Privacy Policy

− Removed: This policy explains what information OrderDen, LLC ("OrderDen," "we," "us") collects, how we use it, who we share it with, and the choices you have. It covers our website at orderden.com, the OrderDen web application, the client portal, public order forms, and our API (together, the "Service").

− Removed:

− Removed: OrderDen is a business tool. It is offered only to businesses and individuals acting for a business, located in the United States, who are 18 or older.

− Removed:

− Removed: ## Who this policy applies to, and our role

− Removed:

− Removed: OrderDen handles two kinds of information, and our role is different for each.

− Removed:

− Removed: **Information about our customers.** When a business signs up for OrderDen, that business (and its team members) are our customers. We decide how to use their account, billing and usage information. This policy governs that information.

− Removed:

− Removed: **Information our customers put into OrderDen about their own clients.** Our customers use OrderDen to manage orders, quotes, invoices and client relationships. That includes contact details, order history and files belonging to their clients ("Customer Data"). For Customer Data, we act as a service provider (sometimes called a processor) to the business that uses OrderDen. We process it only to provide the Service to that business, as described in our [Terms of Service](/terms) and this policy.

− Removed:

− Removed: **If you are a client of a business that uses OrderDen** (for example, you submitted an order form, received an invoice, or logged into a client portal), the business you dealt with controls your information. Their own privacy policy governs how they use it. Please send requests about your information to that business. If you contact us instead, we will refer you to them and help them respond.

− Removed:

− Removed: ## Information we collect

− Removed:

− Removed: ### Information you give us

− Removed:

− Removed: - **Account information:** name, email address, password (stored only as a one-way hash), business name, and two-factor authentication settings.

− Removed: - **Workspace information:** team members you invite, their roles, and your workspace settings, including branding and appearance choices.

− Removed: - **Billing information:** your subscription plan, number of seats, subscription status and the amounts charged. Payments for OrderDen plans are handled entirely by Stripe: you enter your card and billing address on Stripe's own payment page, and we never receive or store your card number, card details or billing address. We send Stripe your business name, email address and address so it can bill you.

− Removed: - **Customer Data:** the information you enter or collect through the Service about your clients, orders and business, including client names, email addresses, phone numbers, shipping and billing addresses, order details, quotes, invoices, pricing, notes, inventory and materials data, and files you or your clients upload (for example, 3D model files, artwork, logos and photos).

− Removed: - **Shipping information:** if you buy shipping labels in OrderDen, with your own shipping account or through ours, the sender and recipient names and addresses, package details and tracking information needed to create and track shipments.

− Removed: - **Support communications:** messages you send us and the information you include in them.

− Removed:

− Removed: ### Information from your clients

− Removed:

− Removed: When your clients use a public order form, view an invoice or status page, or sign into your client portal, we collect what they submit (such as name, email, phone, address, order details and file uploads) and portal login information. If your client saves a card or bank account for future payments, it is saved in your connected Stripe account; we keep only the type, brand or bank name, last four digits and expiry, never the full number, along with the exact consent wording your client agreed to, when, and the IP address it came from. We process all of this as Customer Data on your behalf.

− Removed:

− Removed: ### Information collected automatically

− Removed:

− Removed: - **Sign-in sessions:** when you or a portal user signs in, we store the session along with the IP address and browser user agent, to keep you signed in and to help detect suspicious sign-ins.

− Removed: - **Terms acceptance:** when you accept our Terms and this policy, we record which version you accepted, when, and the IP address and browser user agent the acceptance came from, as a record of the agreement.

− Removed: - **Signatures:** when your client signs a quote or other document, we record the time, the IP address and the browser user agent it came from, as evidence of the signature. This is Customer Data.

− Removed: - **Abuse prevention:** on public forms and password-reset requests, we store a keyed hash of the IP address (not the address itself) to limit spam and abuse.

− Removed: - **API request logs:** for calls to our API, we log the workspace, the API key used, the method, endpoint, response status and timing, to monitor performance, reliability and misuse. We don't log the IP address of API calls.

− Removed: - **Feature usage:** we count, in aggregate, which features workspaces use (for example, how many quotes were converted to orders). We derive these counts from data already stored in the Service. We do not collect page views or click tracking, and we do not read individual workspaces' content for this purpose.

− Removed:

− Removed: ### Information from connected services

− Removed:

− Removed: You can choose to connect third-party accounts. We only receive what's needed for the feature you turn on, and you can disconnect at any time.

− Removed:

− Removed: - **Stripe and PayPal (for invoice payments):** when you connect your own Stripe or PayPal account, we receive account identifiers and access credentials that let us create invoices, payment links and payment status updates on your behalf. Payments from your clients go directly to your account with that provider. OrderDen does not receive, hold or transmit those funds.

− Removed: - **Google and Microsoft email:** if you connect Gmail or Outlook, we use it only to send messages you create in OrderDen (such as invoices, quotes and order updates) from your address. We read your account's email address and name, to show which mailbox is connected. We do not read, store or analyze the contents of your mailbox.

− Removed: - **Google Calendar:** if you connect Google Calendar, we create a separate OrderDen calendar in your account and keep an all-day event in it for each order's due date, updating and removing events as the orders change. We don't read or change your other calendars.

− Removed: - **Google Drive and Dropbox:** if you connect one as your workspace's file storage, the files you and your clients upload to OrderDen are saved to an "OrderDen attachments" folder in that account instead of our own storage, and read back from there when needed. On Google Drive we can access only the files OrderDen created. Files already there stay there if you disconnect.

− Removed: - **Google sign-in** (when available): we receive your name, email address and profile picture from Google to create and sign in to your account.

− Removed:

− Removed: ## Cookies and similar technologies

− Removed:

− Removed: OrderDen uses first-party cookies that the Service needs to work. We do not use advertising cookies, tracking pixels, or third-party analytics scripts.

− Removed:

− Removed: | Cookie | Purpose |

− Removed: |---|---|

− Removed: | Session cookie (`better-auth.session_token`) | Keeps you signed in |

− Removed: | Short-lived sign-in cookies (`better-auth.*`) | Support the sign-in, two-factor authentication, passkey and "remember this device" steps |

− Removed: | Client portal session (one per workspace, scoped to that workspace's portal) | Keeps your clients signed in to your client portal |

− Removed: | Connection state cookies (`od_*_state`) | Protect against request forgery while you connect Google, Microsoft, Dropbox, Stripe or PayPal. Deleted once the connection completes |

− Removed: | Appearance cookies (`on-theme`, `on-accent`, `on-accent-minor`) | Remember the theme and accent colors you picked in Settings |

− Removed: | Staff console session (`orderden-staff.*`) | Keeps OrderDen staff signed in to our internal console. Never set for customers |

− Removed:

− Removed: **Payment pages.** When one of your clients pays an invoice or saves a payment method in your client portal, the page loads Stripe's or PayPal's own payment script, served by them, so that card and account details go straight to them and never to us. Those scripts may set their own cookies and collect device information for fraud prevention, under [Stripe's](https://stripe.com/privacy) and [PayPal's](https://www.paypal.com/us/legalhub/privacy-full) privacy policies. They load only on those payment pages.

− Removed:

− Removed: Because our cookies are necessary for the Service or remember a choice you made, and the payment providers' cookies are needed to take a payment safely, we don't show a cookie consent banner. You can block or delete cookies in your browser, but you won't be able to sign in without them.

− Removed:

− Removed: **Do Not Track and Global Privacy Control.** We don't track you across other websites or share information for targeted advertising, so we don't change our practices in response to Do Not Track or Global Privacy Control signals. There is nothing for those signals to turn off.

− Removed:

− Removed: ## How we use information

− Removed:

− Removed: We use information to:

− Removed:

− Removed: - provide, maintain and secure the Service, including sending the emails, invoices and notifications you set up;

− Removed: - process subscription payments and shipping label purchases;

− Removed: - carry out actions you request through connected services;

− Removed: - provide customer support, including troubleshooting problems in your workspace;

− Removed: - detect, prevent and respond to fraud, abuse, security incidents and violations of our Terms;

− Removed: - understand, in aggregate, which features are used, so we can decide what to build and improve;

− Removed: - send you service messages (such as receipts, security alerts and changes to our terms) and, if you haven't opted out, occasional product updates; and

− Removed: - comply with legal obligations and enforce our agreements.

− Removed:

− Removed: We use Customer Data only to provide the Service to the business it belongs to, to support and secure the Service, and as required by law. We do not sell Customer Data, use it to advertise to your clients, contact your clients for our own purposes, or use it to train artificial intelligence models.

− Removed:

− Removed: **Staff access.** OrderDen staff may access a workspace, including by signing in as a user, only to provide support, investigate and fix problems, protect the security of the Service, or comply with legal obligations. Staff access is logged.

− Removed:

− Removed: ## How we share information

− Removed:

− Removed: We do not sell personal information, and we do not share it for targeted advertising. We share information only as described below.

− Removed:

− Removed: **Service providers.** We use the following companies to run the Service. They may process personal information only on our instructions.

− Removed:

− Removed: | Provider | Purpose |

− Removed: |---|---|

− Removed: | DigitalOcean | Application hosting and database, and storage for our database backups (Spaces) |

− Removed: | Cloudflare | File storage (R2) for uploads and attachments |

− Removed: | Amazon Web Services | Sending email from the Service, and delivery and bounce notices for it (Amazon SES and SNS) |

− Removed: | Stripe | Subscription billing and payment processing for OrderDen plans |

− Removed: | Purelymail | Our support email inbox |

− Removed: | Shipping partners (EasyPost, Easyship, Shippo) and the carriers they use | Creating shipping labels and tracking shipments, when you use shipping features |

− Removed: | Slack and Microsoft Teams | Internal alerts to our own staff about the Service, which can include a new workspace's name, or the email address and message of somebody who sent us feedback |

− Removed: | Browser push services (run by your browser's maker, such as Google, Apple or Mozilla) | Delivering the notifications you turn on in your browser. Each notification is encrypted so the push service cannot read it |

− Removed: | Help desk provider (planned) | Managing support requests, once our support portal launches |

− Removed:

− Removed: We will update this list when we add or change providers.

− Removed:

− Removed: Receipts and purchase orders you scan are read by software on our own servers; the images are not sent to an outside service.

− Removed:

− Removed: **Services you connect.** When you connect Stripe, PayPal, Google, Microsoft or Dropbox, we send information to those services as needed to carry out what you ask (for example, creating an invoice in your Stripe account, sending an email from your Gmail, or adding a calendar event). Their own terms and privacy policies govern what they do with it.

− Removed:

− Removed: **Within your workspace and with your clients.** Information in your workspace is visible to your team members according to their roles. Information you choose to show your clients (such as invoices, order status and portal content) is visible to them.

− Removed:

− Removed: **Legal reasons.** We may disclose information if we believe in good faith it's required by law, subpoena or court order, or needed to protect the rights, safety or property of OrderDen, our customers or others.

− Removed:

− Removed: **Business transfers.** If OrderDen is involved in a merger, acquisition or sale of assets, information may be transferred as part of that deal. We will require the recipient to honor this policy or give you notice and a chance to delete your account.

− Removed:

− Removed: ## Google API data

− Removed:

− Removed: OrderDen's use and transfer to any other app of information received from Google APIs will adhere to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

− Removed:

− Removed: Specifically, we use Google user data only to provide the features you enabled (sending email you create, keeping order due dates in the OrderDen calendar, and storing your workspace's files in the OrderDen folder on your Drive). We do not use it for advertising, we do not sell it, we do not use it to train AI models, and our staff do not read it except with your permission, for security purposes, or to comply with law.

− Removed:

− Removed: ## How long we keep information

− Removed:

− Removed: - **Active accounts:** we keep your information while your account exists.

− Removed: - **Canceled paid plans:** canceling a paid plan moves your workspace to the free tier. Your data stays in place.

− Removed: - **Inactive free workspaces:** if a free workspace has no sign-in activity for 12 months, we may delete it after giving the account owner at least 30 days' notice by email.

− Removed: - **Deleted accounts:** when an account owner deletes the workspace account, we immediately delete it from our active systems, along with its team member accounts, client portal accounts, Customer Data and uploaded files. Copies may remain in backups for up to 6 months before they are deleted.

− Removed: - **Records we must keep:** we keep billing and transaction records (such as invoices for your subscription and shipping label purchases) for as long as tax and accounting laws require. Stripe retains its own payment records under its policies.

− Removed: - **Sessions and logs:** sign-in sessions are removed when they expire or you sign out. API request logs are kept for 120 days, then moved to an archive in our own storage.

− Removed:

− Removed: ## Security

− Removed:

− Removed: We protect information with measures appropriate to a small software business, including encryption of data in transit (HTTPS), hashed passwords, optional two-factor authentication, access limited to staff who need it, and hosting with established infrastructure providers. No system is perfectly secure. If we learn of a security breach affecting your personal information, we will notify you as required by law.

− Removed:

− Removed: You are responsible for keeping your password secure and for the accounts of the team members you invite. We strongly recommend turning on two-factor authentication.

− Removed:

− Removed: ## Your choices and rights

− Removed:

− Removed: Wherever you live in the US, you can:

− Removed:

− Removed: - **access and export** your information and Customer Data from within the Service, or by asking us;

− Removed: - **correct** your account information in Settings;

− Removed: - **delete** your account and workspace from Settings, or by asking us;

− Removed: - **disconnect** any connected service at any time; and

− Removed: - **opt out** of product update emails using the unsubscribe link. Service messages, such as receipts and security alerts, can't be turned off while you have an account.

− Removed:

− Removed: Some state laws give residents additional rights, such as the right to know what personal information we collect and to not be discriminated against for exercising privacy rights. We honor those requests where the law applies to us. To make a request, email [email protected] from the address on your account. We may need to verify your identity before acting on a request. You may use an authorized agent, and we will ask for proof of their authority. If we deny a request, you can reply to appeal, and we will respond within the time required by law.

− Removed:

− Removed: If you are a client of a business that uses OrderDen, please contact that business. We will help them fulfill your request.

− Removed:

− Removed: ## Children

− Removed:

− Removed: The Service is not intended for anyone under 18, and we do not knowingly collect information from children. If you believe a child has given us personal information, contact us and we will delete it.

− Removed:

− Removed: ## Where we operate

− Removed:

− Removed: OrderDen is based in the United States and offers the Service only to US businesses. Our service providers process information in the United States and may process it in other countries where they operate.

− Removed:

− Removed: ## Changes to this policy

− Removed:

− Removed: We may update this policy as the Service changes. If we make material changes, we will notify account owners by email or in the app before the changes take effect. The "Last updated" date at the top shows when this policy last changed.

− Removed:

− Removed: ## Contact us

− Removed:

− Removed: OrderDen, LLC\

− Removed: 615 Peavine Firetower Rd\

− Removed: Crossville, TN 38571\

+ Added: This policy explains what information OrderDen, LLC ("OrderDen," "we," "us") collects, how we use it, who we share it with, and the choices you have. It covers our website at orderden.com, the OrderDen web application, the client portal, public order forms, and our API (together, the "Service").

+ Added:

+ Added: OrderDen is a business tool. It is offered only to businesses and individuals acting for a business, located in the United States, who are 18 or older.

+ Added:

+ Added: ## Who this policy applies to, and our role

+ Added:

+ Added: OrderDen handles two kinds of information, and our role is different for each.

+ Added:

+ Added: **Information about our customers.** When a business signs up for OrderDen, that business (and its team members) are our customers. We decide how to use their account, billing and usage information. This policy governs that information.

+ Added:

+ Added: **Information our customers put into OrderDen about their own clients.** Our customers use OrderDen to manage orders, quotes, invoices and client relationships. That includes contact details, order history and files belonging to their clients ("Customer Data"). For Customer Data, we act as a service provider (sometimes called a processor) to the business that uses OrderDen. We process it only to provide the Service to that business, as described in our [Terms of Service](/terms) and this policy.

+ Added:

+ Added: **If you are a client of a business that uses OrderDen** (for example, you submitted an order form, received an invoice, or logged into a client portal), the business you dealt with controls your information. Their own privacy policy governs how they use it. Please send requests about your information to that business. If you contact us instead, we will refer you to them and help them respond.

+ Added:

+ Added: ## Information we collect

+ Added:

+ Added: ### Information you give us

+ Added:

+ Added: - **Account information:** name, email address, password (stored only as a one-way hash), business name, and two-factor authentication settings.

+ Added: - **Workspace information:** team members you invite, their roles, and your workspace settings, including branding and appearance choices.

+ Added: - **Billing information:** your subscription plan, number of seats, subscription status and the amounts charged. Payments for OrderDen plans are handled entirely by Stripe: you enter your card and billing address on Stripe's own payment page, and we never receive or store your card number, card details or billing address. We send Stripe your business name, email address and address so it can bill you.

+ Added: - **Customer Data:** the information you enter or collect through the Service about your clients, orders and business, including client names, email addresses, phone numbers, shipping and billing addresses, order details, quotes, invoices, pricing, notes, inventory and materials data, and files you or your clients upload (for example, 3D model files, artwork, logos and photos).

+ Added: - **Shipping information:** if you buy shipping labels in OrderDen, with your own shipping account or through ours, the sender and recipient names and addresses, package details and tracking information needed to create and track shipments.

+ Added: - **Support communications:** messages you send us and the information you include in them.

+ Added:

+ Added: ### Information from your clients

+ Added:

+ Added: When your clients use a public order form, view an invoice or status page, or sign into your client portal, we collect what they submit (such as name, email, phone, address, order details and file uploads) and portal login information. If your client saves a card or bank account for future payments, it is saved in your connected Stripe account; we keep only the type, brand or bank name, last four digits and expiry, never the full number, along with the exact consent wording your client agreed to, when, and the IP address it came from. We process all of this as Customer Data on your behalf.

+ Added:

+ Added: ### Information collected automatically

+ Added:

+ Added: - **Sign-in sessions:** when you or a portal user signs in, we store the session along with the IP address and browser user agent, to keep you signed in and to help detect suspicious sign-ins.

+ Added: - **Terms acceptance:** when you accept our Terms and this policy, we record which version you accepted, when, and the IP address and browser user agent the acceptance came from, as a record of the agreement.

+ Added: - **Signatures:** when your client signs a quote or other document, we record the time, the IP address and the browser user agent it came from, as evidence of the signature. This is Customer Data.

+ Added: - **Abuse prevention:** on public forms and password-reset requests, we store a keyed hash of the IP address (not the address itself) to limit spam and abuse.

+ Added: - **API request logs:** for calls to our API, we log the workspace, the API key used, the method, endpoint, response status and timing, to monitor performance, reliability and misuse. We don't log the IP address of API calls.

+ Added: - **Feature usage:** we count, in aggregate, which features workspaces use (for example, how many quotes were converted to orders). We derive these counts from data already stored in the Service. We do not collect page views or click tracking, and we do not read individual workspaces' content for this purpose.

+ Added:

+ Added: ### Information from connected services

+ Added:

+ Added: You can choose to connect third-party accounts. We only receive what's needed for the feature you turn on, and you can disconnect at any time.

+ Added:

+ Added: - **Stripe and PayPal (for invoice payments):** when you connect your own Stripe or PayPal account, we receive account identifiers and access credentials that let us create invoices, payment links and payment status updates on your behalf. Payments from your clients go directly to your account with that provider. OrderDen does not receive, hold or transmit those funds.

+ Added: - **Google and Microsoft email:** if you connect Gmail or Outlook, we use it only to send messages you create in OrderDen (such as invoices, quotes and order updates) from your address. We read your account's email address and name, to show which mailbox is connected. We do not read, store or analyze the contents of your mailbox.

+ Added: - **Google Calendar:** if you connect Google Calendar, we create a separate OrderDen calendar in your account and keep an all-day event in it for each order's due date, updating and removing events as the orders change. We don't read or change your other calendars.

+ Added: - **Google Drive and Dropbox:** if you connect one as your workspace's file storage, the files you and your clients upload to OrderDen are saved to an "OrderDen attachments" folder in that account instead of our own storage, and read back from there when needed. On Google Drive we can access only the files OrderDen created. Files already there stay there if you disconnect.

+ Added: - **Google sign-in** (when available): we receive your name, email address and profile picture from Google to create and sign in to your account.

+ Added:

+ Added: ## Cookies and similar technologies

+ Added:

+ Added: OrderDen uses first-party cookies that the Service needs to work. We do not use advertising cookies, tracking pixels, or third-party analytics scripts.

+ Added:

+ Added: | Cookie | Purpose |

+ Added: |---|---|

+ Added: | Session cookie (`better-auth.session_token`) | Keeps you signed in |

+ Added: | Short-lived sign-in cookies (`better-auth.*`) | Support the sign-in, two-factor authentication, passkey and "remember this device" steps |

+ Added: | Client portal session (one per workspace, scoped to that workspace's portal) | Keeps your clients signed in to your client portal |

+ Added: | Connection state cookies (`od_*_state`) | Protect against request forgery while you connect Google, Microsoft, Dropbox, Stripe or PayPal. Deleted once the connection completes |

+ Added: | Appearance cookies (`on-theme`, `on-accent`, `on-accent-minor`) | Remember the theme and accent colors you picked in Settings |

+ Added: | Staff console session (`orderden-staff.*`) | Keeps OrderDen staff signed in to our internal console. Never set for customers |

+ Added:

+ Added: **Payment pages.** When one of your clients pays an invoice or saves a payment method in your client portal, the page loads Stripe's or PayPal's own payment script, served by them, so that card and account details go straight to them and never to us. Those scripts may set their own cookies and collect device information for fraud prevention, under [Stripe's](https://stripe.com/privacy) and [PayPal's](https://www.paypal.com/us/legalhub/privacy-full) privacy policies. They load only on those payment pages.

+ Added:

+ Added: Because our cookies are necessary for the Service or remember a choice you made, and the payment providers' cookies are needed to take a payment safely, we don't show a cookie consent banner. You can block or delete cookies in your browser, but you won't be able to sign in without them.

+ Added:

+ Added: **Do Not Track and Global Privacy Control.** We don't track you across other websites or share information for targeted advertising, so we don't change our practices in response to Do Not Track or Global Privacy Control signals. There is nothing for those signals to turn off.

+ Added:

+ Added: ## How we use information

+ Added:

+ Added: We use information to:

+ Added:

+ Added: - provide, maintain and secure the Service, including sending the emails, invoices and notifications you set up;

+ Added: - process subscription payments and shipping label purchases;

+ Added: - carry out actions you request through connected services;

+ Added: - provide customer support, including troubleshooting problems in your workspace;

+ Added: - detect, prevent and respond to fraud, abuse, security incidents and violations of our Terms;

+ Added: - understand, in aggregate, which features are used, so we can decide what to build and improve;

+ Added: - send you service messages (such as receipts, security alerts and changes to our terms) and, if you haven't opted out, occasional product updates; and

+ Added: - comply with legal obligations and enforce our agreements.

+ Added:

+ Added: We use Customer Data only to provide the Service to the business it belongs to, to support and secure the Service, and as required by law. We do not sell Customer Data, use it to advertise to your clients, contact your clients for our own purposes, or use it to train artificial intelligence models.

+ Added:

+ Added: **Staff access.** OrderDen staff may access a workspace, including by signing in as a user, only to provide support, investigate and fix problems, protect the security of the Service, or comply with legal obligations. Staff access is logged.

+ Added:

+ Added: ## How we share information

+ Added:

+ Added: We do not sell personal information, and we do not share it for targeted advertising. We share information only as described below.

+ Added:

+ Added: **Service providers.** We use the following companies to run the Service. They may process personal information only on our instructions.

+ Added:

+ Added: | Provider | Purpose |

+ Added: |---|---|

+ Added: | DigitalOcean | Application hosting and database, and storage for our database backups (Spaces) |

+ Added: | Cloudflare | File storage (R2) for uploads and attachments |

+ Added: | Amazon Web Services | Sending email from the Service, and delivery and bounce notices for it (Amazon SES and SNS) |

+ Added: | Stripe | Subscription billing and payment processing for OrderDen plans |

+ Added: | Purelymail | Our support email inbox |

+ Added: | Shipping partners (EasyPost, Easyship, Shippo) and the carriers they use | Creating shipping labels and tracking shipments, when you use shipping features |

+ Added: | Slack and Microsoft Teams | Internal alerts to our own staff about the Service, which can include a new workspace's name, or the email address and message of somebody who sent us feedback |

+ Added: | Browser push services (run by your browser's maker, such as Google, Apple or Mozilla) | Delivering the notifications you turn on in your browser. Each notification is encrypted so the push service cannot read it |

+ Added: | Help desk provider (planned) | Managing support requests, once our support portal launches |

+ Added:

+ Added: We will update this list when we add or change providers.

+ Added:

+ Added: Receipts and purchase orders you scan are read by software on our own servers; the images are not sent to an outside service.

+ Added:

+ Added: **Services you connect.** When you connect Stripe, PayPal, Google, Microsoft or Dropbox, we send information to those services as needed to carry out what you ask (for example, creating an invoice in your Stripe account, sending an email from your Gmail, or adding a calendar event). Their own terms and privacy policies govern what they do with it.

+ Added:

+ Added: **Within your workspace and with your clients.** Information in your workspace is visible to your team members according to their roles. Information you choose to show your clients (such as invoices, order status and portal content) is visible to them.

+ Added:

+ Added: **Legal reasons.** We may disclose information if we believe in good faith it's required by law, subpoena or court order, or needed to protect the rights, safety or property of OrderDen, our customers or others.

+ Added:

+ Added: **Business transfers.** If OrderDen is involved in a merger, acquisition or sale of assets, information may be transferred as part of that deal. We will require the recipient to honor this policy or give you notice and a chance to delete your account.

+ Added:

+ Added: ## Google API data

+ Added:

+ Added: OrderDen's use and transfer to any other app of information received from Google APIs will adhere to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

+ Added:

+ Added: Specifically, we use Google user data only to provide the features you enabled (sending email you create, keeping order due dates in the OrderDen calendar, and storing your workspace's files in the OrderDen folder on your Drive). We do not use it for advertising, we do not sell it, we do not use it to train AI models, and our staff do not read it except with your permission, for security purposes, or to comply with law.

+ Added:

+ Added: ## How long we keep information

+ Added:

+ Added: - **Active accounts:** we keep your information while your account exists.

+ Added: - **Canceled paid plans:** canceling a paid plan moves your workspace to the free tier. Your data stays in place.

+ Added: - **Inactive free workspaces:** if a free workspace has no sign-in activity for 12 months, we may delete it after giving the account owner at least 30 days' notice by email.

+ Added: - **Deleted accounts:** when an account owner deletes the workspace account, we immediately delete it from our active systems, along with its team member accounts, client portal accounts, Customer Data and uploaded files. Copies may remain in backups for up to 6 months before they are deleted.

+ Added: - **Records we must keep:** we keep billing and transaction records (such as invoices for your subscription and shipping label purchases) for as long as tax and accounting laws require. Stripe retains its own payment records under its policies.

+ Added: - **Sessions and logs:** sign-in sessions are removed when they expire or you sign out. API request logs are kept for 120 days, then moved to an archive in our own storage.

+ Added:

+ Added: ## Security

+ Added:

+ Added: We protect information with measures appropriate to a small software business, including encryption of data in transit (HTTPS), hashed passwords, optional two-factor authentication, access limited to staff who need it, and hosting with established infrastructure providers. No system is perfectly secure. If we learn of a security breach affecting your personal information, we will notify you as required by law.

+ Added:

+ Added: You are responsible for keeping your password secure and for the accounts of the team members you invite. We strongly recommend turning on two-factor authentication.

+ Added:

+ Added: ## Your choices and rights

+ Added:

+ Added: Wherever you live in the US, you can:

+ Added:

+ Added: - **access and export** your information and Customer Data from within the Service, or by asking us;

+ Added: - **correct** your account information in Settings;

+ Added: - **delete** your account and workspace from Settings, or by asking us;

+ Added: - **disconnect** any connected service at any time; and

+ Added: - **opt out** of product update emails using the unsubscribe link. Service messages, such as receipts and security alerts, can't be turned off while you have an account.

+ Added:

+ Added: Some state laws give residents additional rights, such as the right to know what personal information we collect and to not be discriminated against for exercising privacy rights. We honor those requests where the law applies to us. To make a request, email [email protected] from the address on your account. We may need to verify your identity before acting on a request. You may use an authorized agent, and we will ask for proof of their authority. If we deny a request, you can reply to appeal, and we will respond within the time required by law.

+ Added:

+ Added: If you are a client of a business that uses OrderDen, please contact that business. We will help them fulfill your request.

+ Added:

+ Added: ## Children

+ Added:

+ Added: The Service is not intended for anyone under 18, and we do not knowingly collect information from children. If you believe a child has given us personal information, contact us and we will delete it.

+ Added:

+ Added: ## Where we operate

+ Added:

+ Added: OrderDen is based in the United States and offers the Service only to US businesses. Our service providers process information in the United States and may process it in other countries where they operate.

+ Added:

+ Added: ## Changes to this policy

+ Added:

+ Added: We may update this policy as the Service changes. If we make material changes, we will notify account owners by email or in the app before the changes take effect. The "Last updated" date at the top shows when this policy last changed.

+ Added:

+ Added: ## Contact us

+ Added:

+ Added: OrderDen, LLC\

+ Added: 615 Peavine Firetower Rd\

+ Added: Crossville, TN 38571\

[email protected]