Vendors and subprocessors
Subprocessors
This page explains vendor categories and processing purposes that may be used to provide Ordiva services.
Effective date: September 6, 2026
1. Growth Assistant — OpenAI
This optional feature uses the OpenAI API after session-specific consent. Visit intervals, package usage, appointment trends, staff workload, available aggregate cost metrics and typed questions are shared. Known customer, staff and service names in the analysis are replaced with codes; stored contacts, private notes and individual wage rates are not sent. Free-text questions must not contain personal or sensitive data. API data is not used for model training by default. Requests use store:false, which does not guarantee zero retention: provider abuse-monitoring logs may be retained for up to 30 days by default, with possible exceptions. Processing may occur abroad. Ordiva keeps temporary conversation context in server memory; it expires after 20 minutes of inactivity. The assistant does not automatically send messages or change appointment or staff records. The business checks customer communication permissions separately.
2. Scope
Subprocessors are technical vendors that provide hosting, database, email, security, error monitoring, support, or integration services on behalf of Ordiva. The list is updated according to production usage.
3. Hosting and infrastructure
Render or similar cloud infrastructure providers may be used for application servers, API, static web deployment, and runtime logs. Data categories may include account, business, appointment, customer, and technical log data.
4. Database and storage
Managed PostgreSQL and related storage services may be used to store appointment, customer, business, staff, package, finance, and consent records.
5. Email and notifications
Resend or similar email services may be used to send verification, appointment, support, reminder, system, and permitted marketing messages.
6. Integrations and auxiliary services
Cloudflare DNS/security/email routing, Google Maps, Google Calendar, AI insight services, analytics, error monitoring, and support tools may process limited technical data when the relevant feature is enabled.
7. Changes
When a new subprocessor is added or a material change occurs in the nature of processing, this page is updated. Businesses should reflect such changes in their own notices where they act as data controller for their customers.