This Privacy Policy describes how OrderDesk ("we", "us", "our") collects, uses, stores, and protects your data when you use our smart manufacturing work order system (the "Service"). As a multi-tenant SaaS platform serving manufacturing businesses, we treat your production data, customer information, and financial records with the highest level of care and isolation.
1. Data Collection Philosophy
OrderDesk follows a minimal data collection principle. We collect only the information necessary to operate the Service, manage your account, and provide customer support. We do not sell your data, we do not use your data for advertising, and we do not share your business data with third parties for marketing purposes.
As a multi-tenant SaaS platform, each tenant's data is logically isolated from all other tenants. Your production orders, customer lists, inventory records, and financial data are never accessible to other tenants or used for any purpose other than providing the Service to you.
2. Information We Collect
We collect the following categories of information:
- Account information — company name, email address, name of account owner, and password hash. Collected when you register for an account.
- Business data — work orders, sales orders, purchase orders, inventory records, BOMs, customer and supplier information, production reporting data, scrap records, financial records, and any other data you enter into the system. This data belongs to you and is stored in your tenant's isolated data space.
- Usage data — anonymized information about how you use the Service, including feature usage patterns, error logs, and performance metrics. This data is used to improve the Service and is not linked to your specific business data.
- Website analytics — anonymized page views, session duration, and referral sources via Google Analytics (GA4) with forced IP anonymization. No personally identifiable information is collected.
- Email subscription data — if you subscribe to our newsletter or product updates, we store your email address and subscription preferences.
We do not collect: payment card information (processed securely by our payment processor), government identification numbers, or any data not explicitly described above.
3. How We Use Your Information
Your information is used exclusively for the following purposes:
- Providing the Service — storing and processing your business data to operate the work order system, including work order management, production tracking, inventory management, and reporting.
- Account management — authentication, access control, billing, and subscription management.
- Customer support — responding to your inquiries, troubleshooting issues, and providing technical assistance.
- Service improvement — analyzing anonymized usage patterns to improve features, performance, and reliability.
- Security — monitoring for unauthorized access, detecting anomalies, and maintaining audit logs.
- Communications — sending service notifications, product updates, and (if subscribed) marketing emails. You can opt out of marketing emails at any time.
4. Tenant Data Isolation
OrderDesk is a multi-tenant SaaS platform. Each tenant's business data is logically isolated using tenant-specific identifiers at the application layer. We implement the following isolation measures:
- All database queries are scoped to the authenticated tenant's ID, preventing cross-tenant data access.
- Role-based access control (RBAC) ensures users within a tenant can only access data their role permits.
- Complete audit logging records all data access and modifications, with immutable audit trails.
- Tenant administrators can export all their data at any time in standard formats.
5. Data Retention & Deletion
Your business data is retained for as long as your account is active. Upon account termination or subscription cancellation:
- Your data remains accessible for a 30-day grace period to allow data export.
- After the grace period, your business data is permanently deleted from our active systems within 90 days.
- Backup copies may retain data for up to 180 days, after which they are automatically purged.
- You may request immediate permanent deletion at any time by contacting support.
Email subscription data is retained until you unsubscribe. Upon unsubscription, your email is removed from active mailing lists within 48 hours.
6. Third-Party Services
OrderDesk utilizes the following third-party service providers, each operating under their own independent privacy policies:
- Cloudflare — hosting, global CDN, edge computing, and DDoS protection. Data processed: website traffic, serverless function invocations, tenant data storage.
- Payment processor — secure payment processing for subscription billing. We do not store payment card numbers; all card data is handled by the PCI-DSS compliant processor.
- Resend — transactional and marketing email delivery. Data processed: email addresses and email content for delivery.
- Google Analytics (GA4) — aggregate website analytics with forced IP anonymization. Data processed: anonymized page views, session duration, referral sources.
- GitHub — source code hosting and version control. No tenant business data is stored in our code repository.
We only engage with service providers that maintain appropriate data protection safeguards. We strongly recommend reviewing the privacy policies of these third-party providers.
7. Cookies & Tracking
Our use of cookies and tracking technologies is described in detail in our Cookie Policy. In summary: we use essential cookies for authentication and session management, Google Analytics for aggregate anonymized measurement, and minimal first-party storage for interface functionality. No cross-site tracking, no advertising networks, no data brokerage.
8. Your Rights
Depending on your jurisdiction (including GDPR for EU residents and CCPA for California residents), you may have the following rights regarding your personal data:
- Right to Access — request a copy of the personal data we hold about you.
- Right to Data Portability — export all your business data in standard formats (CSV, JSON, Excel) at any time from within the application.
- Right to Deletion — request permanent deletion of your account and all associated data.
- Right to Rectification — request correction of inaccurate personal data.
- Right to Restrict Processing — request restriction of how we process your data.
- Right to Object — object to processing of your personal data for marketing purposes.
- Right to Withdraw Consent — unsubscribe from email communications at any time.
To exercise any of these rights, contact us at [email protected]. We will respond to verified requests within 30 days.
9. International Data Transfers
OrderDesk operates globally. Our infrastructure (Cloudflare) may process data in the United States and other jurisdictions. If you are accessing our services from the European Economic Area (EEA) or other regions with data protection laws, please note that your data may be transferred to and processed in jurisdictions that may not have equivalent data protection laws. We only engage with service providers that maintain appropriate data protection safeguards, including Standard Contractual Clauses (SCCs) where applicable.
10. Children's Privacy
OrderDesk is a business-to-business (B2B) SaaS product intended for use by manufacturing companies and their authorized employees. We do not knowingly collect personal data from children under the age of 16 (or the applicable age of digital consent in your jurisdiction). If you believe we have inadvertently collected data from a child, please contact us immediately and we will take steps to delete that data promptly.
11. Security
We implement appropriate technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or destruction:
- Encryption — HTTPS/TLS for all traffic in transit, encryption at rest for stored data.
- Access control — role-based access control, multi-factor authentication support, session management.
- Tenant isolation — logical data isolation between tenants with enforced query scoping.
- Audit logging — complete, immutable audit trails for all data access and modifications.
- Backups — automatic regular backups with tested restore procedures.
- Minimal data — we do not store payment card numbers, government IDs, or unnecessary sensitive data.
However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.
12. Policy Updates
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Material changes will be reflected by updating the "Last updated" date at the top of this page, and we will notify account holders via email or in-app notification of significant changes. Your continued use of our services after such changes constitutes acceptance of the updated policy.
13. Contact & Questions
If you have questions about this Privacy Policy, our data practices, or wish to exercise your data rights, contact us at [email protected].