Privacy Policy

1. Scope and who we are

This Policy explains how Ordo, operated by Banvya Consultoria em BaaS Ltda. (CNPJ 29.341.943/0001-60, Rua Visconde de Inhaúma, 580, Ribeirão Preto, SP, CEP 14010-100, Brasil, the “Provider”, “we”, “us”), processes personal data on the ordopath.com website, in the web and installable application (PWA), the browser extension, the service desk portal, the feedback widget, the API, the MCP server and the integrations of Ordo (the “Service”).

It has been drafted to comply with the Brazilian General Data Protection Law (Law 13,709/2018, “LGPD”), the European Union General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and its United Kingdom version (“UK GDPR”), the Swiss Federal Act on Data Protection (“nLPD/nFADP”), the California Consumer Privacy Act, as amended by the CPRA (“CCPA”), and the other applicable laws listed in Section 14. It also complies with the Google API Services User Data Policy and the Chrome Web Store Program Policies.

2. Who decides about your data: controller and processor

• Customer Data: the company or team that created or subscribed to the workspace (the “Customer”) is the controller of the data it places in or generates within it — tasks, projects, comments, attachments, member and Contact records, permissions and settings. The Provider acts as operator (processor) (LGPD), processor (GDPR) and service provider (CCPA), following the Customer's instructions. Requests concerning this data should be made first to the Customer; we will assist the Customer.
• Account and website data: the Provider is the controller of the data necessary to operate accounts and the security of the platform as a whole — sign-in identity (which may serve multiple workspaces), the link to Google, fraud and abuse prevention, access logs required by law, billing, communications about the Service, and data submitted through the website's contact form.

3. Data we process

We do not request sensitive personal data (such as health, religion or biometrics). If the Customer places such data in the Content, the Customer is responsible for the corresponding legal basis.

4. Data received from Google (“Sign in with Google”)

If you choose to sign in with your Google account, we use Google's OAuth 2.0 / OpenID Connect with the openid, email and profile scopes, and no others.

Limited Use. Ordo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• we use this data only to provide and improve the Sign in with Google feature, which is visible to you in the Service;
• we do not transfer this data to third parties, except as necessary for that feature, to comply with the law, for security purposes, or in a merger or acquisition with notice to you;
• we do not use or transfer this data for advertising, including personalized or retargeted ads;
• we do not sell this data, we do not use it to determine creditworthiness, and we do not use it to train generalized artificial intelligence or machine learning models;
• no human reads this data, except with your consent, to investigate abuse or a security incident, or where required by law.

Access tokens returned by Google are used only during sign-in and are not stored for subsequent access to your Google account. You may revoke the permission at any time at myaccount.google.com/permissions and unlink Google in your Ordo account settings. To delete the data received from Google, delete your account or write to the Data Protection Officer (Section 18).

5. Chrome extension

The “Ordo — tarefas e projetos” extension does not use your Google account, has no analytics, telemetry or third-party SDKs, and does not execute remote code. It reads the current tab only when you trigger it and sends what you capture only to the Ordo server whose address you yourself provided. The API token is kept only in the browser's local storage. A detailed description of each data item, each permission and how to delete everything is set out in the Extension Privacy Policy, which forms part of this Policy.

6. Purposes and legal bases

When we rely on legitimate interests, we assess whether they are overridden by your rights, and you may object (Section 13). Where the legal basis is consent, you may withdraw it at any time, without affecting processing already carried out. We do not send marketing emails without your consent where the law requires it, and every such email includes an unsubscribe link.

7. Automated decisions and artificial intelligence

Ordo does not make decisions based solely on automated processing that produce legal or similarly significant effects concerning you. Automatic rules configured by the Customer (such as ticket routing, SLA deadlines and alert escalation) serve to organize work and can be reviewed by humans. We do not use Content or data received from Google to train AI models. If the Customer connects an AI agent (for example, via MCP), the processing carried out by that agent is governed by its provider's rules, and every action of the agent is identified in the audit trail.

8. Sharing

We share data only with those who need it to provide the Service, under contract and subject to confidentiality and security obligations:

• infrastructure subprocessors: hosting of servers and the database, storage of files and inbound emails, email delivery, bot protection, push notifications and error monitoring. The full list, with purpose and country, is available at Subprocessors;
• services enabled by the Customer: Google (sign-in and Google Chat), Telegram, Slack, GitHub, GitLab, the SMS provider, webhook destinations and the AI agents it connects via API or MCP;
• the payment processor, where there is a paid online subscription;
• legal, accounting and audit advisors, under confidentiality;
• authorities, where there is a legal obligation or a valid order — and, if permitted by law, we will notify the Customer beforehand;
• successors, in the event of a corporate reorganization, merger or sale of the business, with the safeguards of this Policy maintained.

We do not sell personal data and we do not “share” it for cross-context behavioral advertising, within the meaning of the CCPA/CPRA. Within the workspace, what each person sees depends on the permissions defined by the Customer. The audit trail is visible to administrators. Confidential tasks show their content only to their participants.

9. International transfers

The Provider is located in Brazil. Some subprocessors and connected services process data in other countries, such as the United States and countries of the European Union and, for integrations the Customer turns on, the other countries shown in the Subprocessors list. Any transfer takes place only when necessary for the feature being used and with appropriate safeguards:

• LGPD: standard contractual clauses approved by the ANPD (ANPD Board of Directors Resolution CD/ANPD No. 19/2024) or another mechanism under art. 33;
• GDPR: adequacy decisions of the European Commission (including the one recognizing Brazil, where applicable, and the EU-U.S. Data Privacy Framework for certified vendors) or Standard Contractual Clauses (Decision 2021/914), with supplementary measures;
• United Kingdom and Switzerland: the UK Addendum to the Standard Contractual Clauses (IDTA/Addendum) and the adaptations required by the nFADP.

You may request a copy of the applicable safeguards through the Data Protection Officer contact.

10. How long we keep data

Some data may be kept longer where there is a legal obligation or a need for defense in proceedings, and only for as long as necessary.

11. Security

We adopt technical and organizational measures proportionate to the risk, such as: encrypted connections (HTTPS with HSTS), passwords and tokens stored only as hashes, isolation of each workspace's data with automated tests, role-based and need-to-know access control, bot challenges and rate limiting on sign-in screens, files served through signed temporary links, signed webhooks, an audit trail, backups, and error monitoring with removal of sensitive data. Details are available on the Security page. No system is completely immune to incidents; that is why we also rely on you to protect your account.

12. Cookies and local storage

We use only strictly necessary cookies and storage, which do not require consent under the ePrivacy Directive and the LGPD. We do not use advertising cookies, cross-site tracking or third-party analytics tools. The website's fonts are served from our own servers.

We honor the Global Privacy Control (GPC) signal as a request to opt out of sale or sharing — which, in any event, we do not do.

13. Your rights

Depending on the law applicable to you, you may request:

• confirmation of and access to the data we process and a copy of it;
• rectification of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of data that is unnecessary, excessive or processed in breach of the law, and deletion of data processed on the basis of consent;
• portability of data in a structured, commonly used format;
• information about whom we share data with and about the possibility of not giving consent;
• objection to processing based on legitimate interests and restriction of processing;
• withdrawal of consent, where that is the legal basis;
• review of automated decisions;
• to lodge a complaint with the data protection supervisory authority (Section 14).

How to exercise your rights. Write to [email protected] or use the contact form with the subject “Privacy”. Many actions you can take yourself within the Service: correcting your profile, unlinking Google, revoking tokens, exporting and deleting your account. We may ask for information to confirm your identity before responding, in order to protect your data. You may act through an authorized agent, with proof of authorization.

Response times. We respond within 15 days (LGPD, art. 19), within 1 month, extendable by a further 2 months in complex cases (GDPR), and within 45 days, extendable by a further 45 (CCPA). Responses are free of charge, except for manifestly unfounded or excessive requests, where permitted by law.

Customer Data. Where the Customer is the controller (tasks, comments, records, permissions), we will forward the request to the Customer and assist it in responding. Some data cannot be deleted while there is a legal obligation or a need for evidence, such as access logs. You will not be discriminated against for exercising your rights.

14. Region-specific information

If you are in another country, we apply this Policy and the mandatory protections of your local law.

15. Security incidents

We maintain an incident response plan. If an incident occurs that may pose a relevant risk or harm, we will notify the ANPD and the affected data subjects within the period set by ANPD Resolution CD/ANPD No. 15/2024 (3 business days), where we are the controller; we will notify the competent supervisory authority within 72 hours where the GDPR applies; and, where we act as operator (processor), we will notify the Customer without undue delay, with the information it needs to meet its own obligations.

16. Children and adolescents

The Service is intended for professional use by individuals over 18 years of age and is not directed to children. We do not knowingly collect data from individuals under 18. If we learn that this has occurred without a legal basis, we will delete the data. If you believe this has occurred, write to the Data Protection Officer.

17. Changes

This Policy may be updated. The version in force and its date are always published on this page. Material changes will be notified within the Service or by email before they take effect and, where required by law, we will request new consent.

18. Data Protection Officer (DPO) and contact

The Provider's Data Protection Officer (DPO / encarregado): Artur da Silva Júnior — [email protected]. Address: Banvya Consultoria em BaaS Ltda., Rua Visconde de Inhaúma, 580, Ribeirão Preto, SP, CEP 14010-100, Brasil. For data processed on behalf of your company, also contact the data protection officer appointed by it. The Terms of Use, the Extension Privacy Policy and the list of Subprocessors supplement this Policy.

This document is also available in Portuguese, English and Spanish. If the versions differ, the Portuguese version prevails.