Your business records deserve clear privacy rules.

1. Scope and accountability

This notice applies to the Ordvero website, Ordvero Field mobile app, public document links, and support interactions. Ordvero is accountable for personal information under its control.

The Ordvero Privacy Officer receives privacy questions, access or correction requests, deletion requests, and complaints at support@ordvero.com.

2. Information we collect

We collect information you provide, information added by authorized workspace members, and limited technical information created while the service is used.

• Account and profile details, including names, email addresses, optional phone numbers, login records, and workspace roles.
• Business and workspace records, including clients, projects, budgets, schedules, receipts and receipt images, project media, time and labor entries, estimates, invoices, online invoice payments, and recorded external payments.
• When a workspace enables business calling, phone numbers, call times, duration, status, and the team member handling the call. Conversation audio and transcripts are collected when that team member starts recording after confirming everyone has agreed. When voicemail is enabled, callers hear a recording and transcription notice before choosing to leave a message after the beep.
• When a workspace connects Meta Lead Ads, selected Facebook Page and Instant Form identifiers, submitted contact details and form answers, consent checkbox responses, and advertising attribution identifiers where Meta provides them. Integration access tokens are encrypted on the server.
• Location attached to a time punch when a user grants location access and uses a location-enabled time feature. After location setup, business-enabled monitoring automatically collects precise location during active shifts, including in the background, to record job-site entry and exit and, when live sharing is enabled, store positions for authorized managers to view on the project map. Monitoring pauses on breaks and stops at clock-out. A bounded on-device queue retries interrupted uploads during the active shift.
• Subscription and billing information from Stripe, such as plan, subscription status, invoices, and payment status. Ordvero does not store full payment-card numbers.
• When a business enables online invoice payments, connected Stripe account details and invoice payment records, including payment status, processing fees, refunds, and disputes. Payment-card details are collected by Stripe; Ordvero does not store them.
• Support messages, requested email delivery records, notification preferences, device notification tokens, IP address, device or browser details, and security diagnostics.
• When a business sends a Google review request, the time a client first and last opened its review link and how many times. Ordvero does not record the IP address of whoever opens it and cannot see whether a review was posted.
• When you use AI Help, your conversation, selected page and unsaved form context, and authorized business records needed to answer your request. AI Help runs only when you use it.
• Essential browser or device storage used to keep a session active, remember preferences, and support offline or faster loading where available.
• Google Analytics cookies and usage information on the public website, such as page visits, signup-button clicks, referral sources, and browser or device details. Google Analytics is not enabled for the signed-in workspace, sign-in and account-setup screens, or secure client and vendor pages.

3. Why we use information

Ordvero uses information only for identified business and service purposes, or as otherwise permitted or required by law.

• Authenticate users, secure accounts, and enforce workspace roles and project assignments.
• Store, synchronize, organize, calculate, display, export, and delete the records a workspace chooses to keep.
• Record job-site boundary events and show authorized managers a team member’s recent position during active shifts when the business enables those features and the person has completed location setup, so they can coordinate on-site work.
• Extract proposed receipt details, support address search, generate requested documents, and deliver estimate links or invoice PDFs.
• Operate subscriptions, enforce plan limits, provide support, deliver requested notifications, investigate misuse, and maintain service reliability.
• Import selected Meta Lead Ads enquiries into a workspace lead inbox, prevent duplicate imports, notify configured staff, and send optional acknowledgements only when the workspace texting channel and consent checks permit them. Importing a lead does not automatically create a client or project.
• Meet legal, accounting, security, fraud-prevention, and dispute-resolution obligations where they apply.

4. Workspace access and customer responsibilities

Workspace owners and administrators decide who is invited, which role each person receives, and which projects or records they may access. Authorized workspace members may see personal information according to those permissions.

A business that adds employee, client, or other third-party information is responsible for having the authority to do so, providing any required notice, and responding to requests for records it controls. Ordvero supports the workspace in carrying out those instructions.

5. Service providers and processing locations

Ordvero uses service providers to operate the product. They receive only the information needed for their assigned function and process it under their own security and privacy commitments.

Depending on provider infrastructure and configuration, information may be processed outside your province or outside Canada and may be subject to the laws of that location.

• Supabase for authentication, database, realtime features, and file storage.
• Netlify for website hosting and server functions.
• OpenAI, Google (Gemini) and Mistral to power Ordvero’s AI features, such as reading photos and documents and drafting replies and summaries. They receive only the information needed for each request and do not use it to train their models by default. OpenAI may retain abuse-monitoring data under its applicable policy, ordinarily for up to 30 days with policy or legal exceptions.
• Google services for address lookup when that feature is used, and Google Analytics to understand use of the public website. Advertising personalization and Google signals are disabled for website analytics.
• Stripe for subscription checkout, billing, connected business accounts, and online invoice payment processing.
• Resend and device notification providers for requested email and push delivery.
• Telnyx for business texting and calling, including optional call recordings and transcription. Call transcription uses Deepgram through Telnyx when recording is requested.
• Professional advisers, regulators, law enforcement, or a successor to the business when disclosure is lawfully required or reasonably necessary.

6. Consent and your choices

Optional Google Analytics on the public website loads only after you accept analytics in Cookie settings. You can reject analytics or change your choice through Cookie settings in the footer. Your choice is remembered for 180 days in this browser. Rejecting analytics stops future measurement and removes accessible Google Analytics cookies and saved referral attribution; it does not delete information already collected. Essential service storage remains available. Analytics is not enabled on private workspace, authentication or client/vendor pages.

Core account and workspace information is necessary to provide the service. Optional camera, photo-library, microphone, location, and notification permissions are requested in context and can be declined or withdrawn in browser or device settings.

Recording a business call is optional. The person handling the call must explain that audio and a transcript will be kept for service records and obtain everyone’s agreement before starting. A tone plays when recording starts. The call can continue without recording, and recording can be stopped during the call. For voicemail, a notice explains recording, transcription, service-record use and 90-day retention before the beep; callers may hang up instead of leaving a message.

Business owners control whether location features are enabled for team members and whether precise/background location access or being inside a mapped job-site radius is required before clock-in. Phone permissions can be declined or withdrawn in device settings; an enabled business requirement can prevent a new clock-in until it is satisfied. Completed setup is remembered, and authorized monitoring starts automatically during active shifts, including in the background. Monitoring pauses on breaks and stops at clock-out or when authorization is withdrawn. Breaks and clock-out remain available if location becomes unavailable.

Withdrawing a permission may prevent the related feature from working, but it does not remove records that were already saved. An authorized user can delete those records separately where the product allows it.

7. Retention, export, and deletion

Workspace records remain while the workspace is active or until an authorized user deletes them. Before closing an account, owners should export any records their business must retain.

Business call recordings and transcripts are accessible for 90 days after recording starts. Audio is stored by Telnyx; Ordvero stores transcript text and call details and provides playback to authorized workspace members. Hourly cleanup requests deletion of expired recordings from Telnyx and removes transcript text, along with any older audio copies held by Ordvero. Owners can delete retained media sooner after the call ends. Call history remains as a workspace record; deleting media does not delete call dates, numbers, duration, or status.

AI Help chats are private to the signed-in user and workspace. Operators manage access, usage and spending but cannot read private chats through the operator console. Chats and their derived summaries remain until you delete them or the applicable account/workspace deletion process removes them. Deleting a chat does not delete business records created from it. Minimal action and usage receipts are kept separately for security, billing and duplicate prevention. Access to saved chat context is checked again when it is opened.

Deleted data may remain for a limited period in protected backups or logs before normal deletion cycles complete. Ordvero may retain limited billing, security, fraud-prevention, dispute, or legal records for as long as reasonably required for those purposes.

8. Security

Ordvero uses encrypted network connections, role-based workspace access, restricted service credentials, and provider security controls appropriate to the information handled. No online service can guarantee absolute security.

If a privacy breach creates a legal notification obligation, Ordvero will notify affected people and regulators as required.

9. Access, correction, and complaints

You may ask to access, correct, export, or delete personal information under Ordvero’s control, or withdraw consent where applicable. We may need to verify identity and authority before acting on a request, and legal exceptions may apply.

For records controlled by a customer workspace, start with that workspace owner. You may also contact the Ordvero Privacy Officer. If a concern is not resolved, you may contact the privacy regulator that applies in your jurisdiction.

10. Service and marketing communications

Ordvero sends account verification, security, billing, support, document-delivery, and notification messages needed to provide requested features. Some service messages cannot be disabled while an account remains active.

If Ordvero introduces optional marketing messages, they will use applicable consent, sender identification, and unsubscribe controls.

11. Minors and changes to this notice

Ordvero is a business service intended for people aged 18 and over. It is not directed to children.

We may update this notice as the product, providers, or legal obligations change. The current version and update date will remain available here, and material changes will be communicated through an appropriate service notice.