Privacy Policy
How we collect, use, and protect your data
Last updated: November 8, 2026
Legal Basis for Data Processing
We process your personal data based on the following legal grounds under GDPR:
Contract Performance
Processing necessary to provide our services and fulfill our contractual obligations to you.
Legitimate Interest
Processing for our legitimate business interests, such as improving our services, security, and fraud prevention, where these interests do not override your fundamental rights.
Consent
Processing based on your explicit consent for specific purposes, such as analytics cookies and marketing communications. You can withdraw consent at any time.
Your Rights Under GDPR
As a data subject, you have the following rights regarding your personal data:
Right of Access
Request a copy of your personal data and information about how we process it.
Right to Rectification
Request correction of inaccurate or incomplete personal data.
Right to Erasure
Request deletion of your personal data in certain circumstances.
Right to Object
Object to processing based on legitimate interests or for direct marketing.
Right to Data Portability
Receive your data in a structured, machine-readable format.
Right to Withdraw Consent
Withdraw consent for processing based on consent at any time.
Exercising Your Rights
To exercise any of these rights, please contact us at legal@ordne.io. We will respond to your request within 30 days.
Analytics and User Behavior Tracking
We use PostHog, a privacy-focused analytics platform, to understand how users interact with our platform. Optional product analytics, account identification, and session replay are enabled only with your explicit consent.
What We Track
- • User identification data (email address, name)
- • Page views and navigation patterns
- • Feature usage and user interactions
- • MCP tool usage, duration, and success status
- • Session recordings (with consent)
- • User journey analysis
Privacy Protection
- • Optional product analytics can be disabled at any time
- • We collect your email and name to provide personalized insights
- • Data is processed in the EU (PostHog EU instance)
- • No sensitive information (passwords, payment data) is tracked
- • You can opt-out at any time through cookie settings
- • You can request deletion of your analytics data at any time
Data Retention
PostHog data is retained for up to 90 days and is automatically deleted after this period. You can request immediate deletion of your analytics data by contacting us.
Security and Service Diagnostics
We process minimized operational telemetry to secure the service, investigate failures, and maintain reliability. This includes sanitized errors and stack frames, route templates, response status, performance traces, CSP violations, release information, and coarse MCP failure information. This processing is based on our legitimate interests in operating a secure and reliable service and continues when optional analytics is declined.
User and organization identifiers are replaced with one-way pseudonymous keys. We exclude names, email addresses, request and response bodies, query strings, authentication tokens, entity content, MCP parameters and responses, and free-text MCP intent. PostHog processes this data in its EU environment for up to 90 days. You may object to processing based on legitimate interests by contacting privacy@ordne.io.
Cookie Policy
We use cookies and similar technologies to provide, protect, and improve our services. This policy explains how and why we use these technologies and the choices you have.
Types of Cookies We Use
Necessary Cookies
These cookies are essential for the website to function properly. They enable basic functions like page navigation, access to secure areas, and authentication. The website cannot function properly without these cookies.
Analytics Cookies
These cookies help us understand how visitors interact with our website. We collect usage data along with your account information (email, name) to provide personalized insights and improve our services.
Services used: PostHog (EU instance), Vercel Analytics
Functional Cookies
These cookies enable enhanced functionality and personalization, such as remembering your preferences and settings.
Managing Cookie Preferences
You can change your cookie preferences at any time by clicking the “Cookie Settings” button in the footer of our website. You can also withdraw consent for analytics and functional cookies through these settings.
← Back to HomeData Collection and Use
We collect information you provide directly to us, such as when you create an account, use our services, or contact us for support.
Information We Collect
- Account information (name, email, organization)
- Usage data and analytics (including user interactions, page views, and feature usage)
- System architecture data you create
- Communication preferences
- Payment information (processed securely by Stripe)
- Session recordings and user behavior analytics (with your consent)
- Device and browser information for analytics purposes
Third-Party Services and Sub-Processors
We use trusted third-party services to provide our platform. These services act as sub-processors under our Data Processing Agreement and are bound by appropriate data protection obligations.
Vercel
Hosting, analytics, and performance monitoring
Data processed: Website usage, performance metrics
Privacy Policy →Clerk
Authentication and user management
Data processed: User authentication, profile data
Privacy Policy →PostHog (EU)
Consented product analytics and minimized service diagnostics
Data processed: account-linked usage and session replay with consent; pseudonymized errors, traces, CSP reports, and service reliability data under legitimate interests
Privacy Policy →International Data Transfers
Some of our service providers are located in countries outside the European Economic Area (EEA). When we transfer your personal data to third countries, we ensure appropriate safeguards are in place to protect your data in accordance with GDPR requirements.
EU-Based Services (No Third-Country Transfer)
All analytics data is processed and stored exclusively within the EU. No data leaves the European Economic Area.
Your application data and user content is stored exclusively in EU data centers.
Third-Country Transfers (USA) - Protected by Standard Contractual Clauses
Data transferred: Authentication data, user profile information
Legal safeguard: EU Standard Contractual Clauses (SCCs) approved by the European Commission
Additional measures: Encryption in transit and at rest, Privacy Shield successor framework compliance
Data transferred: Payment information, billing data
Legal safeguard: EU Standard Contractual Clauses (SCCs)
Additional measures: PCI-DSS Level 1 certified, encryption, tokenization of payment data
Global Services - Multi-Region Processing
Regions: USA (primary), EU, Asia-Pacific
Data transferred: Website usage data, performance metrics
Legal safeguard: EU Standard Contractual Clauses (SCCs) for non-EU regions
Note: Data is processed on edge servers closest to you for performance
What are Standard Contractual Clauses (SCCs)?
Standard Contractual Clauses are legally binding contracts approved by the European Commission that provide appropriate safeguards for personal data transferred outside the EEA. They ensure that your data receives an equivalent level of protection as it would within the EU.
Following the Schrems II decision (2020), we have implemented supplementary measures including:
- • End-to-end encryption for data in transit and at rest
- • Contractual obligations prohibiting government access without legal basis
- • Regular security audits and compliance certifications
- • Data minimization practices to reduce transfer necessity
Your Rights Regarding International Transfers
You have the right to:
- • Obtain information about the safeguards we use for data transfers
- • Request a copy of the Standard Contractual Clauses we have in place
- • Object to transfers if you have compelling legitimate grounds
- • Withdraw consent for analytics cookies (stops PostHog and Vercel Analytics data collection)
Please note that objecting to necessary transfers (Clerk authentication, Stripe payments) may prevent you from using certain features of our service.
To exercise these rights or request more information, contact us at legal@ordne.io
Data Processing Agreement
For business customers, we offer a Data Processing Agreement (DPA) that governs how we process your personal data as a data processor in compliance with GDPR Article 28.
For Business Customers
If you are using our service for business purposes, you can download our Data Processing Agreement which outlines our obligations as a data processor and your rights as a data controller.
View Data Processing Agreement →Contact Us
If you have any questions about this privacy policy or our data practices, please contact us:
Email: legal@ordne.io
Last updated: November 8, 2026