Account identity and contact details, business and branch configuration, staff permissions, product and stock records, sales and payment records, device health, support messages and sanitised diagnostics. Ordo must not store raw online-banking passwords, card security codes or unapproved customer credentials.
To provide point-of-sale and back-office services, synchronise authorised devices, secure accounts, support customers, maintain audit evidence, bill subscriptions and meet legal obligations.
Access is restricted by business, branch and role. Information is processed by the specific providers Ordo actually uses to run the service: Supabase (database and authentication), Vercel (application hosting) and Resend (email delivery), each only for what their service requires. Ordo does not sell personal information.
Ordo's database, application hosting and email delivery run on Supabase, Vercel and Resend respectively. Their servers are located outside South Africa, so using Ordo involves a cross-border transfer of personal information. Each of these providers is contractually bound to process the information only on Ordo's instructions and to protect it to a standard comparable to what POPIA requires.
Ordo only sends marketing or promotional email to people who have agreed to receive it. Every marketing email includes an unsubscribe link, and unsubscribing takes effect immediately. Service messages that are necessary to run your account — password resets, receipts, security notices and billing notifications — are not marketing and are sent regardless, because they are required to provide the service.
Ordo does not keep personal information for longer than it is needed to provide the service. On request, Ordo will delete a person's personal information, subject only to what the law requires Ordo to keep (for example, financial records for tax purposes). Ordo uses access controls, encryption in transit, audit records, backups and incident procedures to protect information while it is held.
Subject to applicable law, people may request access to, correction of, or deletion of their personal information. To make a request, email liamnaude809@gmail.com. If you are not satisfied with how a request was handled, you may complain to South Africa's Information Regulator at POPIAComplaints@inforegulator.org.za (general enquiries: enquiries@inforegulator.org.za).
