What Ordren ("Ordren", "we", "us") collects when you use this website and the Ordren dashboard, what we do with it, who else handles it, and how to remove it. It also covers suppliers and people who appear in research results.
The short version
This website sets no cookies. We do not use advertising cookies and do not track you across other websites. Ordren does not receive or store your card details.
What we collect
Account details: your email address and password, or your Google sign-in (Google gives us your name, email address, and profile picture). When you sign up we also ask for your name, your company (optional), and where you heard about Ordren, with an optional note. You can add a profile photo; it is stored at an unlisted web address so the app can show it.
Your work: project descriptions, briefs and requirement checklists, results, shortlists and the questions attached to them, comparisons, and decision briefs.
The assistant: when you use the in-app assistant, your messages and the parts of your projects, results, and credit balance it looks up to answer are sent to the AI model. The conversation is kept in your browser for the session.
What you send us: feedback, reports that a check is wrong, and, if you choose to answer it, the short survey shown when you delete your account.
Billing and usage: credit purchases (credits, amount, status), your balance, and a ledger of every grant, charge, and refund. You pay on Stripe's checkout page; Ordren does not receive or store your card details. Stripe receives your email address and an account id from us.
Technical data: per-account request counts used for rate limits, page-view analytics, the request logs our hosting providers keep, and product events (such as signing up, starting a run, or shortlisting a candidate) that we record in our own database to see how Ordren is used and to fix problems. Our hosting provider tells us the country a request comes from, which we use to offer the service only in the United States.
Purchase steps: when you open Buy credits, start or cancel a Stripe checkout, or can't start a run for lack of credits, we record that step with the pack, the amount, and the price list in effect, so we can see how our prices work. These events hold ids and counts, never card details.
How you arrived: if you sign up from a button on this website, the link names the button (for example, the pricing section) and any campaign tags (utm_source, utm_medium, utm_campaign) on the page you came from. The dashboard keeps them in your browser until you finish signing up, then records them once with your account and deletes its copy.
Cookies and browser storage
This website sets no cookies. The dashboard sets only the cookies it needs to work: sign-in session cookies, a cookie that remembers your time zone so dates display correctly, and a short-lived cookie that remembers that you postponed the welcome questions.
The dashboard also keeps a few things in your browser's own storage: an unsent draft of a project brief, the assistant conversation for the current session, and the arrival details described above. Clearing your browser's site data removes them.
We do not use advertising cookies and do not track you across other websites. Both analytics services we use are cookieless. Because we do not track across sites, the dashboard and this website do not change their behavior in response to a browser's Do Not Track signal.
How we use it
To run your projects: turn your description into a checklist, search the web for suppliers or people, read their pages, check each requirement against quotes from those pages, and write titles, briefs, comparisons, and assistant answers.
To run your account: sign-in, credits and purchases, refunds, rate limits, the United States availability check, and support.
To improve and protect Ordren: authorized members of our team can view account details, projects, runs, purchases, feedback, and check reports in an internal admin panel, to provide support, diagnose runs, decide refunds, and prevent abuse.
To send account emails, and product update emails if you opted in, as described under Email.
Who processes it
Supabase runs sign-in, the database, and file storage. Vercel hosts the dashboard and provides its analytics (Vercel Web Analytics): page views, and copies of the product events above with their counts and labels but without account, workspace, or project ids. Cloudflare hosts this website, including these pages, and sees standard request data such as your IP address and browser details; it reports aggregate traffic statistics to us (Cloudflare Web Analytics). Stripe processes payments.
OpenRouter routes AI model requests: your project description, checklist, the text of pages being assessed, and assistant conversations are sent to the model that drafts checklists, reads evidence, and writes answers. We send these requests with an instruction that allows only model providers that do not use prompts for training.
Exa and Parallel run web searches built from your project. Firecrawl, with AlterLab as a fallback, fetches public web pages. For people searches, GitHub and People Data Labs may be queried to find professional profiles.
Resend is our email provider. It delivers product update emails to people who opted in and receives the recipient's name and email address to do so.
We may add or replace providers that do the same jobs; this page lists the current ones.
Sharing and public links
We do not sell personal data, and we do not share it for cross-context behavioral advertising. We share it only with the services above to run Ordren; when the law, a court order, or the protection of our rights or someone's safety requires it; and with a successor if Ordren's business or assets are transferred, who would be bound by this policy for data collected under it.
Your projects are visible only to you and, for the purposes described above, to authorized members of our team. If you create a share link for a project, anyone with the link can view a read-only copy without signing in. It leaves out your original description, credits and cost, shortlist notes and questions, and supplier contact emails. You can revoke a link at any time.
We send account emails, such as sign-up confirmations and password resets, when you need them.
Product update emails go only to people who turn them on in Settings, under Account. Every one has an unsubscribe link, and you can turn them off in the same place. Unsubscribing, a hard bounce, or a spam complaint turns them off, and only you can turn them back on.
Ordren never emails the suppliers or people it finds or that appear in your results. Any message to them is one you send yourself.
Security
Connections use HTTPS. Database access rules limit a workspace's data to its owner, and admin access is limited to authorized members of the Ordren team. No system is perfectly secure; if we learn of a breach that affects your personal data, we will notify you as the law requires.
Retention and deletion
We keep your data while your account is open. Deleting your account in Settings permanently removes your sign-in, profile, profile photos, projects, runs, results, shortlists, share links, check reports, and purchase and credit records from our database.
A few things are kept. Feedback you sent, including exit-survey answers, is kept but no longer linked to your account. Product event records are kept without your account id. A one-way fingerprint of your sign-in email address is kept so the free starter credits cannot be claimed twice with the same address; it cannot be turned back into the address. Records of actions our team took on an account are kept for accountability. Stripe keeps its own payment records. Logs, backups, and copies held by the services above are removed on their own schedules or on request.
Suppliers and people in results
Ordren researches public web pages: supplier sites, directories and articles, and, for people searches, public professional profiles and pages. Pages used as evidence are stored so every quote can be checked against its source. These records are shared across projects and are not deleted with any one account.
For people searches, we may also obtain professional profile data from GitHub and from People Data Labs, a commercial provider of professional profile data. This can include a name, role, employer, location, links to public profiles, and a work or personal email address. Customers who run a search see these details in their results and exports, and agree to use them only to contact someone about a professional opportunity.
Suppliers and people do not submit, control, or review how they appear. If you appear in results and want your details corrected or removed, or want to know what we hold about you, email hello@ordren.io. We will review the request, correct or remove the details we hold, and tell you where the data came from so you can also ask that source to remove it.
Ordren is not a consumer reporting agency and does not provide consumer reports. Customers are prohibited from using results to decide anyone's eligibility for employment, credit, insurance, or housing.
AI models
Ordren does not train AI models on your data. Model requests go through OpenRouter to the model providers it routes to, under their terms, and are sent with the no-training instruction described above. AI output can be incomplete or wrong, which is why each result links to its source.
Your choices and rights
From Settings you can update your profile, turn product update emails on or off, and delete your account. You can revoke share links from the project.
To ask for a copy of your personal data, a correction, or a deletion you can't make yourself, email hello@ordren.io. We will confirm it is you (usually by replying to the address on your account), answer within 45 days, and never treat you differently for making a request. You may have someone you authorize make the request for you. Depending on where you live, local law may give you further rights, including the right to appeal a decision by replying to it.
California residents: we do not sell or share personal information as those terms are defined in California law, and we do not disclose it to third parties for their own direct marketing.
Location and age
Ordren is operated from the United States and offered only to customers in the United States; your data is processed there. The service is for adults using it for work. It is not directed to anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, email us and we will delete it.
Changes
When how Ordren handles data changes, we update this page, the date above, and, for material changes, the version. For material changes we also tell account holders by email or in the product.
Contact
Privacy questions and requests: hello@ordren.io.