Privacy Policy

Last updated: 16 September 2026

This Privacy Policy explains how Ordina Ltd (“Ordina,” “we,” “us,” or “our”) collects, uses, shares, and protects information in connection with the Ordina platform, an AI-powered secretary and booking service for service-based businesses (the “Service”). By using the Service, you agree to the practices described here.

1. Who this applies to

Ordina serves several groups of people, and this policy covers all of them:

Business users: the owners of service businesses who create an Ordina account, and the team members they invite into it.
Clients: the customers of those businesses, who interact with a business’s public page, chat widget or WhatsApp number, and may provide details to make a booking, place an order, or leave a review.
Partners: people or organisations who refer businesses to Ordina through a partner code.

For client data submitted through a business’s booking page, that business is the data controller and Ordina acts as a processor on its behalf.

2. Information we collect

Information you provide

Account & profile: name, email address, phone number, business name, business details, services, pricing, and operating hours. We sign you in using a one-time code sent to your email (passwordless), so we do not store a password.
Booking and order information: client names, contact details, requested services or products, dates, times, delivery details, and any notes provided during a booking or order.
Conversations: the messages clients exchange with a business’s Secretary on its page, in an embedded widget, or on WhatsApp, and the messages business users exchange with their own Secretary in the dashboard. Business users can read, archive, download and delete their conversations.
Business page and reviews: the text, images and links you publish on your business page (including drafts the Service writes for you), and reviews clients leave after a visit. These are public.
Knowledge sources: text you enter, documents (e.g. PDFs) you upload, and website URLs you add. We extract and store their text so your assistant can answer client questions.
Business verification (KYB): if you apply for business verification, your legal business name, registration number, and the registration certificate you upload.
Identity verification (KYC): to enable payouts, our identity-verification provider collects and verifies your name, date of birth, address, a photo of a government-issued ID, and a short liveness check (a selfie video in which you follow on-screen prompts). The provider processes the images and video; we store the verification status and limited related details, not the documents or video, and use them only to confirm payout eligibility.
Team members: the name and email address of each team member a business invites, and which business they belong to.
Payout details: the account information needed to pay out money you collect, handled through our payment provider.
Payment information: when a payment is made, transaction metadata is processed by our payment provider. We do not store full card numbers.
Partner details: for partners, the contact email and label associated with a partner code, and records of referrals and reward earnings.
Communications & preferences: messages exchanged with the Ordina assistant, support enquiries, and your notification and marketing preferences.

Information collected automatically

Usage data: interactions with the Service, including booking-link visits and basic analytics.
Device & log data: IP address, browser type, and timestamps, used for security, rate-limiting, and abuse prevention. If you use our mobile app and enable notifications, we store a push-notification device token to deliver alerts.
Cookies: in the app itself we use only strictly necessary cookies, to keep you signed in and to operate the Service. There are no analytics or advertising trackers on booking pages, the chat widget, checkout, or the dashboard. Our marketing pages (the website, blog and these legal pages) use Google Tag Manager and a Reddit advertising pixel to measure where visitors come from and how our own advertising performs; you can block these with your browser or a content blocker without affecting the Service.
Usage analytics: anonymised product-usage data that helps us improve the Service. Business users can switch this off in Settings.

3. How we use information

To provide, operate, and maintain the Service and your account.
To power the Secretary, including processing your knowledge sources and conversations through AI providers to generate responses, extract booking and order details, and draft page copy or knowledge text when you ask it to. Our AI providers process this data to return a response and are not permitted to use it to train their models.
To publish your business page, and, if you opt in, to list your business in the Ordina directory and in search.
To collect and display reviews from clients after a visit.
To review business-verification (KYB) requests and manage the verified badge.
To verify identity (KYC) and enable payouts to businesses.
To process bookings and send confirmations, reminders, and notifications by email, SMS, WhatsApp (where enabled), and mobile push.
To process payments and payouts through our payment provider.
To operate the partner/referral program, including calculating and paying rewards and preventing abuse.
To send product updates and marketing emails to business users, who can opt out at any time (these are separate from transactional account and booking messages).
To secure the Service, prevent fraud and abuse, and enforce our Terms.
To respond to your requests, provide support, improve the Service, and comply with legal obligations.

Messaging on behalf of businesses. When a customer books through a business’s Ordina page, we send transactional booking confirmations and reminders by SMS (and, where enabled, WhatsApp) to the mobile number the customer provided for that booking, on the business’s behalf. These are not marketing messages. Recipients can opt out at any time by replying STOP. See our Messaging Policy for full opt-in and opt-out details.

We share information with trusted third parties only as needed to run the Service. These include:

Supabase: database, authentication, and private storage of application data (including verification documents).
AI providers: Google (Gemini), Cerebras, OpenRouter, Groq and Cencori process Secretary conversations and your knowledge content to generate responses and extract booking details; some requests are served by models we host ourselves. Requests are routed for speed and availability and are not used by any provider to train models.
Google: optional Google Calendar integration, if you connect it.
Dojah: identity verification (KYC) to enable payouts.
Twilio: delivery of SMS and, where enabled, WhatsApp notifications.
Zoho: delivery of transactional emails (account & booking).
Resend: delivery of product and marketing emails (with one-click unsubscribe).
Flutterwave and Bachs: payment processing, subscription billing and payouts. Which partner handles a payment depends on the currency.
Google Tag Manager and Reddit: analytics and advertising measurement on our marketing pages only, as described above.
Vercel: application hosting and infrastructure.

We do not sell your personal information. We may disclose information where required by law, to protect our rights, or in connection with a business transfer.

5. Google Workspace APIs and Limited Use

If you choose to connect your Google Calendar, Ordina requests access to your calendar through Google APIs solely to read your existing busy time blocks so the AI secretary does not offer clients a slot when you are already booked, and to write confirmed appointments to your calendar. You can disconnect this access at any time from your Ordina settings or from your Google Account permissions page.

Ordina’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy , including the Limited Use requirements.

In particular, data received from Google Workspace APIs is:

used only to provide or improve the calendar-availability and appointment features that are visible to you in the Ordina app;
never sold, and never used or transferred for advertising or any advertising-related purpose;
never used to train, fine-tune, or develop generalised or non-personalised artificial-intelligence or machine-learning models;
not read by any human except with your explicit consent for a specific message, where required for security or to comply with applicable law, or where the data has been aggregated and anonymised; and
transferred to others only as necessary to provide or improve these features, to comply with applicable law, or as part of a merger or acquisition.

6. Data retention

We retain information for as long as your account is active or as needed to provide the Service, comply with legal obligations (including financial and payout records), resolve disputes, and enforce agreements. When you delete your account, we delete or anonymise your personal data within a reasonable period, except where retention is required by law.

7. Your rights

Depending on your location (including under the Nigeria Data Protection Act / NDPR and, where applicable, the GDPR), you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Business users can download a copy of their business data and delete their account from Settings, switch off usage analytics, opt out of marketing emails via the unsubscribe link in any such email, or contact us using the details below. Clients can ask the business they dealt with, or us, to correct or delete their details.

8. Security

We use industry-standard measures to protect your data, including encryption in transit, row-level access controls, passwordless sign-in, optional two-factor authentication, and access logging. No method of transmission or storage is completely secure, but we work to protect your information and continuously improve our safeguards.

9. Children

The Service is not directed to children under 16, and we do not knowingly collect personal information from them.

10. International transfers

Your information may be processed in countries other than your own. Where we transfer data internationally, we take steps to ensure it remains protected in line with this policy and applicable law.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here and revise the “Last updated” date above. Material changes will be communicated where appropriate.

12. Contact us

For questions or to exercise your rights, contact us at help@useordina.com. Ordina Ltd is based in Nigeria.