Privacy Policy

1. Growth Assistant — OpenAI

Growth Assistant is optional. When the user consents to data sharing and starts an analysis, the OpenAI API is used to produce a concise daily briefing and prioritized suggestions from business records. Opening a saved analysis alone does not start a new OpenAI analysis.

• Data shared: visit intervals, package usage, available appointment slots, appointment trends, staff workload, service amounts and, where available, period-based cost estimates for individual staff members. Known customer, staff and service names are replaced with codes before transmission. Stored phone numbers and email addresses, private notes and individual wage rates are excluded from the analysis input. Coding does not mean the data is fully anonymous.
• Ordiva storage: the last successful analysis, its date and a snapshot of its supporting records are stored in the database by business, account owner and language. This snapshot may contain customer and staff names. A new successful analysis replaces the previous record for the same scope; without a new analysis, the record is retained without automatic expiry. When account deletion is completed, the associated saved analyses are also deleted. Business ownership and plan access are checked when it is accessed.
• OpenAI processing: API data is not used for model training by default. store:false does not guarantee zero retention. Provider abuse-monitoring logs may be retained for up to 30 days by default, or longer for legal or security requirements. Processing may occur abroad.
• User control: this feature does not offer free-text questions or chat. Suggestions and any message drafts are presented for user review; the assistant does not automatically send messages or change appointment or staff records. The business checks the necessary permissions before contacting customers.

2. Mobile subscriptions — RevenueCat

Ordiva uses RevenueCat to verify Google Play and App Store subscriptions, restore purchases, manage plan access and provide subscription analytics. This involves your Ordiva account ID, your account email address where available, store transaction and purchase records, product/plan identifiers, and subscription status and dates. Your full payment card number or security code is not sent to Ordiva or to RevenueCat through this integration; the relevant store processes store payments. Before account deletion is completed, deletion of the associated RevenueCat customer record is also requested. The stores have their own transaction records and retention obligations.

3. Mobile notifications — Expo and platform providers

When you enable mobile notifications, delivery uses Expo Push Service together with Firebase Cloud Messaging (Google) on Android or Apple Push Notification service on iOS. Device/app installation identifiers, push tokens, app/project and platform information may be processed, together with notification titles, content and navigation data when a notification is sent. The notification token is linked to your account. You can disable notifications in Ordiva settings or device permissions while keeping your Ordiva account. Notification records and necessary delivery information are processed to operate the service and investigate issues.

4. App updates — Expo EAS Update

When the Ordiva mobile app starts, it checks Expo EAS Update for compatible software updates. These requests transmit a randomly generated app installation identifier, app/project and version information, and operating system information; the IP address may also be processed as part of the network request. This data is used to deliver the correct update, measure distribution and operate the update service. Update checks are independent of notification permission; disabling notifications does not stop this technical request.

5. Deleting your account and personal data

You can request deletion of your Ordiva account and associated personal data in the mobile app or by email.

• Business Settings → Account & Data → Request account deletion
• An in-app confirmation starts a 7-day waiting period. You can cancel the request from the same section during this period. After it ends, the daily automated process closes the account and deletes or anonymizes personal data. Technical failures are retried. Email requests are handled by support after account ownership is verified; we will communicate the timeline and any additional steps required.
• Account contact and profile details are removed or anonymized and sign-in access is disabled. When a business owner deletes their account, their business is deactivated; related customer and staff contact details, private notes and images are cleared, and saved Growth Assistant analyses are deleted. Transaction history and financial and operational records may be retained with personal identifiers removed. Records needed for legal obligations, security and disputes are retained only for the relevant purpose and required retention period.
• Deleting your account does not cancel a Google Play or App Store subscription. To stop renewal, cancel your subscription separately in the relevant store subscription settings.

6. Data controller

Ordiva is an appointment, customer, and business operations platform provided by Potensas Bilişim Teknolojileri Anonim Şirketi. Potensas Bilişim Teknolojileri Anonim Şirketi acts as data controller for Ordiva account, website, security, and platform operation data. When businesses add their own customer data to the Ordiva panel or collect it through a slug booking link, the relevant business is the data controller for those customer records; Ordiva processes such data for service delivery and technical operation.

7. Data categories processed

• Account data: full name, email, phone, role, verification, and session information.
• Business data: business name, address, working hours, services, staff, prices, and settings.
• Appointment and customer data: customer name, contact details, gender, date of birth, appointment time, service, staff, payment method, and transaction history.
• Support and communication data: support messages, notification preferences, email, and system records.
• Technical data: IP address, device and browser information, security logs, error records, and cookie-like local storage data.
• Account identifiers: the unique user ID associated with your account and authorized session records.
• Purchase and financial data: store subscriptions, transaction and plan records; income, expenses, tips, commissions, staff pay and period-based cost information entered for the business.
• Photos and contacts: business, customer or staff images you choose to upload, and names, phone numbers and email addresses of contacts you select for import.
• Mobile notification data: with your permission, push tokens, device/app installation identifiers, platform and notification delivery information.

8. Purposes of processing

• Creating user accounts, authenticating identity, and providing authorized access.
• Operating business appointment, customer, staff, finance summary, package, and reminder workflows.
• Providing online booking and appointment tracking for customers.
• Running notification, support, security, abuse prevention, and service improvement processes.
• Meeting legal obligations, managing disputes, and maintaining record security.
• Technically hosting and processing customer data added by businesses according to the business instructions and platform purpose.

9. Support and technical administration access

Ordiva’s authorized support and technical administration personnel may access your business’s management dashboard and related records to handle support requests, investigate and resolve issues, maintain security and operate the service. Depending on their assigned permissions, this access may include viewing business settings, appointments, customer and staff records, packages, subscriptions and financial records. Necessary changes to records or settings during support may be made in accordance with the business’s instructions and within the scope of the authorization. Access and actions are limited to what is necessary for the relevant support or technical task.

10. Legal bases

• Processing necessary for entering into or performing a contract.
• Compliance with legal obligations.
• Processing necessary for establishing, exercising, or defending rights.
• Legitimate interests in security, product improvement, and operational management.
• Consent where required, especially for non-essential cookies and marketing communications.

11. Recipients

• Cloud hosting, database, email, security, error monitoring, and support service providers.
• Business account owners, authorized staff, and persons involved in appointment workflows.
• Authorized public authorities, courts, and regulators where legally required.
• For cross-border technical transfers, applicable safeguards and consent mechanisms under relevant law.

12. Notifications and marketing communications

Appointment confirmations, reminders, security, account, and support messages may be sent to operate the service. Campaign, announcement, or commercial electronic messages are subject to the recipient consent, opt-out rights, and communication preferences managed by the business. Ordiva may also email account owners about getting started, product use, trial periods, plan options and returning to the service, using their name, email address and account/plan status. Marketing messages are sent subject to applicable communication rules and preferences and can be stopped using the unsubscribe link in those emails. Necessary account, security and transaction messages may continue to operate the service.

13. Subprocessors and vendors

Ordiva may use vendors for technical services such as hosting, database, email delivery, security, error monitoring, maps, calendar, analytics, and AI-assisted insights. The current category list is published on the Subprocessors page and material changes are communicated where appropriate.

14. Retention

Personal data is kept for as long as necessary for the processing purpose and applicable limitation, accounting, security, and dispute management periods. After that period, data is deleted, destroyed, or anonymized.

15. Data subject rights

Depending on applicable data protection law, you may request access, rectification, erasure, restriction of processing and data portability, or object to processing. Contact help@ordivaapp.com to exercise your rights.

16. Security

Ordiva applies technical and administrative measures such as authorization, access control, secure configuration, encryption, logging, rate limiting, and environment variable management. Absolute security cannot be guaranteed for any internet service.