Privacy Policy

Ordinal acts as the controller of your account, billing, and operational data. For the briefs, files, and Knowledge Vault content you submit, Ordinal processes that content on your behalf and only to deliver your projects; you remain responsible for having the right to share any personal data it contains.

Account data: email address, name, avatar, bio, and any company details you choose to provide.

Billing data: payments are processed by Stripe. Card numbers never touch Ordinal's servers; we store only Stripe identifiers, payment status, amounts, and transaction records.

Project content: briefs, uploaded files, Knowledge Vault entries, revision feedback, messages, and the deliverables produced for you.

Operational data: authentication events, notifications, and error logs used to keep the service reliable and secure.

To operate your account and authentication, deliver the projects you commission, run and review AI work under dedicated quality review, process escrowed payments, send notifications, prevent fraud and abuse, meet legal obligations, and improve the reliability and performance of the Platform.

Where laws such as the GDPR or UK GDPR apply, we rely on: performance of our contract with you (accounts, projects, payments); legitimate interests (security, fraud prevention, service reliability); legal obligations (tax and accounting records); and consent where we ask for it, which you can withdraw at any time.

We do not sell your data and we do not share it for advertising. We share data only with service providers acting on our instructions and only as needed to deliver the service: our cloud database and authentication provider, Stripe for payments, AI model providers for processing task content, web search providers where a project requires research, and our transactional email provider.

Your briefs and attachments are accessible to Ordinal's supervising personnel solely to deliver and review your project. We may also disclose data where required by law or to protect the rights, safety, and property of Ordinal and its users.

Content you submit is used only to deliver your own projects. Knowledge Vault material is vectorised for isolated retrieval scoped to your account. Ordinal does not use your data to train shared or foundational models, and never exposes it to another client.

Learned standards extracted during review are stored against your own project context. Content sent to third-party model providers is processed to return a response for your task, subject to those providers' terms.

We keep account and project data for as long as your account is active and afterwards only as needed for legal, tax, accounting, and dispute-resolution purposes. You can delete your account and its associated content from your profile at any time, except while a project is in progress or funds are held in escrow. Transaction records tied to payments are retained to satisfy financial recordkeeping requirements.

Access to data is enforced at the database layer with row-level security so each account can reach only its own records. Uploaded files are stored in private storage and are reachable only in connection with your own projects. Data is encrypted in transit, and secrets and API keys are stored in managed secret storage. No system is perfectly secure; we do not claim certification under any specific compliance framework on this page.

If we become aware of a security breach affecting your personal data, we will notify affected users without undue delay and inform regulators where the law requires it, describing what happened and the steps being taken.

Depending on where you live (for example under the GDPR, UK GDPR, or California's CCPA/CPRA), you may have the right to: access the personal data we hold about you; correct it; delete it; receive it in a portable format; restrict or object to certain processing; and withdraw consent. We do not sell or share personal data for cross-context advertising, so there is nothing to opt out of. You can edit your profile and delete your account in the app, and contact us for any other request; we aim to respond within 30 days and will not treat you differently for exercising your rights. You may also complain to your local data protection authority. We do not knowingly collect data from anyone under 18.

We use strictly necessary cookies and local browser storage to keep you signed in and to remember interface preferences. We do not use third-party advertising trackers.

Our providers may process data in countries other than yours. Where required, transfers rely on appropriate safeguards such as standard contractual clauses.

We may update this policy; material changes will be reflected by the "Last updated" date above. For privacy requests or security reports, contact us.