesses’ behalf.
  • To verify identity and businesses, take online payments, pay businesses out, and bill plans and phone lines.
  • To run the Partner Program: reviewing applications and partners’ details, recording which partner link or code a business came through, crediting referrals, calculating and paying partners’ earnings, checking payments with our payment providers for refunds and disputes, and preventing self-referral and abuse.
  • To send business users product news and tips, which they can unsubscribe from at any time (section 8).
  • To measure our own advertising on our marketing pages and for new sign-ups (section 7).
  • To provide support, secure the Service, prevent fraud and abuse, and enforce our Terms, which are our legitimate interests.
  • To improve the Service, and to comply with our legal, tax and accounting obligations.

Where the law asks for a legal basis, we rely on performing our contract with you, our legitimate interests (running, securing, improving and promoting the Service, in ways that do not override your rights), compliance with legal obligations, and your consent where we ask for it. For customers’ information, the business decides the legal basis for its own purposes.

5. AI, voice and phone calls

How the Secretary uses AI

The Secretary’s replies are written by AI models. To answer a message, we send the conversation to an AI provider together with the business’s information and knowledge and what the Secretary knows about the customer. Requests are routed for speed and availability between Google (Gemini), Anthropic (Claude), Cerebras and OpenRouter, and whichever provider serves a turn receives the conversation so far. We also use Google to read booking and order details from conversations, to organise knowledge, to read catalogues you import (including documents and photos), to draft text, to prepare insights, and to create searchable representations of text.

Our AI providers process this information to return a response. We choose providers, plans and settings that limit what they may do with it: for example, we use paid API services, we route OpenRouter requests only to providers that say they neither retain nor train on the data, and we send Deepgram requests with its model improvement opt-out. Each provider’s use of data is governed by its own terms, which it can change, so we cannot promise how every provider handles every request; we review them and change providers or settings when we need to. Some requests may be served by an open model we host ourselves.

Ordina does not train on your data

Ordina does not use businesses’ data to train AI models. If we ever offer that, it will be opt-in: off unless a business turns it on, and only with anonymised data. There is no such option today. We never use the personal information of the people a business serves to train AI models, and never sell it or use it for our own advertising.

The Secretary tells customers it is an AI whenever it is asked, and never claims to be a person. The Secretary’s answers can be wrong, and the business remains responsible for its offer.

Secretary Live Mode

Live Mode lets business owners on a paid plan talk to their own Secretary by voice in the dashboard. Your speech is turned into text by your browser’s own speech recognition where it is available (in Chrome, the browser sends the audio to Google to do this), or by Google Gemini, or, where we have enabled it, by Deepgram. When Deepgram is used, we also send it up to 50 of your customer and service names so they are recognised correctly. The Secretary’s replies are turned into speech by Google, by Deepgram, by a speech provider reached through OpenRouter with zero data retention, or by your device’s own voice.

We do not store Live Mode audio: each recording is held in memory only long enough to turn it into text. The text of each turn is saved with your Secretary conversation, which you can clear.

Phone calls

When a business has a Secretary phone line, the Secretary answers calls and introduces itself as the business’s Secretary. It says it is an AI whenever a caller asks. Calls are not recorded. The call audio is streamed live through Twilio and our voice bridge to Google Gemini, which listens and speaks; Gemini also receives the caller’s number and, for a returning caller, their earlier history with the business. We keep a written transcript of the call, the caller’s and the called number, the call’s length, cost and summary, and a log of what the Secretary did (such as the name and phone number given for a booking). Messages a caller leaves are sent to the business by push notification, Telegram and email.

6. Service providers and other recipients

We share information only as needed to run the Service, with the providers below, each of which processes it for us or for the purpose described. We do not sell personal information.

Hosting and infrastructure

  • Supabase: our database, sign-in system and file storage, which hold everything the Service stores, including verification documents in private storage.
  • Vercel: hosts the website and app and runs scheduled jobs. It receives every request, keeps request logs (which can include IP addresses and, for some errors, short extracts of content) and tells us your approximate location.
  • Fly.io: hosts our voice bridge, which relays live call audio between Twilio and Google. It keeps error logs only.
  • Sentry: error and performance monitoring. When something breaks in the website, app or our servers, it receives a report with the page address, browser and device details and technical details of the error. For business users with usage analytics on, it also receives performance measurements (timings and the page address) for about 1 in 10 page loads and page changes. We configure it not to collect personal information by default, but a report can contain information from the page where the error happened.

AI and speech

  • Google (Gemini): conversations on every channel with the business information and customer history the Secretary uses; owner Secretary and Live Mode turns; text to read aloud; live phone call audio; documents and photos imported into a catalogue; and text to organise or draft (section 5).
  • Anthropic (Claude), Cerebras and OpenRouter: the same conversation and owner Secretary requests, when they serve a turn. OpenRouter also passes Live Mode reply text to a speech provider with zero data retention.
  • Deepgram: Live Mode reply text to read aloud and, where enabled, owner voice recordings to transcribe with a list of customer and service names.

Messaging, email and notifications

  • Twilio: phone numbers and the content of SMS and WhatsApp messages, including Secretary conversations on a business’s own WhatsApp number, the booking and order messages Ordina’s shared WhatsApp number sends for businesses that have not connected one, and conversations an owner has with their own Secretary on that shared number, with the alerts it sends them there (a WhatsApp message that fails is sent again by SMS); for phone lines, the caller’s number and the live call audio; and the identity and supporting documents a business submits to buy a number in some countries.
  • Meta: if a business connects Instagram or a Facebook Page, the messages customers send it and their app-scoped IDs. If a business connects its own WhatsApp number, its WhatsApp account and number identifiers, through Meta’s signup flow. The Facebook SDK loads in the dashboard only when a business sets up its own WhatsApp number, with automatic event logging turned off.
  • Telegram: if a business connects Telegram, customer conversations through our bot or Telegram Business, and alerts to the owner, which can include customer names and booking details.
  • ZeptoMail (Zoho): our transactional email, such as sign-in codes, booking and order emails, billing, verification and partner emails.
  • Resend: backup for transactional email; our product and marketing emails to business users; businesses’ broadcasts and automations to their customers; and the Secretary’s email channel, which receives and answers emails sent to a business’s Secretary address.
  • Expo and browser push services (such as Google, Mozilla and Apple): your device’s push token and the content of each notification, which can include customer names and booking, order, lead or caller message details.
  • Intercom: our support chat, which loads only when you open support. It then identifies you by your user ID, name, email address, business name, plan and the date you joined, and receives the messages you send, so our team can help. If usage analytics is on, it is also told which dashboard pages you move between.

Payments, billing and verification

  • Bachs and Flutterwave: plan payments, customers’ payments to businesses, usage balance top-ups, and businesses’ payout account details. Which provider handles a payment depends on the currency and country.
  • Shopify: billing for businesses that subscribe through the Ordina app for Shopify.
  • Dojah: identity verification (section 3).

Integrations a business turns on

  • Google Calendar and Google Sheets: see section 10.
  • Shopify and WooCommerce: see section 11.
  • The business’s own systems: a business on the Business plan can send its data, including customers’ contact details, notes, addresses, form answers and reviews, to webhooks, connected actions, its API and AI assistants it connects to its account. Webhook deliveries are logged.
  • Video meetings: online appointments use a Jitsi Meet link or, with Google Calendar, a Google Meet link; the meeting service processes the call when people join.

Advertising measurement

  • Google Tag Manager and the Reddit Pixel: on our marketing pages only (section 7).
  • Reddit Conversions API: when a new business account is created, we send Reddit a hashed (SHA-256) copy of the sign-up email address, the IP address and browser details, the account ID and, if the visitor came from a Reddit ad, the Reddit click ID, so we can measure our Reddit advertising.

Content loaded in your browser

  • DiceBear: creates default avatar pictures in the dashboard. It receives the request from your browser and a value that does not include customer names or email addresses.
  • Gravatar: if you have not uploaded a profile picture, we look for one using a hashed (MD5) copy of your email address.
  • YouTube (privacy-enhanced mode) and Vimeo: if a business adds a video to its page, these load it and receive the visitor’s IP address and browser details.
  • flagcdn and Unsplash: flag images in country fields and some images, which receive the visitor’s IP address when they load.

Other disclosures

  • A business sees the information its customers give it, and its team members see what their role allows.
  • A partner sees limited information about businesses it referred (section 12).
  • We may disclose information where the law requires it, to protect our rights, users or the public, or as part of a merger, acquisition or sale of assets, where the information stays protected by this policy.

7. Cookies and browser storage

Cookies

  • Sign-in cookies (named sb-…-auth-token): keep you signed in to the dashboard, the partner dashboard and the Shopify app, for up to 400 days or until you sign out.
  • ordina_ws: remembers which business a team member is working in, for 90 days.
  • Integration cookies (gcal_oauth_state, gsheets_oauth_state, meta_oauth_state and meta_pages): protect the connection steps for Google and Meta, for 10 minutes.
  • Partner Program cookies: see below.
  • ord_rdt_cid: if you arrive on our marketing pages from a Reddit ad, keeps Reddit’s click ID for 30 days so we can tell Reddit if you sign up.
  • Advertising tags: Google Tag Manager and the Reddit Pixel, and the tags they load, may set their own cookies on our marketing pages (for example Reddit’s _rdt_uuid).
  • Intercom and Meta: Intercom sets its cookies when you open support, and Meta’s SDK sets its cookies when a business sets up its own WhatsApp number.
  • A business’s own Meta Pixel: a business can add its own Meta Pixel to its booking page, to measure its Meta ads. It loads only on that business’s booking page, and only after you agree in the prompt on that page. Meta then sets its own cookies (such as _fbp) and is told which page and items you viewed, and whether you booked or paid, with the amount and currency. We never send Meta your name, email address, phone number or anything you type. The business is responsible for its own use of Meta’s advertising tools. You can change your choice with the link at the bottom of that booking page.

Partner Program cookies

When someone opens a partner’s share link on our marketing pages, we set an ordina_ref cookie for 90 days, recording which partner’s link it was, when it was first opened, the page it led to and the website that sent the visitor, and, if the link carried a partner code, an ordina_coupon cookie for 30 days holding that code. If an Ordina account is created in that browser, the signup is credited to the partner. When a partner signs in, we set an ordina_aff cookie in their browser for 365 days, used only to flag a referral for review if a business signs up from a partner’s own browser. These cookies are signed or hold only a code, contain no contact details, and are used only for the Partner Program.

We remove the partner’s link code and any code from the page address before our marketing tags load, so those tags never receive them. These cookies are not used for advertising.

Browser storage

  • Booking pages: a random identifier for each business page you visit, so the Secretary can continue your chat; identifiers for visit counting and form activity; and your chat, cart and payment progress.
  • Chat widget on a business’s website: your sound setting and whether you closed or have seen the widget.
  • Dashboard: your preferences and display settings, the device identifier for your devices list, a short-lived copy of dashboard data and visited pages to make the app faster and work offline (deleted when you sign out or delete your account), and the identity verification draft described in section 3.
  • Marketing pages: a random identifier for the current visit, and the blog posts you have liked.

Where advertising tags run

Google Tag Manager and the Reddit Pixel run only on our marketing pages: the website, help centre, blog and these legal pages. They do not run on booking pages, the chat widget, checkout and payment pages, sign-in, onboarding, the dashboard or the partner dashboard. You can block or delete cookies and storage in your browser, or use a content blocker, and the Service will keep working, although blocking sign-in cookies signs you out.

8. Emails and messages

  • To business users: we send account, billing, security and booking emails as part of the Service, and product news and tips as marketing. Every marketing email has an unsubscribe link. Once you unsubscribe, we stop sending you marketing emails, including tips for inactive accounts.
  • To customers, on businesses’ behalf: booking and order messages by WhatsApp, SMS and email, follow-ups from the business, and on the Business plan, email broadcasts and automations. Replying STOP stops SMS and WhatsApp messages, and the unsubscribe link in a business’s emails stops its broadcasts, automations and follow-ups. Every message the Service sends honours these opt-outs. See our Messaging Policy.
  • Broadcasts and automations: these go to people who have given the business an email address on a booking or order, unless they have unsubscribed, so the business is responsible for having a lawful basis to send them. They are sent by Resend in the business’s name with replies going to the business, and Ordina acts as the business’s processor.

9. Instagram and Messenger

If a business connects its Instagram professional account or a Facebook Page, Ordina receives the messages that customers send to that account or Page (the message content and the sender’s app-scoped identifier) through Meta’s platforms. We use them only to let the business’s Ordina Secretary answer those customers, help them book, and show the conversation to the business, and the business may follow up with those customers in the same conversation. The business’s access token is stored encrypted and is used only to send and receive those messages.

Message text is processed by the providers in section 6 to write replies. Ordina does not use it to train AI models, sell it, or use it for advertising. Conversations are kept while the business’s account is active, until the business deletes them. The business can delete any conversation, or its account, from its dashboard, and can disconnect Instagram or Messenger at any time from Integration or from its Instagram or Facebook settings.

Deleting your messages

If you messaged a business on Instagram or Messenger and want the messages deleted, ask the business, or email us at help@useordina.com with the name of the business and the Instagram or Facebook account you used. We will delete the conversation and confirm by email.

10. Google user data and Limited Use

If you connect Google Calendar, Ordina uses Google APIs to read your busy and free time, so the Secretary does not offer a slot when you are already booked, and to add your confirmed appointments to your calendar. Each event includes the customer’s name, email address, phone number and booking reference, and lists the customer as a guest on the event. For online appointments, Ordina can create a Google Meet link.

If you connect Google Sheets (Business plan), Ordina creates one spreadsheet in your Google Drive and, every hour, rewrites it with your appointments, orders and customers, including their contact details, notes and amounts. Ordina can only access files it created.

You can disconnect either at any time from your Ordina dashboard or from your Google Account permissions page. Google access tokens are stored encrypted.

Ordina’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy , including the Limited Use requirements.

In particular, data received from Google Workspace APIs is:

  • used only to provide or improve the calendar, availability, appointment and spreadsheet features that are visible to you in the Ordina app;
  • never sold, and never used or transferred for advertising or any advertising-related purpose;
  • never used to train, fine-tune, or develop generalised or non-personalised artificial-intelligence or machine-learning models;
  • not read by any human except with your explicit consent for a specific item, where required for security or to comply with applicable law, or where the data has been aggregated and anonymised; and
  • transferred to others only as necessary to provide or improve these features, to comply with applicable law, or as part of a merger or acquisition.

11. Online stores (Shopify and WooCommerce)

If a business connects its Shopify or WooCommerce store, Ordina reads the store’s products, prices, variants and stock levels so its Ordina Secretary can answer questions about them. On a Shopify store, the Secretary links the customer to the product’s page in the store, where the customer buys it; Ordina creates no orders in a Shopify store and does not read its orders. On a WooCommerce store, when the Secretary sells, Ordina creates a pending order in the store with the customer’s name, email address and phone number, the customer pays at the store’s own checkout, and Ordina then follows that order’s status (paid, fulfilled, cancelled) so the Secretary can tell the customer where it is. Ordina never receives or stores card or payment details. For a Shopify store, Ordina also reads the shop’s name, contact email, currency, domain and billing country, and the installing user’s email address and first name, to set up the business.

For orders the Secretary creates (and the Shopify orders it created before 23 October 2026), Ordina keeps the customer’s name, email address and phone number as the customer gave them in the conversation, the items, the total, and the order’s status. Ordina does not keep the store’s other orders and does not read its customer list. The store’s access credentials are stored encrypted and are used only for the purposes above. This data is not sold, not used for advertising, and not used to train models. Businesses whose plan is billed through the Ordina app for Shopify pay through Shopify, including top ups of their usage balance.

The business can disconnect its store at any time from Integration in its dashboard, or by removing the Ordina app from Shopify or revoking Ordina’s key in WooCommerce. When the Ordina app is removed from a Shopify store, Ordina deletes the store’s access credentials immediately, and deletes the store’s products and orders when Shopify asks it to (48 hours after removal). If a shopper asks a Shopify store for their data, Ordina sends the store the orders it holds for that shopper; if they ask for it to be deleted, Ordina erases their name, email address and phone number from those orders. Conversations and bookings the same person had with the business through Ordina are not covered by Shopify’s request; the person can ask the business or us to delete them.

12. Partner Program

The Partner Program is described in the Partner Program Terms. Section 3 lists the information we keep about partners and referrals, and section 7 the cookies.

Partners and the businesses they refer. If your business signs up through a partner’s share link, or uses a partner code, and then pays for an Ordina plan, that partner is credited with your business. The partner sees your business name, your plan and billing period, your status, the dates and amounts of your plan payments, your next renewal date and the share they earn from each payment. Before your business has paid, a partner may see its name if it signed up through their link or started a free trial with their code. A partner never sees your contact details: not your email addresses, phone number, address, the owner’s name or the address of your Ordina page.

13. Where we store and transfer information

Ordina is based in Nigeria. We host the Service in the European Union: our app runs in Frankfurt, Germany, our database is in Frankfurt, and our voice bridge for phone calls runs in Paris, France. Many of our providers, including our AI, messaging, email, notification and support providers, are based in or process data in other countries, including the United States, and may process information wherever they operate.

So your information may be processed in countries other than your own, which may have different data protection laws. Where the law requires safeguards for these transfers, we rely on the protections our providers offer, such as standard contractual clauses, and we share only what each provider needs.

14. How long we keep information

  • While an account is open: we keep a business’s information, including its customers’ information, while its account is open. Conversations are never deleted automatically: those idle for 30 days are archived, and the business can delete any conversation. Deleting a conversation does not delete the customer’s bookings, orders or contact record.
  • When a business deletes its account: deletion is immediate and permanent. It deletes the business’s data, including its customers’ information and its stored files, cancels future charges with our payment providers and releases its phone lines. We keep only the records listed below.
  • Payment records (plan payments, discounts, checkout and payment provider records) are kept after an account is deleted, without the link to the account, for as long as tax and accounting law requires. Records of paid invoices from our payment providers are kept as payment evidence; other provider notifications are deleted after 30 days once processed.
  • Partner Program records (referrals, partners’ earnings and refund adjustments, payouts and their transfer references, pause history and earlier payout details) are financial records. We keep them after a partner’s or a referred business’s account is deleted, with the business name as it was at the time, so that payouts, refunds and disputes can be reconciled, for as long as tax and accounting law requires, typically up to 7 years.
  • Other records we keep after deletion: a record of the marketing emails we sent and the address each went to; our administrators’ audit log; if you were a team member in another business, that business’s record of your membership and activity; and records of the Ordina app being installed on a Shopify store.
  • Phone lines left unpaid are released 14 days after suspension.
  • Security records, such as abuse-prevention counters keyed by IP address or email address, are kept for as long as needed for that purpose.
  • Accounts we close ourselves (for example for fraud or abuse) may be kept, out of use, for as long as needed to deal with the reason they were closed.
  • Our providers keep information they process for us under their own retention terms.

15. Security

We protect information with encryption in transit and at rest, row-level access controls in our database, sign-in by one-time code with no passwords, optional two-step sign-in (required for partner payout actions), alerts for sign-ins on new devices, a devices list from which you can sign out other sessions, private storage for verification documents, and access logging. Integration credentials, Google access tokens, national ID numbers and partners’ bank account and routing details are encrypted in our database; for a business’s own payout account we keep only the bank name, account name and last four digits, and the full details stay with Bachs or Flutterwave. API keys are stored only in hashed form. Team members only reach the parts of the dashboard their role allows. No method of transmission or storage is completely secure, but we work to protect your information and keep improving our safeguards.

16. Your rights and choices

Depending on where you live, laws such as the Nigeria Data Protection Act 2023, the GDPR or the UK GDPR may give you the right to access, correct, delete or receive a copy of your personal information, to object to or restrict certain processing, to withdraw consent, and to complain to a data protection authority (in Nigeria, the Nigeria Data Protection Commission, or the authority where you live).

  • Business users can correct their details in the dashboard; download their business data from Settings (“Download my data”); switch usage analytics off in Settings; delete their account from Settings; unsubscribe from marketing emails; and manage their devices and two-step sign-in.
  • Your data download is a ZIP file with your business profile, services and products, appointments and orders, customers and contacts, conversations and messages, your own Secretary messages, reviews, forms and their submissions, team members, availability and locations, leads, knowledge, phone calls, broadcasts, payments, your payout account history (with only the last 4 digits of account numbers) and your plan payments. It leaves out access tokens, payment provider credentials, identity verification documents and our team’s internal notes. If you use two-step sign-in, you confirm it before downloading.
  • Customers can ask the business they dealt with, or us, to access, correct or delete their information; reply STOP to stop SMS and WhatsApp messages; and use the unsubscribe link in a business’s emails.
  • Partners can see their information in the partner dashboard and email us about anything else.
  • Everyone can contact us at help@useordina.com. We will respond within the time the law requires, and may need to confirm who you are first.

17. Children

Business and partner accounts are only for people aged 18 or over. The Service is not directed at children under 16, and we do not knowingly collect their personal information. A business whose customers include children is responsible for having any consent the law requires. If you believe we hold a child’s information without that consent, contact us and we will work with the business to delete it.

18. Changes to this policy

We may update this Privacy Policy. We will post the updated version here and revise the “Last updated” date above, and we will tell business users and partners about material changes by email or in the dashboard before they take effect.

19. Contact us

For questions, or to exercise your rights, contact us at help@useordina.com. Ordina Ltd is based in Lagos, Nigeria.