Privacy policy

SwiftLabs UG (haftungsbeschränkt), represented by its managing director Felix Straub, Schanzenstraße 19, 90478 Nürnberg, Germany. Commercial register: HRB 46502, Amtsgericht Nürnberg. Email: hello@ord1nary.com.

ord1nary is a product of SwiftLabs UG (haftungsbeschränkt). Full provider details are in the legal notice.

This policy applies to the website ord1nary.com, to the apps of ord1nary for iPhone, iPad and Mac, to the web app at app.ord1nary.com and to the services behind them (api.ord1nary.com, links.ord1nary.com, media.ord1nary.com), and to the app ord1nary in the Shopify App Store (section 6, “Shop on Shopify”).

We process data in ord1nary in two roles:

• As controller for this website, the contract with your company and the owner's details for it, the subscription and its billing, your enquiries and feedback to us, and the protection of the service.
• On behalf of your company for everything your company enters or uploads in ord1nary: customers, contacts, enquiries, tickets, quotes, orders, invoices, expenses, books, articles, documents, personnel data, applications and working time, and for the accesses of all users with their sign-in and the related emails. Your company is the controller for that data.

This policy applies regardless of the country in which you use ord1nary. We are established in Germany and process all data under the General Data Protection Regulation (GDPR).

This website sets no cookies and uses no analytics, advertising or tracking services. Fonts and images are served from our own hosting; nothing is loaded from third-party servers. Your choice of light or dark appearance is stored locally by your browser and never reaches us. Only the web app on app.ord1nary.com (section 7), the approval page for AI apps on api.ord1nary.com (section 9), the page for setting a password (section 3) and the pages for accepting a quote, for withdrawal and for paying an invoice on links.ord1nary.com (section 6) set cookies, and they are strictly necessary.

The support page embeds our form from links.ord1nary.com. When your browser shows it, it fetches it from our server at Hetzner (sections 4 and 8). It sets no cookie and loads no script (section 3).

When you open the website, our host Hostinger International Ltd. (61 Lordou Vironos str., 6023 Larnaca, Cyprus) processes technically necessary access data - IP address, time, page requested, user agent - in server log files as a processor under Art. 28 GDPR. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in secure and stable operation.

We process:

• email address and name,
• your password, stored only as a hash,
• whether and when you confirmed your email address,
• sign-in sessions (hashes of the session key and of the key with which the app or browser renews the session, start, expiry, last renewal, sign-out),
• if you set up two-factor authentication: the secret for your authenticator app, encrypted, ten recovery codes only as hashes and your trusted devices with name (such as “iPhone” or “Safari · macOS”), start and last sign-in. A device stays trusted until you remove it, switch two-factor authentication off, change your password or the owner resets it,
• for every sign-in session and every event on your account, such as an activation or a new password, the network range of your IP address (for IPv4 without the last block, for IPv6 the first 48 bits) and the identifier of your app or browser (user agent). We delete both 90 days after the session ended or the event took place,
• your membership of a company with role, title, rank and departments,
• a profile photo if you or your company upload one. Only two reduced versions (128 and 512 pixels) without image metadata are stored; the uploaded file itself is not.

Employee accesses are created and deleted by the company's owner or administration. Whether two-factor authentication is required is decided by your company. We process your access on behalf of your company; your company is the controller, including for the legal basis. As the owner, you conclude the contract for ord1nary with your account; for your details in it the legal basis is Art. 6(1)(b) GDPR, or Art. 6(1)(f) GDPR if you act for a company. We process the network range and the identifier of your app or browser ourselves to protect the service; the legal basis is Art. 6(1)(f) GDPR.

To confirm your email address, activate an account, accept an invitation or set a new password, we send you an email with a link. The link can be used once and is valid for 24 hours when you set a new password, otherwise for seven days; the email states the period as well. If you change the email address of your account, we send the link to the new address; it is valid for 24 hours. Only once you confirm the new address with it do you sign in with it, and we send a message with the new address to the previous address, without a link. If you connect an AI app to ord1nary, every new connection sends you a notification with the name and address of the app, the company and the time; it contains no link. The emails contain no tracking pixels and load no images from third-party servers. The page for setting the password sets a cookie for its form (__Host-miphu-passwort), a random number that expires after one hour and is deleted once the password is set (§ 25(2) no. 2 TDDDG).

The emails are sent via the service Resend (Plus Five Five, Inc., USA) on the basis of standard contractual clauses. Your email address and the content of the message are processed for this. Emails about your access to a company are sent on behalf of that company (section 2); for the emails at registration, before a company exists, the legal basis is Art. 6(1)(b) GDPR.

When you write to hello@ord1nary.com, we process your address, your name and the content of your message to answer your request. The mailbox of this address is run for us by Microsoft Ireland Operations Limited (Microsoft 365), Ireland, as processor under Art. 28 GDPR. The former address hello@miphu.com is still hosted by Apple (iCloud Mail). Claude by Anthropic helps us handle it: Claude receives your message and, to the extent handling it requires, the data of your company in ord1nary that it concerns (section 6(5) of our data processing agreement). We use subscriptions governed by Anthropic's consumer terms for this, without a data processing agreement with Anthropic; we have switched off training on this content in the settings (section 12). The legal basis is Art. 6(1)(b) GDPR where your request concerns the use of ord1nary, otherwise Art. 6(1)(f) GDPR.

The same purpose, legal basis and help from Claude apply to the form on our support page and to “Send feedback” in the apps, in the web app and through an AI connection. Your message becomes a ticket in our own ord1nary and so lies with Hetzner (section 8), not in the mailbox. The form collects name, email address and message; against abuse it counts submissions per network range (for IPv4 without the last block, for IPv6 the first 64 bits), which we store for this for one day. Feedback also names the app version, the platform, the language, your company, your name and your email address. We delete enquiries and tickets once they are settled and we need them neither for the contract nor as commercial or business letters (§ 257 HGB, § 147 AO).

An AI assistant additionally evaluates emails to our mailboxes for us: Claude by Anthropic (Anthropic Ireland, Limited, Ireland; processing also by Anthropic, PBC, USA) receives the text of your message and of earlier messages and prepares our handling of it. It does not reply on its own and decides nothing about you. A service of ours at Cloudflare, Inc. (USA), acting as our processor, passes the message on to it. Anthropic is our processor under Art. 28 GDPR and does not train any models with this data. Data is stored in the USA; for this, our contract with Anthropic provides for standard contractual clauses under Art. 46(2)(c) GDPR (anthropic.com/legal/data-processing-addendum). We delete the histories after 30 days; Anthropic may retain content for longer if its systems flag a violation of the usage policy (up to 2 years) or the law requires it. The legal basis is Art. 6(1)(b) GDPR, otherwise point (f); our interest is the prompt handling of our business mail. You can object under Art. 21 GDPR.

To prevent abuse we limit the number of requests per period. For requests without sign-in, your IP address serves as the key.

The servers write operating logs that are continuously overwritten: a summary every minute that relates to no individual person, plus single entries for failed or unusually slow requests and for security events such as a failed sign-in. Such an entry names the time, the kind of request and its outcome, your account and your company, and the network range of your IP address - never the full IP address, your email address, search terms or content. Requests from connected AI apps (section 9) and the opening of links for customers (section 6) are logged separately.

You reach the web app through a server of its own on app.ord1nary.com. It limits the number of requests per IP address, more tightly for sign-in, and passes your IP address on to our other servers through a separate, secured channel. Their limits and the entries above therefore concern your address and not the web server's; here too only the network range is stored (section 2). The web app's server writes no access logs; its continuously overwritten operating messages may in single cases contain an IP address.

Error collection. So that we can find and fix errors, we create an entry in a separate database for every request that ends in a server error or is refused without stating a business reason: the time, the kind and outcome of the request, the function called without identifiers or search parameters, the duration, a technical error code, the platform and version of the app, the version of our server and a checksum derived from your company's identifier.

If an error occurs in our program code in the web app, your browser reports it to us: the time, the kind of error, the page without identifiers, the error message, shortened to 160 characters and cleaned of anything in quotation marks, sequences of digits, email and web addresses, the place in the program code, the browser and operating system family and the version of the web app. A report is sent only when an error occurs; nothing is stored in your browser for it. An entry contains neither your account nor your IP address. We do not take in what you enter or content from ord1nary; only an error message may in single cases contain a word from it, such as a name. To limit the number of reports, we count them per day and network range (section 2), only as a checksum and without any link to an entry. We delete the counter after two days and the entries after 30 days. We use them only to find and fix errors. For the report from your browser, section 25(2) no. 2 TDDDG applies: detecting and fixing errors is part of the service your company has agreed on for ord1nary (section 9(5) of the Terms of Use).

The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in secure and stable operation.

In the apps, ord1nary is purchased as a subscription through Apple's App Store. Apple handles purchase, payment and billing under its own responsibility; Apple's terms and privacy notices apply. We do not receive your payment details.

So that we can unlock the purchased number of accounts for your company, Apple provides us with Apple-signed details of the purchase and renewals, such as product, transaction identifiers, dates and status, and we store them as Apple delivers them. At purchase the app passes a random identifier that lets us link the purchase to your account and your company. The legal basis is Art. 6(1)(b) GDPR.

In the web app the owner concludes the subscription through the payment service Stripe; the contracting party is Stripe Payments Europe, Limited (Ireland). The web app opens the payment process and the customer portal for payment method, invoices and cancellation on Stripe's pages; you enter card or account details there, and we do not receive them. Beforehand we pass your company's billing details to Stripe: name, the email address for invoices or otherwise that of your account, address with the region where the web app asks for it, and, if given, the VAT identification number or another tax or register number. Stripe checks the VAT identification number, calculates the VAT, collects the payments and creates the invoices. From Stripe we receive and store the identifiers of customer, subscription, invoice and payment, the package, the paid period and whether it is cancelled, so that we can unlock your company's accesses and book the payments. The details we store for this before your company is created are deleted once it has been created.

Under its own data processing agreement, Stripe acts in two roles: as our processor to the extent it handles payments, subscription and invoices for us, and as a controller in its own right to the extent it processes the data for its own purposes, for example to prevent fraud and losses, to meet legal obligations such as anti-money-laundering checks and to improve its services. Stripe's privacy policy applies to that processing and to the cookies on Stripe's pages. We do not embed any Stripe scripts in the web app itself.

If someone from our sales team offers you an entry package, we store the offer with the email address it applies to, the package, the term, the months given free and the sales person, and after it is redeemed with your company and the amount paid, from which we calculate their commission.

The legal basis is Art. 6(1)(b) GDPR, for calculating the commission Art. 6(1)(f) GDPR. We keep invoices and accounting records as far as commercial and tax law require (Art. 6(1)(c) GDPR).

What your company enters or uploads in ord1nary we process on behalf of your company: customers and contacts, enquiries, tickets and notes, tasks, quotes, orders, invoices with payment reminders and dunning notices, recurring invoices and tasks, payments, expenses with uploaded receipts, the books, articles with stock, purchasing and deliveries, documents, personnel data including pay and the team directory, applications, and, if your company uses shift planning, shifts and absences, and, if it uses time recording, your working time. Your company decides which data this is, what it is used for and how long it is kept. We process it only on your company's instructions.

Added to this are your company's master details, which appear on its documents: address, legal form, phone, email and website, the names of the managing directors, the register court and register number, and the bank details with IBAN, BIC and bank name. The owner or the administration enters them; ord1nary prints them in the footer of quotes and invoices and names the bank details in the payment note. If the bank details change, we email the owner the changed fields, who changed them and when.

Special categories. An absence carries a kind - holiday, sickness or other - a period, and the name of the person concerned. “Sickness” is health data and therefore a special category of personal data under Art. 9 GDPR. Here too your company is the controller: it needs its own basis under Art. 9(2) GDPR, and we process the entry only on its instructions. ord1nary stores no free text with a sick note, only its start and end. It can be seen by the person concerned and by whoever plans or manages personnel in the company, that is the owner, the administration and anyone holding the “planning” or “personnel” right. The kind of an absence does not appear in the company's audit log. Through an AI connection with the area “Personnel” it can go to the provider of an AI app (section 9). Application papers can contain such details, and a payroll journal states church tax per denomination and thus religious affiliation; for this too your company needs a basis under Art. 9(2) GDPR.

Uploaded receipts. We store a receipt for an expense exactly as you upload it - byte for byte, as PDF, JPEG or PNG. We do not re-encode it and we remove nothing from it. So whatever is in the file stays in it, including what a camera writes into a photo: the time it was taken, the device and, if your phone is set that way, the place. If you would rather they did not travel with it, remove them on your device before uploading. This concerns receipts only: a profile photo and a company logo are re-encoded by ord1nary on upload and stored without image metadata. A receipt can be read only by someone with access to finance in your company. If you replace a receipt or detach it from the expense, the earlier file stays in that expense's history.

Documents. In the document storage you file files on a record, for example a customer, an invoice or an article, or in a general area. With them we store title, type, date, amount, counterparty, reference and tags, earlier versions, and who changed what and when. ord1nary files issued invoices, quotes, delivery notes and other documents there itself. We store an uploaded file as you upload it and check it for malware before it is released. So that you can search documents, our server reads the text from the file; for scans and photos without text it recognises the text itself, and text your device has already recognised is taken over by the app. We use no third-party service for this. A document can be seen by whoever may see the record or area it is filed in; the owner and the administration can also mark it confidential or restrict it. For a contract, your company can record the term, notice period, renewal, cancellation and a person responsible; before the notice date, ord1nary creates a task for that person.

A deleted document stays in the trash for 30 days and is then deleted permanently; we then remove its file from the file storage after 35 days and from the second copy after 85 days. For every document ord1nary records a retention period, for Germany the periods under § 147 AO. While it runs, the document cannot be deleted. If someone asks for such a document to be erased, your company can restrict it: then only the owner and the administration see it, and ord1nary deletes it as soon as the period ends.

Links for customers. Anyone in your company with the right to do so can create a link through which someone without ord1nary can download a single document. The link is valid for one to 90 days, if you like only for a set number of downloads, and ends earlier when it is revoked or the document is deleted. We store only a fingerprint of the link, not the link itself. The page the recipient opens sets no cookie and contains no scripts. For each access we store the time, the kind (opened, viewed, downloaded) and the device class (phone, tablet, computer or other). The person who created the link sees this and receives a notification the first time it is opened (section 10). Solely to prevent abuse, we also keep the network range of the person accessing it for 90 days (for IPv4 without the last block, for IPv6 the first 64 bits); we do not store the full IP address, the browser or the location. We delete a link and its accesses 90 days after it ended, and at once with the document. We process the accesses on behalf of your company; the legal basis for the network range is Art. 6(1)(f) GDPR, our legitimate interest in secure operation.

Quotes for acceptance. For an issued quote, your company can create a link through which its customer views the quote without ord1nary, chooses line items and accepts or declines it with their name. The link is valid until the day your company sets, at most one year, and ends earlier when your company withdraws it or the quote is decided otherwise. We store a fingerprint of the link, the PDF of the quote as it was when the link was created, and how often and when the link was first and last opened. For the decision we store the name entered, the time, the chosen line items and the total shown, for a decline the reason, as well as the language of the page, the device class and the network range (for IPv4 without the last block, for IPv6 the first 64 bits); we do not store the full IP address, the browser or the location. If the customer is a consumer, they can accept online only if your company allows it (off by default); the page then shows the information on the right of withdrawal your company has entered and, if your company offers it, a box with which the customer requests that performance begin before the withdrawal period ends; we store their answer with the decision. If your company is established in the EU or the EEA, the customer can withdraw from the contract through the page for up to 18 months after accepting it. We then store the time, name, the email address they give for the acknowledgement of receipt, language, device class and network range; your company sends them the acknowledgement of receipt. This information stays with the quote for as long as your company keeps it in ord1nary. The page sets one cookie (__Host-miphu-angebot) for its forms that binds them to the browser: a random value that expires after one hour (section 25(2) no. 2 TDDDG). We process all of this on behalf of the company that issued the quote; that company is the controller. Its legal basis is Art. 6(1)(b) GDPR, for the withdrawal and its acknowledgement Art. 6(1)(c) GDPR (withdrawal function under Art. 11a of Directive 2011/83/EU, in Germany section 356a BGB).

Online payment. If your company connects an account with the payment service Stripe, its customers can pay invoices online through a link on links.ord1nary.com. Online payment is a contract between your company and Stripe; we hold no money. On your company's instruction we transmit to Stripe, when connecting, the country and name of the company and the email address of the person who connects, for every payment the invoice number, amount, currency and identifiers, and for a refund from ord1nary the amount and identifiers. The payer enters their payment details on Stripe's pages. From Stripe we store for a payment the amount, fee, times, status and payment method, such as card or direct debit, as well as refunds, chargebacks and payouts; we do not store the payer's name, address or payment details. If your company takes over customers from its Stripe account, we read their name, address, email address, phone number and VAT identification number there. For the link we store a fingerprint and how often and when it was first and last opened. The payment page sets one cookie for its form (__Host-miphu-zahlung), a random value that expires after one hour (section 25(2) no. 2 TDDDG). We process all of this on behalf of the company that issued the invoice; that company is the controller, and its legal basis is Art. 6(1)(b) and (f) GDPR. Stripe processes the data under its contract with the company as the company's processor and, for its own purposes such as preventing fraud and checks under anti-money-laundering law, under its own responsibility; Stripe's privacy policy applies to that.

Shipping through Sendcloud. If your company connects its own account with the shipping service Sendcloud, it can create a shipping label from a delivery note. Shipping is a contract between your company and Sendcloud (Sendcloud Global B.V., Netherlands) and the carriers it uses there. On your company's instruction we transmit to Sendcloud for a shipment the recipient's name, company and address, the order and delivery note numbers, the line items with description, quantity, weight, price, item number, customs tariff number and country of origin and the order amount, for a destination outside the EU also the invoice number. We transmit the recipient's email address and phone number only if your company has switched this on or the chosen shipping method requires them. Sendcloud passes the details to the carrier that transports the parcel. From Sendcloud we store the status and history of the shipment, the carrier, tracking numbers and the tracking link, the label and customs documents as documents on the delivery note and the status of returns. We store the keys of the Sendcloud account encrypted; we delete the content of notifications from Sendcloud 30 days after processing. We process all of this on behalf of your company; it is the controller, and its legal basis is Art. 6(1)(b) GDPR. If it gives the email address or phone number to the carrier without the shipping method requiring them, it needs a basis of its own for this, for consumers as a rule their consent (Art. 6(1)(a) GDPR). Sendcloud processes the data as your company's processor, the carriers under their own responsibility according to their privacy notices.

Shop on Shopify. For shops on Shopify we offer the app “ord1nary” in the Shopify App Store. If your company installs it in its shop and connects the shop to ord1nary, we retrieve from Shopify: the shop's name, domain and identifier; orders from the time of connecting and individual older ones on request, with line items, prices, discounts, taxes, shipping costs, payments, refunds and fulfilments; the buyers with name, billing and shipping address, email address, phone number, language and, for businesses, VAT identification number; products and variants with item number, locations and stock levels. From this ord1nary creates customers, orders, invoices, delivery notes and payments according to your company's settings; they are then your company's data like everything else in this section. To Shopify we report the available stock, fulfilments with carrier and tracking number and, if your company switches this on, the link to the issued invoice. We store the access tokens encrypted; we delete the content of notifications from Shopify 30 days after processing. The app's start page in the Shopify admin shows only the status of the connection, sets no cookie and loads the App Bridge script that Shopify requires there; we check Shopify's session token with which it identifies itself and do not store it. If your company disconnects or removes the app, we delete the access tokens at once; when Shopify then asks us to delete the shop's data, we delete the installation, the matching and the status of the orders. If a person requests access or deletion through the shop, we create a task for the owner and delete the matching and notifications concerning them, and also, ourselves, a customer the connection created if no business document your company must retain is attached to it. Orders, invoices, delivery notes and payments remain for as long as your company keeps them in ord1nary. We process all of this on behalf of your company; it is the controller, and its legal basis is Art. 6(1)(b) GDPR, for invoices and their retention (c). Shopify is your company's contracting party. We use data from Shopify only for these services, do not sell it, do not use it for advertising or for training AI, and pass it on only on your company's instruction, for example to Sendcloud or to an AI app a User connects. Questions about this: hello@ord1nary.com.

Email inbox. Your company can create and renew its own inbound address in ord1nary; a renewed address stops accepting mail at once. ord1nary files emails that arrive there as documents: every accepted attachment, the text of the email and the email itself as it arrived, with all headers including the entries of the servers on the way. For this we store the time it was accepted, the sender with address and name, subject, Message-ID and date, the envelope sender, the IP address and name of the server that delivered the email, the results of the SPF, DKIM and DMARC checks, and the record the email was filed on. If an email carries a ticket's number in the address or the subject, ord1nary attaches it to that ticket as a message, and its attachments become documents on the ticket; any other email becomes a ticket only through a user or an AI connection. The emails are accepted by our own server at Hetzner; no third-party service processes them. For the checks, this server queries the public DNS for the sender's domains, without content, and we delete its log after 14 days. The details of an email stay as long as a document from it exists; afterwards we remove the email from the file storage after 35 days and from the second copy after 85 days.

Tickets. A ticket records a customer's or contact's concern: subject, contact details (name, email address, phone number), status, priority, due date, who is responsible, and the history of the customer's messages, reply drafts, recorded replies and internal notes. ord1nary sends no replies: a draft opens in the mail program of the person, who sends it and then records it as sent. If a contact is deleted permanently, ord1nary clears the sender details of their messages; the text stays as your company's correspondence. A ticket stays until your company deletes it. The legal basis lies with your company: Art. 6(1)(b) or (f) GDPR.

Inquiry form. If your company switches on its inquiry form (off by default), it is available at an address on links.ord1nary.com and can be embedded in its website. ord1nary creates a submission with name, email address, message and the fields your company switches on (company, phone, website, place, country, industry) as an enquiry with a contact and a note; ord1nary writes nothing to the sender. The page sets no cookie, loads no script and uses no captcha service; against abuse it checks an invisible field and a time signed by the server and counts submissions per network range (for IPv4 without the last block, for IPv6 the first 64 bits), which we store for this for one day. The page gives the privacy notice on behalf of your company, with a link to its privacy policy if it has entered one. We process this on behalf of your company; its legal basis is Art. 6(1)(b) GDPR, for the network range (f). The same applies to the ticket form (off by default): a submission with name, email address and message becomes a ticket.

Article images. We store images of articles like other files; the original can be read only by your company. From it we create reduced versions without image metadata. Only these versions become public, and only if the owner or the administration switches on the publishing of product images (off by default) and the article and the image are marked for the shop. They can then be retrieved without sign-in at media.ord1nary.com so that a shop can show them. If one of these conditions no longer holds, we delete the public versions within seconds; copies a browser or a shop has cached may remain for up to a day. The apps and the web app currently do not offer the shop, and so neither the publishing of product images nor marking articles and images for it.

Imports. When you import customers, leads, contacts, suppliers or articles from a CSV or Excel file, we check the file for malware and read it on a separate server for file processing, in an environment without network access. We store the rows of the table, your mapping of the columns, the result of the check and the report. An import nobody continues for seven days is ended. We delete the rows and the report 30 days after the import ended, and the file 35 days after it ended.

Do-not-contact list. Your company can record in ord1nary who has objected to being contacted, including people who are not otherwise recorded in ord1nary. For an entry we store the reason as free text, the day of the objection, who recorded it and when, and, where there is one, the lead, customer or contact it was recorded on. The details by which ord1nary recognises the person, that is email address, phone number, website and company name with postal code, are not stored in plain text but only as a checksum (SHA-256) with a salt that is specific to each company. The entries are therefore pseudonymised and remain personal data: the salt is part of the owner's data export, and with it any known detail can be checked against the list. If someone creates a lead, customer or contact whose details are on the list, ord1nary asks first; in an import, ord1nary does not create such rows. As long as the company account exists, we do not delete entries after a period; an entry stays even when the record is hidden, archived or deleted permanently. Only the owner and the administration can lift it. A connected AI app never reads the reason; what it can do with the list is set out in section 9.

Calendar subscription. If the owner of your company has switched on calendar subscriptions (off by default), you can create a calendar link in ord1nary and subscribe to it in a calendar app, for example Apple Calendar or Google Calendar. The calendar shows your open tasks with their due date, your published shifts with their location and, if you may see customers, the customer, and the notice date or the end of term of contracts you are responsible for, but no personnel data, absences, descriptions, notes or amounts. We store the link only as a fingerprint, together with when it was created, last retrieved and revoked; we do not log individual retrievals. Anyone who knows the link can read the calendar; keep it secret, and revoke it in ord1nary if it has fallen into the wrong hands. What your calendar app retrieves is received by its provider. If the subscription is stored in iCloud or with Google, the provider's server may retrieve the calendar, also from the USA; its terms and privacy notices then apply. Whether you may use calendar subscriptions is decided by your company.

Deleting individual entries. Your company can archive and restore customers, contacts and leads or delete them permanently; only the owner and the administration with the Sales right can delete permanently. Where issued business documents, documents with a running retention period or imported business history that ord1nary keeps as to be retained (in Germany, for example, under section 147 of the Fiscal Code, section 14b of the VAT Act and section 257 of the Commercial Code) belong to an entry, ord1nary allows only archiving. For a contact, your company can still remove the personal data: name, email address, phone number, position and title are deleted, and the contact remains without them only for the business documents that refer to it. With an entry deleted permanently we delete the data that belongs only to it, such as its notes; documents assigned only to it and without a retention period then stay in the trash for 30 days. The change log keeps that, when and by whom the entry was changed or deleted, without its content; of deleted leads and contacts we keep the identifier so that a repeated request does not create them again. An entry on the do-not-contact list remains, so that the objection continues to be respected. Information about the person that appears elsewhere as free text, for example in notes on other entries, in documents and their titles or in emails in the inbox, is not removed by the deletion, and neither are issued business documents.

Pay and payroll preparation. If your company keeps its employees' pay in ord1nary, we process it on your company's behalf: fixed salary per month or year, hourly wage or no fixed pay with the day from which it applies and its history, weekly hours, a note, variable components such as commission, bonus or allowance, and the personnel number. The purpose is for your company to prepare its payroll: for each month, ord1nary compiles pay, the planned hours of published shifts, with time recording switched on the recorded hours and per day start, end and break, approved absences, start date and the end of the access into a file your company downloads and passes to its payroll office. ord1nary does not calculate pay. Only the owner and those to whom the owner gives the Personnel right can see and change pay; you see your own pay, including the note, read only. Outside your company, it is received only by whoever your company gives the file to, such as its payroll office, and by an AI app under the conditions in section 9. For pay, the change log contains no amounts, only which fields were changed. We delete pay with your personnel record (section 13), otherwise with the rest of your company's data; we set no period of our own.

Bookkeeping. If your company uses the bookkeeping, ord1nary posts invoices, payments and expenses to the journal; customers, suppliers and employees appear there with an account of their own. A posting is fixed when it is recorded: it can be neither changed nor deleted, only reversed, and the postings are chained by checksums. If your company imports a bank statement (CSV, Excel, CAMT.053 or MT940), we store per transaction the day, amount, the counterparty's name and IBAN, the purpose and reference, and the file as a voucher; ord1nary suggests only unambiguous matches, and nothing is posted until a person or an AI connection confirms them. A payroll journal takes over the result of your company's payroll per month and person (personnel number, name, amounts); the lines per person are seen only by the owner and by whoever has access to finance and the Personnel right. For a tax audit, ord1nary creates an export (section 147(6) AO). ord1nary deletes nothing from the books individually; they go with the rest of your company's data (section 13). The legal basis lies with your company: Art. 6(1)(c) GDPR.

My documents. Your company can make documents from your personnel record available to you under “My documents”. Payslips and contracts it files in your record are released to you by default, other personnel papers only if your company releases them. You see and download the current version while you have an access. We do not log your retrievals under “My documents” one by one: on the release we store only when you first downloaded or viewed the paper, and your company sees this time. ord1nary notifies you about a new paper (section 10).

Applications. If your company switches on applications (off by default), it keeps job openings and applications with name, email address, phone number, stage, day of receipt, notes, tasks and papers such as the CV. Applications are created by users or their AI connection; ord1nary has no application form and writes nothing to applicants. They can be seen by the owner, the administration and whoever holds the Personnel right. After a rejection, ord1nary proposes an application for deletion once the period your company sets has passed (suggested for Germany: six months); it is deleted when someone deletes it. If someone is hired, name, email address and papers go into the personnel record. We process this on behalf of your company; its legal basis is Art. 6(1)(b) GDPR, for keeping an application after a rejection (f).

Working time. If your company switches on time recording (off by default), you record in ord1nary when you arrive, take a break and leave, and, if you like, which customer or order you are working for. We store every entry with the governing time, the time of your device and the time it reached us; without a network the time of your device applies, and the entry is marked as such. We store no location, device identifier or IP address with it. Entries are not overwritten: a later entry or a correction is added with a reason, the original entry stays visible, and each person's entries are chained by checksums. If someone else changes your working time, ord1nary notifies you (section 10). Your working time is seen by you, the owner and anyone in the company with the Personnel or Planning right. On a customer or order, whoever may read it sees the total of the hours and, so that your company can invoice it, an order's time not yet invoiced with person, day and duration; if your company invoices per person, your name and your hours appear on the invoice to its customer. You can download your time as a CSV file. How long the time is kept is set by your company; until then your personnel record cannot be deleted, and we never delete working time on our own. Whether and how your company must record working time follows from the law that applies to it; your company is responsible.

Protocol. ord1nary keeps a protocol for every company. It records when you sign in and out and when a sign-in to your account fails, each with the network range of your device (for IPv4 without the last block, for IPv6 the first 48 bits), and which administrative actions you take, such as changed accesses and rights, AI connections and data exports; changes by SwiftLabs support are recorded with their occasion. What you read is not recorded in it. The owner and the administration can read the protocol, also through an AI connection (section 9). The entries are chained by checksums. We delete the network range after 90 days and the entries after the period your company sets: at least two years, administrative actions of companies in Germany at least ten years (section 147(1) no. 1 and (3) AO). We keep the protocol on behalf of your company; its legal basis is Art. 6(1)(f) GDPR, its legitimate interest in the security of its data and in being able to trace its settings.

If you are an employee, customer or contact of a company and have questions about this data, please contact that company first. We support it in responding.

In the apps:

• Your sign-in is stored in the device keychain together with your sign-in address. If it ends without you signing out, the app opens the sign-in with this address; when you sign out, it deletes both.
• After a correct two-factor authentication code, the app keeps a key in the keychain with which the device counts as trusted (section 2).
• So that lists stay readable without a network connection, the app keeps the most recently loaded state on the device.
• So that you can find entries through system search, the app creates a search index on the device. It contains name or title and place, for enquiries also the phone number, no amounts, and is deleted when you sign out.
• Widgets show follow-ups with title, place and due date, without amounts.
• The app stores appearance settings (light, dark, accent color) per account on the device.

Crash and performance reports. The operating system provides the app with reports on crashes, hangs and the app's performance (Apple MetricKit). The app reads them and sends them to us only if you switch on “Send crash reports” in the app's settings; the switch is off by default. It applies to the device on which you switch it on, and you can switch it off again at any time; the app then reads no more reports and deletes what has not been sent yet. Of a report we store only: the day of receipt, platform and device type (iPhone, iPad, Mac), the versions of the app and the operating system, the report period as dates, counts and durations (for example how often and why the app was terminated, launch and hang times, peak memory and disk writes) and, for a crash, its kind, the exception type and up to 16 entries of the call stack. We store a report without account, company, device identifier, IP address or any text from the app, and delete it after 90 days. Solely to accept no more than 50 reports per person and day, we count them under a key derived from your account; we delete this counter after two days. The legal basis is your consent (section 25(1) TDDDG, Art. 6(1)(a) GDPR); withdrawing it applies to the future.

Web app. The web app on app.ord1nary.com sets six cookies that are technically necessary for the service. All six apply only to app.ord1nary.com, are sent only over HTTPS and cannot be read by scripts in the browser:

• __Host-miphu-sitzung holds your sign-in: encrypted, with the session key and the key for renewing it, your account, your company, your sign-in address and your language. It lasts at most 30 days and is deleted when you sign out.
• __Host-miphu-ende is set by the web app when your sign-in ends without you signing out: encrypted, with your account, the company and its name, the time and your sign-in address. With it, the sign-in page names the company and prefills your address. It lasts at most 30 days and is deleted as soon as you open the company again.
• __Host-miphu-geraet holds an identifier with which our servers recognise a known browser for the limits on sign-in attempts. It lasts 400 days and remains after you sign out.
• __Host-miphu-sprache holds your language for the pages before sign-in. It lasts 400 days.
• __Host-miphu-pruefung holds the open verification step during a sign-in with two-factor authentication: encrypted, with your sign-in address. It lasts ten minutes and is deleted after the code.
• __Host-miphu-vertraut holds, after a correct code, the key with which this browser counts as a trusted device. It lasts 400 days, is renewed at every sign-in and remains after you sign out; it stops working as soon as the trust ends (section 2).

In addition, the web app stores in your browser's storage, per account: your appearance (light, dark, accent color, row density), which columns and areas you have hidden, the five most recently opened entries with their title for “Recent” and the filters of the start page, plus the width of the record panel. Temporarily it keeps entries that have not yet reached us: an action whose answer did not arrive, an invitation with the name, email address and rights of the invited person until it has been sent, and counts of a stocktaking and time-recording entries made without a network until they have been transferred. Each window adds a random identifier that disappears with the window. This information reaches us only as the action concerned. When you sign out, the web app deletes it from your browser. If your sign-in ends without you signing out, only counts of a stocktaking and time-recording entries that have not yet been transferred remain.

The legal basis for storing and reading the cookies and this information is section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act); for the processing afterwards section 2 applies, and for the identifier for the sign-in limits Art. 6(1)(f) GDPR, our legitimate interest in secure operation. The web app reports errors in our program code to us as described in section 4; it stores nothing in your browser for this. The web app loads nothing from third-party servers; fonts and images come from app.ord1nary.com. The exception is the app's start page in the Shopify admin, which loads Shopify's App Bridge script (section 6).

ord1nary contains no third-party analytics, advertising or tracking services.

The services of ord1nary, the database, the storage for uploaded files and the encrypted backups are operated for us by Hetzner Online GmbH (Industriestraße 25, 91710 Gunzenhausen, Germany) as a processor under Art. 28 GDPR. Servers, file storage and backups are located in data centers in Germany.

The server of the web app on app.ord1nary.com is also operated for us by Hetzner, in the data center in Nuremberg. It holds no database and stores no files; it passes requests on to our other servers over a private network.

We store uploaded files encrypted, with a key of its own for each company, in the data center in Nuremberg, and a second copy in Falkenstein. When a company is deleted permanently, we delete its key; its files can then no longer be read in any copy. Only the article images your company publishes are stored unencrypted (section 6).

You can connect an AI app such as Claude or ChatGPT to ord1nary. You sign in with your own ord1nary account, choose the company and the areas, and approve the connection. To answer your requests, the app can then read your company's data that you are allowed to see in ord1nary, in the areas you have approved: leads, customers and contacts with name, position, email address, phone number and postal address, notes and tasks, tickets with their history, quotes, orders and invoices with their payment status, open or overdue amounts and the latest recorded payments, the time on orders not yet invoiced with person, day and duration, expenses, the bookkeeping with journal, accounts, fixed assets and bank statements with the counterparties' names and IBANs, items, stock, suppliers, purchasing and deliveries, the figures of the insights, and the names, titles, ranks and departments of your colleagues. About yourself it reads your name, your email address and your rights in ord1nary. If you are the owner or belong to the administration, it also reads, without you choosing an area, your company's settings with its bank and tax details, the accesses with their roles and rights and the do-not-contact list. Not available through it are credentials and payment method details, files only as described below for the area “Documents”, and personnel data only as described below for the area “Personnel”. The app receives your company's logo as an image, together with the company colour and sender details, so that it can create documents in your company's look. If a lead, customer or contact is on your company's do-not-contact list (section 6), the app also reads the day of the objection. It never reads the reason of an entry on the do-not-contact list.

If the connection has the area “Documents”, the app can read, of the documents you are allowed to see in ord1nary, the title, details such as date, amount and counterparty, the text ord1nary has read or recognised from the file, and the file itself, such as a PDF or an image. The area exists only once the owner or the administration of your company has switched on “AI connections may read documents” in ord1nary (off by default). Under “Selected” it is not preselected when you approve; if the setting is switched off, all connections lose the area at once. The app never reads confidential or restricted documents or documents in the trash, and personnel papers only if the connection also has the area “Personnel” and you are the owner or hold the Personnel right. From the level “Write” upwards it can also file a text or a file of up to 4 MB as a new document, never as personnel papers, change a document's title, type, details and tags, and link a document to a further record or remove that link. ord1nary checks and reads such a file like an upload in the app. In the level “Full” it also moves documents to the trash and brings them back. It cannot finally delete documents or share them with customers.

If the connection has the area “Personnel”, the app can read personnel records with name, personnel number, position, work contact details, start date, working days, departments and leave account, and requested and approved absences with type, period and state. The area exists only if you may see personnel data in ord1nary and the owner of your company has switched on “AI connections may read personnel data” (off by default). The app reads pay and the payroll preparation only if you are the owner or hold the Personnel right. If your company uses applications, it also reads job openings and applications with their papers with the area, creates and changes them from the level “Write” and deletes them in the level “Full”. If you may also see finance, it reads the payroll journal per person and, from the level “Write”, takes one over. Under “Selected” the area is not preselected when approving; if the setting is switched off, all connections lose the area at once. The app changes, from the level “Write”, personnel records and leave entitlements and, if you are the owner or hold the Personnel right, pay; it requests or records absences including sick reports and, if you hold the right, can enter them for others, approve, reject or withdraw them. In the level “Full” it archives personnel records and removes leave entitlements and pay components. With the area “Team”, it reads your own absences and those it enters for others, also without the area “Personnel”. It reads payslips and other personnel papers as described above for the area “Documents”, as text and as a file. Absences, personnel and application papers can contain health data, such as the entry “sickness” or a sick note, and the payroll journal, through church tax, religious affiliation. Your company is responsible for whether they may go to the provider of the AI app; it needs a basis under Art. 9(2) GDPR for this.

If you plan shifts in ord1nary, the app reads with the area “Scheduling”, even without the personnel data setting, the shifts and requested and approved absences with their period, only as holiday or absence, without type and note. From the level “Write” upwards, it creates shifts as drafts, changes them and publishes them, and in the level “Full” it also cancels and removes them. The area exists while your company uses scheduling and you are the owner, belong to the administration or hold the Scheduling right; under “Selected” it is preselected.

The app reads recorded working time only with the area “Working time”, also without the personnel data setting: your own and, if you are the owner or hold the Personnel or Planning right, everybody's, the planned and the recorded minutes per person and day and the individual entries with marks such as added, corrected or offline and hints on legal limits. The area exists while your company uses time recording; under “Selected” it is not preselected. For a customer or order, the app reads the total of the recorded hours without the persons, and for an order, also without this area, the time not yet invoiced with person, day and duration. The app cannot record or change working time.

When approving, you choose the scope and the level of the connection; “All areas” and “Read” are preselected. With “All areas” it has every area you may approve at the time, including one you may only approve later; under “Selected” you choose single areas. In the level “Read” the app cannot change anything. If your AI access allows the level “Write” and you set the connection to it, the app can, on its request and with your access rights, also create and change records and carry out transactions, for example issue quotes and invoices, confirm orders, record payments, post to the journal, import and match bank statements, draft replies to tickets, place purchase orders, post stock and request absences, and, through an import, create many records from a spreadsheet you give the app. In the level “Full” it can also delete and archive records, discard drafts, cancel business documents and postings, close accounting periods, remove the personal data of a contact or customer and create exports for your bookkeeping; if you are the owner or belong to the administration, it also changes, in this level, your company's settings, accesses, rights and departments and the do-not-contact list. If it creates an access or sends an invitation again, ord1nary sends the invitation to the address entered. In no level can it finally delete customers, contacts or leads, change AI access or, apart from feedback to us (section 3), send anything else. It does not create a lead, customer or contact whose details are on the do-not-contact list, not even on your instruction. Whatever the app does this way is treated like your change and is recorded with your name and the connection in your company's audit log. You can change scope and level in ord1nary at any time. When a connection is approved with “Write” or “Full” or its level is raised, we send you an email. If an AI app enters details about other people in this way, for example from emails or the internet, your company is responsible for informing these people.

For the approval, the sign-in page on api.ord1nary.com sets one strictly necessary cookie that links the approval to your sign-in and expires after 10 minutes. If you have two-factor authentication, the page asks for the code and then sets a second cookie (__Host-miphu-vertraut) with which this browser counts as a trusted device; it lasts 400 days and stops working as soon as the trust ends (section 2). The legal basis is Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act).

Which AI app you connect is your own choice. What the app reads is received by the provider of that app, for example Anthropic or OpenAI, which processes it under its own terms and the settings of your account with that provider. This includes whether it may use this content to train its models: on some plans for individuals this is possible when the corresponding setting is turned on. ord1nary itself does not call a language model.

For each request we log the time, duration and outcome, user, company, app, tool and the number of records transmitted, but not search terms or content, so that your company can see which connection retrieved what and when, and so that we keep to the limits per connection. We delete these logs after 90 days. For each connection we store who created it for which company and which app, the approved areas or “All areas”, the level and when it was last changed, when it was last used, and whether and why it was revoked; an entry is also added to your company's audit log. For your account we store your AI access: no AI access, “Read”, “Write” or “Full”. We keep this information for as long as the company account exists.

Agents. The owner and the administration of your company can create agents: company accounts without a sign-in, with their own rights, used by an AI app. If they connect an AI app as an agent, it reads and changes what the agent's rights and level allow, as described above. What an agent writes or changes appears under its name with the label “Agent” in the history and the change log; the AI app produced it. Its provider receives this data under the contract your company or the connecting person has with it. For each agent we store name, rights, level and status and who created it, and of a connection key only a hash.

We process the data the app reads, the request log, the details of the connections and the app's sign-in with your access on behalf of your company (section “Scope”) under section 12 of the data processing agreement. Your company is the controller, including for the legal basis; it receives the request log with its data export.

You can revoke your connection in ord1nary at any time. The owner can revoke any connection in the company and administrators can revoke employees' connections, and the owner can switch connections off for the whole company. The AI app can also end the connection from its side.

ord1nary can notify you about tasks when something happens to them: when someone assigns a task to you or changes the title, description or due date of a task you are responsible for, when a task is open for your department, and when someone takes over, sets to “In progress” or completes a task you created. Several changes to the same task within ten minutes are combined into one notification. ord1nary does not notify you about your own steps. If a time to be reminded is set on a task you or your department are responsible for, ord1nary reminds you then, even if you set it yourself. ord1nary also tells you when a link you created for a customer is opened for the first time and, for a quote, when the customer has decided on it or withdrawn from the contract; these messages go to the person responsible for the quote, otherwise to whoever created the link (section 6). For online payment, ord1nary reports when a payment link is opened for the first time, an invoice is paid online, a payment has not arrived or is disputed, and when Stripe needs details; depending on the kind, these messages go to whoever created the link, the owner and the administration with access to finance. For shipping, ord1nary reports a problem with a shipment and a registered return to the person who created the label, and for Shopify an order that needs review to the person who connected the shop. If ord1nary pauses a connection to Sendcloud or Shopify, the owner and the administration learn of it; if taking over notifications fails, the person who connected does. If your company releases a paper to you under “My documents”, ord1nary notifies you no earlier than two minutes later; if your company withdraws the release before then, there is no message. If someone else records or changes your working time, ord1nary tells you so with the day, without times, reason or name. If you are the owner, ord1nary tells you when an AI connection creates or changes an access or sends an invitation again, with the name of the person whose connection it was and no details of the access. For tickets, ord1nary notifies the person responsible when someone assigns them a ticket and when a customer replies to their ticket, without subject or customer. ord1nary reports an enquiry through the inquiry form to the person responsible for it, otherwise to everyone who may work on enquiries, without the sender's details. If someone mentions you in a note, ord1nary tells you so with the colleague's name, without the text or the record. A notification contains, in the language of your app, the title of the task, a colleague's name, a department name or the task's due date - no amounts and no customer data beyond the title; the messages about an opened link, about the decision on a quote or its withdrawal, about a new paper, about online payments, shipments and Shopify name no document.

For this the app registers your device with us. We store the device identifier Apple issues for ord1nary on that device, the platform (iPhone, iPad or Mac), the version of the app and its language, together with your account, your company and the time it was last seen. The registration belongs to the sign-in that created it: we delete it when you sign out, when your account is deleted or disabled, when your membership of the company ends, or when Apple tells us the identifier is no longer valid. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in delivering the notifications you allow on your device; the content itself comes from your company's data (section 6).

Notifications are delivered through the Apple Push Notification service. Apple receives the device identifier and the text of the notification in the process. Whether your device displays them is your choice in the device settings; which of the seven kinds about tasks you receive you set in ord1nary. All seven are on by default. When you turn a kind off, we also discard what is still waiting for it. The messages about an opened link, about the decision on a quote or its withdrawal, about a new paper, about changed working time, about an access, about online payments, shipments, Shopify, connections, tickets, enquiries from the form and mentions have no switch of their own in ord1nary.

A notification waits at most 24 hours for delivery. Once it has been delivered or has finally failed, we clear its content immediately and remove the record after seven days.

• Hostinger International Ltd., Larnaca (Cyprus) - operation of this website.
• Hetzner Online GmbH, Gunzenhausen - servers, database and backups of the services of ord1nary, the server of the web app, and receiving emails at the inbound addresses.
• Stripe Payments Europe, Limited, Ireland - payments, subscription and invoices when your company concludes ord1nary in the web app, as our processor and for its own purposes under its own responsibility (section 5).
• Resend (Plus Five Five, Inc.), USA - sending sign-in emails and notifications of new AI connections (section 3).
• Apple - purchase and billing of the subscription under its own responsibility, and delivery of the notifications to your device (section 10).
• Microsoft Ireland Operations Limited (Microsoft 365), Ireland - mailbox of our contact address (sections 3 and 12).
• Apple - mailbox of the former address hello@miphu.com.
• Cloudflare, Inc., USA - running the service that passes emails to the AI assistant (section 3).
• Anthropic (Anthropic Ireland, Limited, Ireland, and Anthropic PBC, USA) - Claude as help in handling your requests (section 3).
• Anthropic (Anthropic Ireland, Limited, Ireland, and Anthropic, PBC, USA) - AI assistant that evaluates emails to our mailboxes (section 3).
• Stripe as your company's contracting party when it uses online payment - the details of the invoices its customers pay online (section 6).
• Sendcloud as your company's contracting party when it ships through Sendcloud, and the carriers it uses there - the details of the shipments (section 6).
• Shopify as your company's contracting party when it connects its shop to ord1nary - stock, fulfilments and, if wished, the link to the invoice (section 6).
• The provider of an AI app you connect to ord1nary yourself or your company connects as an agent - the data that app reads (section 9).
• The provider of a calendar app in which you subscribe to your calendar from ord1nary - the dates of that calendar (section 6).

We do not sell personal data. Your data is not passed on to third parties for marketing purposes.

If your company is established outside the EU and the EEA, your company's data goes there when you or your colleagues use ord1nary there or export data. If there is no adequacy decision of the European Commission for that country, the Commission's standard contractual clauses (Module 4), which are part of our data processing agreement with your company, apply (Art. 46(2)(c) GDPR). Such a decision exists for the United Kingdom and Switzerland. Even then, we store your data in Germany (section 8).

Resend (Plus Five Five, Inc.) is based in the USA. We base the transfer on standard contractual clauses under Art. 46(2)(c) GDPR.

Microsoft stores and processes the contents of our mailbox within the EU Data Boundary. In limited cases, data may go to Microsoft Corporation in the USA. The standard contractual clauses in the contract with Microsoft apply to this (Art. 46(2)(c) GDPR); Microsoft Corporation also states that it is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).

Cloudflare, Inc. is based in the USA and states that it is certified under the EU-US Data Privacy Framework (Art. 45 GDPR); otherwise the standard contractual clauses of its data processing addendum apply (Art. 46(2)(c) GDPR).

Anthropic, whose Claude we use for requests to us (section 3), states that it transfers the data to its servers in the USA. Anthropic PBC is not certified under the EU-US Data Privacy Framework (checked on 3 November 2026); for the Claude Max subscriptions there are no standard contractual clauses between us and Anthropic, for the AI assistant under section 3 our contract provides for them. For transfers outside the EEA, Anthropic's privacy policy names adequacy decisions, standard contractual clauses and derogations under Art. 49 GDPR.

If you or your company connect an AI app, also as an agent (section 9), its provider receives the data the app reads. If the provider processes it outside the EU and the EEA, for example in the USA, this is a transfer to a third country. It takes place on the approval and on behalf of your company; the safeguards that apply to it are governed by the agreement between you or your company and the provider, and your company is responsible for whether the transfer is permitted. We do not transfer anything to the provider on our own initiative.

Stripe may transfer data to Stripe, LLC in the USA and to other companies of the Stripe group. Stripe, LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR, checked on 23 October 2026); where it does not apply, the standard contractual clauses in the agreement with Stripe apply, for the subscription ours, for online payment your company's (Art. 46(2)(c) GDPR).

Sendcloud and Shopify receive data under your company's contracts with them; those contracts govern which safeguards apply there to transfers to third countries. If a parcel goes to a country outside the EU and the EEA, the carrier there receives the details of the shipment.

The notifications (section 10) are delivered by the Apple Push Notification service. The contracting party for this service is Apple Inc., based in the USA. Apple does not state where the device token and the text of the notification are processed; we therefore assume a transfer to the USA.

For this one transfer there is no adequacy decision and no standard contractual clauses. Apple Inc. does not participate in the EU-US Data Privacy Framework, and Apple provides no standard contractual clauses for the push service. We therefore base the transfer on your explicit consent under Art. 49(1)(a) GDPR. What that means for you: your data is transferred without the safeguards Chapter V of the GDPR otherwise provides — in particular, US authorities may under US law access data held by US providers, and you may have no effective legal remedy against that. The transfer is therefore voluntary: it only happens if you switch notifications on on your device, for tasks also only for the kinds you keep switched on in ord1nary, and it ends as soon as you switch notifications off on the device again. We also limit the content: no amounts, no customer data beyond the title of a task and no document title, the title of a task cut at 80 characters, and an undeliverable notification is discarded after at most 24 hours.

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21(1)). An informal email to hello@ord1nary.com is enough for a request.

Two of these rights are built into ord1nary:

• Take your data with you. The owner and the administration of a company create a complete copy of the company data as a ZIP archive in ord1nary: on iPhone and iPad under Settings, Company details, “Export data”, on the Mac under Settings, Company, “Export Data”, in the web app in the settings. The finished archive stays available for download for seven days. The owner can still create it after the subscription has ended.
• Delete your account. As the owner, you delete your account in the app and in the web app under Settings, My profile, “Delete Account”. Before you confirm, ord1nary shows you what happens to your access and to the company. An employee's access is managed by their company (below).

After a deletion. When you delete your account, your access ends at once. We permanently delete your sign-in, your email address, your password and your profile photo after 30 days, and backup copies no later than 90 days after that. Within the 30 days you can have the deletion reversed by writing to hello@ord1nary.com. If you are the owner, deleting your account closes the company: we also keep its data for 30 days and then delete it permanently, backup copies no later than 90 days after that. We end a subscription through Stripe at the same time; if the deletion is reversed, it does not resume.

When your company ends your access. Your employer is the controller of your access and your employee data, so an erasure request goes to them, and they carry it out in ord1nary. If you write to us, we forward your request to them. They have two options. Deactivating takes away your access, can be undone, and changes nothing about your name. Deleting ends the access at once and then permanently replaces your personal details in the team: your name, your profile photo and your title. A neutral placeholder takes their place.

The same periods apply as above: we keep the data for 30 days so your company can still undo the deletion within that time, and replace it afterwards; backup copies no later than 90 days after that. What the company is required by law to keep remains — issued documents and shift plans are not altered, so that they stay correct. They will no longer carry your name, though, but the placeholder.

Your personnel record. Your company is the controller of the personnel record it keeps about you in ord1nary; we process it on the company's behalf. When your access is deleted, the record remains for the time being, with your name, work email address and phone number, role, start date, working days, leave entitlement and, if your company keeps it in ord1nary, your pay. The company can archive the record, change its details and delete it individually and permanently as soon as no access holds it; while you have an access, it cannot be deleted. If it contains recorded working time, it can also only be deleted once the retention your company has set for working time has expired. With the record we delete leave entitlements, pay and the releases under “My documents” and clear the notes on your absences; the type and period of the absences and your shifts remain for the company's planning, and documents from the record remain in the area Personnel without the link until the company deletes them. If the company does not delete the record, it is deleted with the rest of its data when the company is closed or its subscription ends, within the periods in this section. We set no retention period of our own for the record.

When a company's subscription ends, its data is kept for at least 90 days; after that the same periods apply as after a deletion by the owner. Regardless of any deletion, we keep the acceptances of the terms of use and the data processing agreement, the subscription records for our accounting and the record of the deletion itself.

Technical records. A sign-in is valid for at most 30 days. Its session key expires after twelve hours without use; while the sign-in is valid, the app and the browser renew it themselves. Links in emails are valid for the periods in section 3. We delete those entries and the message with them as soon as they are used or replaced, and with the account at the latest. We delete the previous and the new address of a change of your email address as soon as the message to the previous address has been sent or the link expires unused. Keys that limit sign-in attempts are deleted as soon as they expire. For AI connections: the call log after 90 days, approvals and authorisation codes one day after they expire, a connection never used after 30 days. Pending notifications lose their content on delivery, and the entry itself is deleted after seven days. We delete the error collection after 30 days and its counter after two days (section 4). For documents, links for customers and imports the periods in section 6 apply, for crash and performance reports those in section 7.

If your questions concern data a company keeps in ord1nary, please contact that company first (section 6).

You may also lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 27, 91522 Ansbach, Germany.

For an account we need your email address and a name. Without them ord1nary cannot be used. No automated decision-making, including profiling, takes place.

If what ord1nary processes changes, we update this policy. The date at the top states the version in force.