Ordina← Back to home

Privacy Policy

Last updated: 22 June 2026

This Privacy Policy explains how Ordina Ltd(“Ordina,” “we,” “us,” or “our”) collects, uses, shares, and protects information in connection with the Ordina platform — an AI-powered secretary and booking service for service-based businesses (the “Service”). By using the Service, you agree to the practices described here.

1. Who this applies to

Ordina serves several groups of people, and this policy covers all of them:

  • Business users— the owners and staff of service businesses who create an Ordina account to manage bookings.
  • Clients— the customers of those businesses, who interact with a business’s public booking page and may provide details to make a booking.
  • Partners— people or organisations who refer businesses to Ordina through a partner code.

For client data submitted through a business’s booking page, that business is the data controller and Ordina acts as a processor on its behalf.

2. Information we collect

Information you provide

  • Account & profile: name, email address, phone number, business name, business details, services, pricing, and operating hours. We sign you in using a one-time code sent to your email (passwordless), so we do not store a password.
  • Booking information: client names, contact details, requested services, dates, times, and any notes provided during a booking.
  • Knowledge sources: text you enter, documents (e.g. PDFs) you upload, and website URLs you add. We extract and store their text so your assistant can answer client questions.
  • Business verification (KYB): if you apply for business verification, your legal business name, registration number, and the registration certificate you upload.
  • Identity verification (KYC): to enable payouts, our identity-verification provider may collect and verify identity details and government-issued identifiers (for example, an ID number). We store the verification status and limited related details, not full identity documents, and use them only to confirm payout eligibility.
  • Payout details: the account information needed to pay out money you collect, handled through our payment provider.
  • Payment information: when a payment is made, transaction metadata is processed by our payment provider. We do not store full card numbers.
  • Partner details: for partners, the contact email and label associated with a partner code, and records of referrals and reward earnings.
  • Communications & preferences: messages exchanged with the Ordina assistant, support enquiries, and your notification and marketing preferences.

Information collected automatically

  • Usage data: interactions with the Service, including booking-link visits and basic analytics.
  • Device & log data: IP address, browser type, and timestamps, used for security, rate-limiting, and abuse prevention. If you use our mobile app and enable notifications, we store a push-notification device token to deliver alerts.
  • Cookies: we use strictly necessary cookies to keep you signed in and to operate the Service. We do not use advertising cookies.

3. How we use information

  • To provide, operate, and maintain the Service and your account.
  • To power the AI assistant, including processing your knowledge sources and messages through AI providers to generate responses and extract booking details.
  • To review business-verification (KYB) requests and manage the verified badge.
  • To verify identity (KYC) and enable payouts to businesses.
  • To process bookings and send confirmations, reminders, and notifications by email, SMS, WhatsApp (where enabled), and mobile push.
  • To process payments and payouts through our payment provider.
  • To operate the partner/referral program, including calculating and paying rewards and preventing abuse.
  • To send product updates and marketing emails to business users, who can opt out at any time (these are separate from transactional account and booking messages).
  • To secure the Service, prevent fraud and abuse, and enforce our Terms.
  • To respond to your requests, provide support, improve the Service, and comply with legal obligations.

Messaging on behalf of businesses.When a customer books through a business’s Ordina page, we send transactional booking confirmations and reminders by SMS (and, where enabled, WhatsApp) to the mobile number the customer provided for that booking, on the business’s behalf. These are not marketing messages. Recipients can opt out at any time by replying STOP. See our Messaging Policy for full opt-in and opt-out details.

4. Service providers we share data with

We share information with trusted third parties only as needed to run the Service. These include:

  • Supabase — database, authentication, and private storage of application data (including verification documents).
  • Google — AI processing (Gemini) of assistant messages and your knowledge content to generate responses and extract booking details; and optional Google Calendar integration, if you connect it.
  • Dojah — identity verification (KYC) to enable payouts.
  • Twilio — delivery of SMS and, where enabled, WhatsApp notifications.
  • Zoho — delivery of transactional emails (account & booking).
  • Resend — delivery of product and marketing emails (with one-click unsubscribe).
  • Flutterwave — payment processing and payouts.
  • Vercel — application hosting and infrastructure.

We do not sell your personal information. We may disclose information where required by law, to protect our rights, or in connection with a business transfer.

5. Google Workspace APIs and Limited Use

If you choose to connect your Google Calendar, Ordina requests access to your calendar through Google APIs solely to read your existing busy time blocks so the AI secretary does not offer clients a slot when you are already booked, and to write confirmed appointments to your calendar. You can disconnect this access at any time from your Ordina settings or from your Google Account permissions page.

Ordina’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, data received from Google Workspace APIs is:

  • used only to provide or improve the calendar-availability and appointment features that are visible to you in the Ordina app;
  • never sold, and never used or transferred for advertising or any advertising-related purpose;
  • never used to train, fine-tune, or develop generalised or non-personalised artificial-intelligence or machine-learning models;
  • not read by any human except with your explicit consent for a specific message, where required for security or to comply with applicable law, or where the data has been aggregated and anonymised; and
  • transferred to others only as necessary to provide or improve these features, to comply with applicable law, or as part of a merger or acquisition.

6. Data retention

We retain information for as long as your account is active or as needed to provide the Service, comply with legal obligations (including financial and payout records), resolve disputes, and enforce agreements. When you delete your account, we delete or anonymise your personal data within a reasonable period, except where retention is required by law.

7. Your rights

Depending on your location (including under the Nigeria Data Protection Act / NDPR and, where applicable, the GDPR), you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Business users can delete their account from within the app, opt out of marketing emails via the unsubscribe link in any such email, or contact us using the details below.

8. Security

We use industry-standard measures to protect your data, including encryption in transit, row-level access controls, passwordless sign-in, optional two-factor authentication, and access logging. No method of transmission or storage is completely secure, but we work to protect your information and continuously improve our safeguards.

9. Children

The Service is not directed to children under 16, and we do not knowingly collect personal information from them.

10. International transfers

Your information may be processed in countries other than your own. Where we transfer data internationally, we take steps to ensure it remains protected in line with this policy and applicable law.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here and revise the “Last updated” date above. Material changes will be communicated where appropriate.

12. Contact us

For questions or to exercise your rights, contact us at help@useordina.com. Ordina Ltd is based in Nigeria.