Ordavela Privacy Notice
Version 1.0 | Effective 8 November 2026 | Aurican Analytics Ltd
This notice explains how Aurican Analytics Ltd handles personal information in connection with Ordavela, our service that reads purchase orders and sends approved orders to a business's ERP system. It is written for the people who visit our website, sign up, use Ordavela, or contact us.
1. Who we are
Aurican Analytics Ltd ("Aurican", "we", "us") is a company registered in England and Wales, company number 16686611, registered office 27 Old Gloucester Street, London WC1N 3AX, United Kingdom.
Contact for anything about privacy: privacy@ordavela.com.
2. Two different roles
Information about you and your account (we decide how it is used). For account, sign-in, billing, support and website information, Aurican is the controller. This notice covers that information.
Information inside your business's orders (your business decides). When a business uses Ordavela, the purchase orders, emails, attachments, catalogues and order data it sends to Ordavela ("Customer Data") belong to that business. For Customer Data, the business is the controller and Aurican is its processor, acting only on its instructions under our Data Processing Agreement. If your details appear in a purchase order (for example, as a buyer or delivery contact), please contact the business that uses Ordavela. Their privacy notice applies, and we will help them respond.
3. What we collect, and why
| Information | Examples | Why we use it | Legal basis (UK and EU GDPR) |
|---|---|---|---|
| Sign-up details | Your name, work email, company name, country, industry, which ERP and email provider your business uses, the data region you choose | To set up your trial and account, offer the right region and currency, and understand which systems our customers use | Taking steps to enter into a contract; our legitimate interest in understanding demand |
| Account and user details | Names, work email addresses and roles of the people your business adds | To let them sign in and use Ordavela with the right permissions | Contract |
| Sign-in details | How you sign in (Microsoft, Google, password, or emailed link). For Microsoft or Google sign-in: the name, email address and account identifier they share with us. For passwords: a scrambled (hashed) copy of your password, never the password itself. If you use an authenticator app: its set-up key, stored encrypted | To sign you in securely and keep accounts safe | Contract; legitimate interest in security |
| Security records | Sign-in times, the browser used, failed attempts, and staff access to accounts | To protect accounts, spot misuse, and tell you about new sign-ins | Legitimate interest in security; legal obligation |
| Billing details | Billing contact, plan, invoices. Card details are collected and held by our payment provider, Stripe, not by us | To charge for subscriptions and keep tax records | Contract; legal obligation |
| Service health counts | Counts and times such as orders read or waiting, and when a mailbox was last checked. Never order content | To spot and fix problems with the service | Legitimate interest in running a reliable service |
| Messages to us | Emails and support requests | To answer you | Contract; legitimate interest |
| Website | Information your browser sends when you visit (such as IP address and pages requested), kept in short-lived server logs | To run and protect the website | Legitimate interest |
Cookies. Ordavela uses only cookies that are strictly necessary to keep you signed in and protect forms from misuse. We don't use advertising or tracking cookies. If that changes, we will ask for your consent first.
Checking for breached passwords. When you choose a password, we check whether it has appeared in a known data breach. We send only the first five characters of a scrambled code of the password to the Pwned Passwords service (run by Have I Been Pwned with Cloudflare). Neither the password nor your email address is sent.
We don't sell personal information, use it for advertising, or use it to train AI models.
4. Google and Microsoft data
Sign in with Google or Microsoft. If you sign in with Google or Microsoft, we receive only your name, email address and account identifier, and use them only to sign you in.
Connected mailboxes. If your business connects a Microsoft 365 or Google Workspace mailbox, Ordavela reads new emails in the folder or label your business chooses, only to find purchase orders and process them for your business. That email content is Customer Data (section 2).
Google API Services User Data Policy. Ordavela's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, information from Gmail is used only to provide Ordavela's order-reading features to the business that connected the mailbox. It is not used for advertising or for credit or lending decisions, not sold, not used to train generalised AI or machine-learning models, and not read by people except with the business's permission for support, where needed for security, or where the law requires.
5. Who we share it with
We share personal information only with service providers who help us run Ordavela, under contracts that protect it:
| Provider | What they do for us | Where |
|---|---|---|
| Microsoft (Azure, Azure Communication Services) | Hosting Ordavela, and sending sign-in and password emails, in your business's data region | United Kingdom, European Union or United States, as your business chooses |
| Supabase | Our account database | United Kingdom (London) |
| Vercel | Hosting our website, sign-up page and account system | United States |
| Stripe | Billing and payments | United Kingdom entity; may process in the United States |
| Resend | Sending our own service emails (for example sign-up confirmation and trial reminders) | United States |
| Google, Microsoft | Sign-in, if you choose to sign in with them | Under their own terms |
We may also share information if the law requires it, to protect our rights or users' safety, or as part of a sale or reorganisation of our business (in which case we will tell you).
6. International transfers
Some providers are outside the UK or the European Economic Area. Where the law requires it, we protect those transfers with an adequacy decision or regulation, the EU–US Data Privacy Framework (including its UK Extension) where the provider is certified, or standard contractual clauses (the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses). You can ask us for details.
7. How long we keep it
| Information | How long |
|---|---|
| Account, user and sign-in details | While the account is open, then deleted within 30 days after it ends (after the 30-day export period) |
| Trial sign-ups that don't become customers | Deleted within 30 days after the export period following the trial |
| Security records | 12 months |
| Billing records | 6 years, for UK tax law |
| Website server logs | 30 days |
| Messages to us | As long as needed to deal with them, then up to 2 years |
Customer Data is kept for the periods each business sets in Ordavela (see our Data Processing Agreement).
8. Your rights
Depending on where you are, you may have the right to ask for a copy of your personal information; to have it corrected or deleted; to restrict or object to how we use it (including where we rely on legitimate interests); to have it moved to another provider; and to withdraw consent where we rely on consent. To use these rights, email privacy@ordavela.com. We will reply within one month. We may need to confirm who you are first.
US residents. Depending on your state, you may have rights to know, correct and delete personal information, and to opt out of its sale or sharing. We don't sell or share personal information for cross-context behavioural advertising. We won't treat you differently for using your rights.
Complaints. You can complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority. We'd appreciate the chance to help first.
9. Security
We protect personal information with measures such as encryption in transit and at rest, keeping each business's data separate, signing in services without stored passwords, multi-factor sign-in for our staff, and recording staff access to accounts. More detail is in Annex B of our Data Processing Agreement.
10. Children
Ordavela is for businesses. It is not meant for children, and we don't knowingly collect children's information.
11. Changes to this notice
We will post any changes here with a new version number and date, and tell account admins about important changes by email or in Ordavela.