Privacy Policy

1. Information we collect from vendors

• Account information: name, email, password (stored only as a secure hash), language, and two-factor authentication settings (authenticator secret, phone number for SMS codes).
• Business information: business name, logo, currency, product types, WhatsApp number, pickup address and catalog settings.
• Business records you enter: products, photos, prices, costs, stock, suppliers, purchases, expenses, sales, receipts, clients and notes.
• Billing information: subscription status and history. Card details are collected and stored by Stripe, not by OrdenStock.
• Security and usage data: login times, IP address, device and browser information, trusted devices and active sessions, used to protect your account.

2. Information we collect from customers

When a customer uses a vendor's public catalog, they do not create an account. We collect only what is needed to handle their order or request:

• Order details: products, quantities, totals, delivery or pickup choice, and optional notes.
• Contact details the customer enters: name, WhatsApp phone number and, for delivery, address.
• Catalog activity: a random anonymous visitor ID stored in the browser, product views, "Ask about this" taps and visits by link or QR code, used for the vendor's statistics.
• Feedback messages and contact details customers choose to submit.

This information is shared with the vendor whose catalog the customer used. The vendor decides how to use it to serve the customer and is responsible for it. WhatsApp messages are sent through the customer's own WhatsApp app and are not stored by OrdenStock.

3. How we use information

• to provide the Service: inventory, sales, catalog, orders, receipts and reports;
• to send service emails: verification codes, order alerts, summaries, trial and billing notices (you can turn off optional summaries in Settings or on the Catalog page);
• to process subscriptions and payments through Stripe;
• to keep accounts secure, prevent fraud and abuse, and fix problems.

4. We do not sell your data

OrdenStock does not sell, rent or trade personal information about vendors or their customers to third parties, and we do not use it for third-party advertising.

5. Service providers

We share information only with providers that help us run the Service, under agreements that limit their use of it:

• Stripe: payment processing and subscription management;
• Resend: sending email;
• Twilio: sending SMS verification codes, if you choose SMS;
• cloud hosting, database and file storage providers that store the Service's data.

We may also disclose information if required by law or to protect the rights, safety and security of our users or the Service.

6. How data is stored and protected

Data is stored in secured cloud databases and file storage. Each business's data is kept separate from other businesses and is accessible only to that business's account. Connections use HTTPS encryption. Passwords are hashed, and accounts are protected by two-factor authentication, session controls and rate limits. No system is completely secure, but we work to protect your information and will notify affected users of a breach as required by law.

7. Data retention

We keep vendor data for as long as the account is active. If a vendor deletes their account, we delete or anonymize their business data within a reasonable period, except records we must keep for legal, tax or security reasons. Vendors can delete individual client and order records at any time.

8. Your rights and choices

You can access, correct, export or delete your information from the app, or by contacting us. California residents have rights under the California Consumer Privacy Act (CCPA/CPRA), including the right to know, delete and correct personal information and to not be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioral advertising.

Customers who placed an order through a vendor's catalog should contact that vendor first; we will help vendors respond to these requests.

9. Cookies and local storage

We use the browser's local storage for login sessions, language and preferences, and, on public catalogs, for the anonymous visitor ID and the customer's cart. We do not use third-party advertising cookies.

10. Children

OrdenStock is intended for businesses and is not directed to children under 13. We do not knowingly collect personal information from children.

11. Changes and contact

We may update this Policy and will post the new version on this page with a new date, notifying vendors by email of material changes. Questions or requests: support@ordenstock.com