Privacy policy

1. Who is responsible

For account data (your name, email, agency and billing details) Ordyum acts as data controller.

For the data agencies store about their clients’ leads and customers, the agency is the controller and Ordyum acts as processor, following the agency’s instructions.

Ordyum is operated from Canada and follows the federal Personal Information Protection and Electronic Documents Act (PIPEDA), the provincial privacy laws that apply (such as Quebec’s Law 25 and the Alberta and British Columbia PIPA), and the GDPR for agencies in the European Union.

2. Data we process

Account data: name, email, password hash, language, timezone, role and the workspaces you belong to.

Billing data: agency name, plan, subscription status and the payment history (amount, date, gateway and reference). Card and PayPal account details are handled directly by Stripe or PayPal and never reach our servers.

CRM data: contacts, companies, deals, activities and attribution (UTM parameters and ad click identifiers) that you capture or import.

Technical data: IP address and user agent for security, rate limiting and the audit log.

3. Why we use it

To provide and secure the service, process payments, send transactional emails (invitations, password resets, billing notices, weekly reports) and answer support and sales requests.

We do not sell personal data and we do not use CRM data to advertise.

4. Sub-processors and transfers

We rely on infrastructure, email delivery and payment providers (such as Stripe and PayPal) bound by data-processing agreements. When you connect Google Ads, Meta or Shopify, data is exchanged with them on your instruction.

Our servers are in Canada. Some providers may process data in other countries, such as the United States, where it is subject to local law and may be accessed by that country’s authorities; we protect it by contract. For agencies in the European Economic Area, transfers to Canada rely on the European Commission’s adequacy decision, and other transfers on standard contractual clauses.

5. Security

Workspaces are isolated with row-level security in the database, API keys are stored as hashes, integration secrets are encrypted, and sensitive actions are recorded in an audit log.

If a breach of security safeguards creates a real risk of significant harm, we notify the people affected and the Office of the Privacy Commissioner of Canada (and the Commission d’accès à l’information when Quebec residents are affected), and we keep a record of every breach.

6. Retention

We keep account and CRM data while the agency has an account. When an agency is deleted, its data is removed from our active systems; backups expire on their regular cycle.

Contact form requests sent from our website are kept for up to 24 months.

7. Your rights

You can access, correct, export or delete your account data, and object to or restrict certain processing. Leads and customers of an agency should contact that agency first; we will help it respond.

Our privacy officer handles these requests. Contact: the contact form on this website, topic “Privacy & data”. If you are not satisfied with the answer, you can complain to the Office of the Privacy Commissioner of Canada or, depending on your province, to the Commission d’accès à l’information du Québec or the Alberta or British Columbia privacy commissioner. In the European Union you can also turn to your data-protection authority.

8. Cookies

We use only the cookies needed to keep you signed in and remember your preferences (language and theme). We do not use advertising cookies on Ordyum.

9. Data from Google and Meta

When a workspace admin connects Gmail, Google Ads, Meta (Facebook / Instagram Lead Ads, WhatsApp Business) or Microsoft 365, Ordyum only requests the permissions needed for the feature the agency turns on: reading and sending the emails of the connected inbox, receiving lead form submissions, uploading offline conversions and reading campaign spend.

Ordyum’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use that data for advertising, we do not sell it, we do not use it to train general-purpose AI models, and Ordyum staff only access it when the agency asks for support, for security reasons or when the law requires it; every such access is recorded in the agency’s audit log.

Tokens are encrypted at rest and never returned by our API. Disconnecting an integration in Settings → Integrations deletes its tokens; you can also revoke access from your Google or Meta account at any time. To have all data removed, follow the instructions on our data deletion page (/legal/data-deletion).