1. Who we are
Ordafy Limited (“we”, “us”, “our”), registered in England and Wales (company number 16063522), is the data controller for the Ordafy platform. This policy explains how we collect, use and protect your personal data and your rights.
2. Scope (Ordafy platform)
This policy applies across the Ordafy platform and features accessible via ordafy.com and business.ordafy.com, including customer experiences (Shop under /shop) and merchant experiences (Business tools, Pay by Link, POS).
3. What we collect
We collect: (a) information you give us (e.g. name, email, address, payment details when you register, order or contact us); (b) usage and device data (e.g. IP address, browser type, pages visited, actions in our apps); (c) cookies and similar technologies as set out in our Cookie Policy. We may also receive data from third parties (e.g. payment providers, analytics) where permitted by law.
Payments: Card payments are processed by Stripe. We do not store full card numbers or CVV on Ordafy servers. Stripe may process data according to its own privacy notice. For how charges, settlement and payouts work on the marketplace, see our Payments & payouts page. Platform subscription billing for merchants is described in section 10 below.
4. How we use data (legal basis and purposes)
We process your data on the basis of: contract (to provide the services you use); consent (where we ask for it, e.g. marketing); legal obligation; and our legitimate interests (e.g. security, improving services, fraud prevention). We use data to operate and improve the platform, process orders and payments, communicate with you, comply with law, and enforce our terms.
5. Retention
We keep your data only as long as needed for the purposes above, for legal or regulatory requirements, or to resolve disputes. Account and transaction data are typically retained for the duration of the relationship and for a period thereafter as required by law (e.g. tax). You can request erasure subject to the exceptions in the “Your rights” section.
6. Sharing and international transfer
We may share data with: service providers (hosting, payments, analytics, support) who process on our instructions; professional advisers; and authorities when required by law. Some providers may be outside the UK/EEA; we ensure appropriate safeguards (e.g. standard contractual clauses or adequacy decisions) where required. We do not sell your personal data.
7. Your rights
Under UK and EU data protection law you have the right to: access your data; have inaccuracies corrected; request erasure (“right to be forgotten”) in certain cases; restrict or object to processing; data portability; and withdraw consent where processing is based on consent. You may also lodge a complaint with a supervisory authority (e.g. the ICO in the UK). To exercise these rights, contact us using the details at the end of this policy or via the relevant product’s settings or support.
8. Deleting your account
You may request deletion of your Ordafy account and associated personal data at any time. To do so: use the account or profile settings in the product where you signed up (e.g. Ordafy Shop, Business dashboard, or auth service), or contact us using the details below. For product-by-product steps and what we delete or retain, see our Delete your Ordafy account page. We will process the request in line with applicable law and may retain certain data where we have a legal obligation or legitimate interest (e.g. fraud, tax). Deletion may affect your ability to use other Ordafy products linked to the same account. Product-specific account deletion options are described in each product’s privacy notice where applicable.
9. Cookies
We use cookies and similar technologies as described in our Cookie Policy. That policy explains types of cookies, how to manage them, and how they are used across our products.
10. Subscription billing (Ordafy Business)
If you subscribe to Ordafy Pro, Business+, or Enterprise for a Business Group, we process:
- Account and billing contact details (name, email, business identifiers) of users who manage billing.
- Subscription plan, status, billing interval, renewal dates, and usage against plan limits (locations, storage, team seats).
- Payment metadata from Stripe Billing (customer id, subscription id, invoice references). We do not store full card numbers on Ordafy servers.
We use this data to provide the subscription, enforce plan limits, send billing and lifecycle emails (e.g. payment failed, trial ending), prevent fraud, and comply with law. Legal bases include contract performance and legitimate interests. Stripe acts as a processor for payment data under its privacy notice.
See our Business subscriptions & billing terms for cancellation and retention of access after you stop paying.
10. Ordafy Shop (marketplace) — data practices
When you use Ordafy Shop (discovery, product orders, service bookings, reviews, affiliate activity), we process account and profile data, listing and booking details, messages, payment references (card data via Stripe), device/usage logs, and content you post. Providers additionally supply inventory, pricing, policies, and payout/Stripe Connect onboarding data. We use this data to operate the marketplace, settle payments, prevent fraud, and meet legal obligations — consistent with sections 3–7 above.
11. Pay by Link — data practices
For Pay by Link on business.ordafy.com/pay, we may process: merchant/org identifiers, link metadata (amounts, line descriptions, currency), optional customer email fields you attach to a link, audit timestamps, and payer technical data (IP, device/browser) needed for Checkout. Card data is handled by Stripe; we do not store full card numbers or CVV on Ordafy servers. Stripe may act as processor or independent controller for certain fraud/compliance processing — see Stripe's privacy notice. Retention follows financial, tax, and dispute needs as described in section 6.
13. Contact
For privacy enquiries, to exercise your rights, or to request account deletion, contact Ordafy Limited: +44 191 323 5433 · privacy@ordafy.com. For general support: info@ordafy.com. We will respond within the timeframes required by law.