What Ordryx keeps, and why.

1. Who we are

Ordryx is made by Ordryx LLC, a Colorado limited liability company (Colorado ID 20268283789, formed 20 October 2026). In this policy, "we" and "us" mean Ordryx LLC.

This policy covers the website ordryx.com, the Ordryx account at account.ordryx.com, the shops we host, what we see of shops that run Ordryx themselves, the Ordryx app for Shopify, the Ordryx for WooCommerce plugin for WordPress, and the Ordryx POS app once it's released.

It doesn't cover Shopify, WordPress, shipping companies or anything else a shop connects to its Ordryx. Their own policies cover what they do.

To reach us about privacy, see Contact us.

2. Whose information it is

Ordryx holds two kinds of information, and who is responsible for each differs.

About you, as our visitor or customer

When you visit ordryx.com, answer our questions, make an Ordryx account or send us feedback, we decide what's kept and why. We're responsible for it.

A shop's own records

Orders, customers, staff, contractors, suppliers and stock belong to the shop. The shop decides what goes in, who sees it and how long it stays.

• A shop that runs Ordryx itself keeps its records on its own computer. We hold none of them and can't reach them.
• A shop we host keeps its records on our server. We keep them for the shop, use them only to run the shop's Ordryx, and follow the shop's instructions, as Part 2 of our terms (the data processing agreement) sets out.

If you bought something from a shop that uses Ordryx, that shop is the one to ask about your details. See section 16.

3. The website (ordryx.com)

Visiting

The site sets no cookies and keeps nothing in your browser. It has no analytics. Every page, font and picture comes from ordryx.com itself, so no other company learns of your visit. Our web server keeps no log of visits.

Because we don't track you across sites, and no other company collects anything on our pages, Do Not Track and Global Privacy Control signals change nothing here.

Cloudflare answers for our domain name, but it doesn't carry the visit: pages come straight from our server.

The early-tester sign-up and the questions

The sign-up at /early and the questions at /questions are the only forms on the site.

Answers are kept in the Ordryx account's database on our server, with a copy (without the fingerprint) in our operations dashboard. When one arrives, we email ourselves a short notice: its number, the first line of what you make, and which boxes you ticked. Never your name or email.

Your answers are never sold or shared, as the forms say: we sell no one's information, share none for advertising, and give your answers to no one outside Ordryx. Only the companies that run our server and send our email handle them, for us (section 13).

4. Your Ordryx account (account.ordryx.com)

You have an Ordryx account if we host a shop for you, or if you've linked your own Ordryx to one (for the Shopify app, the WooCommerce plugin, HTTPS on your shop's network or remote access).

If we host a shop for you

Our operations dashboard also keeps a customer record: your name, email, company and phone, how and when you like to be reached, your time zone, your billing and mailing address, our notes, your email choices and your invites. It's for running and supporting your hosting, and only our staff see it. It's erased when you delete your account: your names, emails and addresses, in our records about you. We keep its number, its dates, which shops were yours, the names of your installs and the record of notices sent (no name or address), for our books.

Our dashboard also keeps an activity record of what we did, and some entries name you (an invite sent to your email, say). It's kept 1 year, except the record of a shop's removal, and the entries that name you are blanked when you delete your account.

Paying us

Ordryx is free while hosting is being tested, and we keep no payment details. Prices, billing and refunds will be added here, and emailed to you 30 days before anything is charged. When billing starts, cards will be entered on Stripe's own page, and we'll never see or keep card numbers.

Emails we send you

Only about your account and your shops: a password reset, confirming a new email address (with a notice to the old one), changes to your sign-in, a sign-in from a new device, your linked Ordryx being offline for a day or changing address, your hosted shop being down or back, an update coming in 7 days, an update done, a backup downloaded, a customer's privacy request waiting on your Ordryx, your account deleted, and sign-up codes and invites. They're sent from info@ordryx.com through Fastmail, and a copy stays in our Sent folder. We keep a record of which notice went to whom, and when. Sent copies and that record are kept 1 year.

Downloading and deleting your account

Download my account data gives you one file: your details, your sign-ins with their full network addresses, your linked installs (their names, dates and versions) and your support conversations. It also holds your passkeys, each linked install's addresses (its last public network address and its address on your own network), your current sessions, the Shopify stores and WooCommerce sites connected to your installs, the terms you agreed to, and, for hosted customers, the customer record above, without our notes. If our dashboard can't be reached, the file says so: download it again later.

Delete account asks for your email and proof that it's you. While you have hosted shops or linked installs, remove them first. Then your name and email are wiped; your sign-ins, passkeys and recovery codes are deleted; your sessions end and their network addresses are blanked; and your support conversations are deleted here, in our dashboard and in shops still connected. We email you to confirm.

What stays: an empty record with its number and dates, so numbers are never reused; the records of installs you removed, for 90 days (section 5); log lines, for 30 days; from a hosted customer's record, only its number, dates, which shops were yours and the names of your installs; and copies in our backups until they age out (section 14).

5. Linking your own Ordryx

If you run Ordryx yourself, you can link it to your Ordryx account. Linking is what the Shopify app, the WooCommerce plugin, HTTPS on your shop's network and remote access go through.

Some things pass through our account on their way to your Ordryx and aren't kept: a Shopify store's key (when it's first handed over, and each hour when it's renewed), WooCommerce's read-only key, what the Shopify app's page and the plugin's tab show, orders shipped from your Ordryx on their way to your WooCommerce store, lists of orders to forget, and a Shopify store's erasure (section 9).

6. Shops we host

A hosted shop's whole Ordryx (its database, its documents, its local backups and its logs) lives on our server at DigitalOcean in New York, USA. Each shop runs on its own, and one shop can't reach another.

On that server, everything we keep (every hosted shop, the Ordryx account and our dashboard) is stored in an encrypted vault (LUKS2), opened by a passphrase only Ordryx LLC's owner holds. After any restart the server stays locked, with nothing running, until the owner unlocks it (since 13 November 2026).

What we do with it

We run your shop's Ordryx. We don't read your orders, customers or other records. To watch over the shop, our dashboard reads only its version, its health check, which modules are switched on, two settings (its time zone and where its backups go), its off-site backup records, a few backup entries from its activity log, its performance figures and its log lines (which name your staff by username). It has no screen that shows a shop's orders or customers, and it can't download a shop's backups. When you download a backup through your account, we email you each time.

We look inside a hosted shop only to keep it running or safe, to fix a fault, when the shop asks us in writing, or when the law requires it, and we note each time. Asking the shop first before anyone looks (support access only with its consent) is planned, not built.

Who at Ordryx can reach it

While the server runs, its vault is open, so anyone with full access to the running server could read any hosted shop's records. Only Ordryx LLC's owner has that access, with a key, never a password. Today the server accepts that key from anywhere on the internet; allowing it only over our private network is planned, with no date set. The accounts that run our servers and code (DigitalOcean, GitHub, Tailscale, Cloudflare, Fastmail, our Shopify Partner account and our domain's registrar) each have a password from a password manager and two-step sign-in with an authenticator app or a passkey, never a text message, and nobody else is on them. Who has access is reviewed every month.

The owner sometimes has an AI coding assistant run commands on our server, each one the owner approves, and only commands whose output names no customer. It never reads a hosted shop's data, logs, activity or backups. If one ever did, its company would be listed in section 13 first.

Copies

• Local backups on the server: 14 by default; your shop's owner chooses 1 to 365, within the hosting plan's limit on copies and space.
• A safety copy before every update, deleted once the update is through.
• Off-site copies, if you turn them on: encrypted in your shop, with your passphrase, before they leave; kept on a server in Colorado, USA, under Ordryx LLC's control, on encrypted storage, away from DigitalOcean. 30 by default (your shop's owner chooses 1 to 365), within the same limit on space, then 30 days in the trash.

The local backups, the safety copy and the off-site copies hold no shipping label's file or customs form (section 8), and their database holds customers' ship-to addresses only encrypted. Backups made before those rules (Ordryx 0.0.206 and 0.0.209) still hold them until they age out. DigitalOcean no longer backs up the server (since 13 November 2026). The old server's last DigitalOcean backups, from before the vault, are unencrypted copies of its disk; DigitalOcean doesn't let them be deleted, and the last ages out by 25 November 2026.

Leaving

You can download a backup of your shop at any time. To close a hosted shop, ask at privacy@ordryx.com: we confirm it with you and remove it within 7 days. Its backups can then be downloaded from your account for 30 days. Its off-site copies are deleted 30 days after the removal, and so is its folder on our server (its database, documents and backups, with any copies a restore set aside, and its keys), by our dashboard itself.

A hosted shop can't send email yet. When it can, the provider it sends through will be named in section 13 first.

7. Shops that run Ordryx themselves

If you run Ordryx on your own computer, your shop's records stay there. Ordryx LLC holds none of them and can't reach them.

Your Ordryx contacts us only when you choose to: when you link it to your account (section 5) and when you send us feedback (section 12). It doesn't check in with us, report how it's used, or send analytics. Off-site copies go only to storage you choose (a folder, or your own storage account), never to ours.

That computer is yours to look after: who can reach it, whether its disk is encrypted, its backups, and whether your shop's network uses HTTPS. Our terms say so.

8. What a shop's Ordryx keeps

This is what Ordryx keeps inside a shop, about the shop's customers, staff and contractors, and the rules it follows. It's the same whether the shop runs Ordryx itself or we host it. The shop decides how it's used.

Customers' orders

The shop's own records. Orders the shop types in (their customers and addresses), receipt emails taken at the till, and a WooCommerce buyer's name and email while the store is connected belong to the shop, as do its activity log, its old sessions and the people it has turned off (below). They're kept until the shop deletes them: Ordryx removes none of them by itself, and most have no delete button in Ordryx today. For a shop we host, we keep them as its processor (Part 2 of our terms). Store orders' addresses follow the rules in the table.

Every order's ship-to, a store's or a typed-in one's, is kept encrypted in the shop's database, with the same key as the shop's saved passwords. When a store order's address is cleared, everything else in the shop's Ordryx that could hold it or confirm it goes with it: the store's keyed mark of the last address it sent (used to tell a store's change from a staff correction), shipping companies' error messages and rate notes, a batch's problem for that order, the parcel's towns and ZIPs and the shipping company's own words on its scans (Ordryx's plain word, such as Delivered, stays), and the label's file and customs form. The database overwrites what's cleared, so it doesn't linger in the file. Backups made before keep it until they age out (section 14). The shipping company's end-of-day SCAN form, which lists its parcels' ZIPs, is kept.

Where customers' addresses go

• Only to the shipping accounts the shop connects itself (EasyPost, Shippo, ShipStation, UPS, FedEx, USPS or DHL Express), to get prices and buy labels: the name, company, address and phone. A parcel to another country also carries a customs declaration: what's in it, what it's worth and where it was made. Never the customer's email. The shipping company keeps these under its own terms with the shop. Rates and labels asked for with a shipping account's Test key never get the customer's name, street, company or phone: they go to a sample recipient in the order's own town, state, ZIP and country.
• Back to the store, a tracking number, never the address. For a Shopify store, only if the shop's owner turns on Tell Shopify the tracking number (it starts off): the carrier and tracking number go back as a fulfillment, and it's cancelled if the label is voided. Shopify then emails the customer unless the shop turns off Email the customer, or unticks it when buying that label. For a WooCommerce store, WooCommerce marks the order shipped (section 10).
• Never into spreadsheet downloads and reports, answers to AI assistants, the diagnostics files sent to us, or logs. The one file that carries them is a customer's own data, which the shop downloads to answer that customer's request (Sales › Customers' data, JSON or CSV), only for people given See customers' addresses, and each download is recorded (below). Ordryx itself never emails an online store's customers.

A shipping label's file carries the address. It's kept only until the shipping company has the parcel: it goes a day after the first scan, once a void goes through, when the order's address is cleared, a day after it was made for a Test-key label, and 14 days after it was kept for a label never scanned; none is kept past 16 days. A parcel abroad also keeps the carrier's customs form, which shows the recipient's name and address; it goes with its label. Neither is ever put in a backup, a safety copy before an update or an off-site copy. Packing slips and pick lists are made fresh each time they're printed and never stored.

Tracking keeps the shipping company's scans with their towns. For a store's order, the towns and ZIPs go 90 days after the parcel is done, or with the order's address if that goes first; the state stays, for the map. A typed-in order's parcel keeps them, as its order keeps its address.

In the shop, only people given See customers' addresses see where an order ships to: on the order page, Buy a label, labels, packing slips and customs forms. It's on for the roles that ship, and the shop decides who else. The orders list shows no address, to anyone. Each time someone is shown an address (opening an order, Buy a label, rates checked against it, printing or downloading a label, a packing slip or a customs form, a parcel's tracking with its towns and ZIPs, or a customer's data downloaded), the shop's activity log records who, when and which order, never the address. The shop sees these under Settings › Activity, Address views.

Staff and their sign-in

Each person's username, name, email if given, password (as a one-way hash), two-step key (encrypted) and passkeys. Two-step sign-in is required for everyone on the shop's staff; contractors in the contractor portal, who see only their own work, may choose it. Each session keeps the network address and browser it was started from, and ends after 14 days unused or 90 days at most. The shop's Ordryx sets two cookies, both only for signing in: one keeps the person signed in, and one, if they tick it, remembers their device for two-step sign-in for 30 days.

The activity log records who did what, and some entries name a customer (for example, "Entered order M-1001 for" a name). It also keeps each sign-in and failed sign-in with the network address it came from, including tries at usernames that don't exist. The shop's log files keep no network addresses: each request's line has its path (with record numbers, never a query or what was sent), its result and the username. Log files are kept by size, about the last 50 MB. The activity log (its record of address views too), old sessions' records and people who are turned off are the shop's own records. Ordryx removes none of them by itself and has no button to delete them (people are turned off, never deleted), so they stay as long as the shop's Ordryx does.

Contractors

For a shop that pays people to make things at home: their name, company, email, phone and notes, how they like to be paid (never bank details) and, for tax forms, their legal name, mailing address and tax ID. The tax ID and the W-9 file are encrypted. The tax ID is shown masked to its last four digits. People who pay or manage contractors can show the whole number and open a W-9, and the year's tax-time summary they download includes each paid contractor's legal name, mailing address and tax ID. Each showing, each opening and each such download is logged.

Payment receipts are permanent, because their codes are already on paper: anyone holding a receipt's code can check it on the shop's /verify page, which shows the payee's name, the item, the quantity, the amount, the method and the date. A contractor who has been paid stays on record for the shop's tax records.

AI assistants

Off unless the shop's owner turns it on. A shop can connect its own AI assistant to read some of its Ordryx: stock and its history (with who made each change, and its notes), what can be made, what to make, printers, totals of open orders, and contractors' work (names and checking notes, never pay). No answer includes a customer's name, email or address. The assistant's company gets what those answers say, under the shop's own agreement with it. Ordryx keeps a log of the calls for 90 days (the newest 100,000).

Email and notifications

A shop's Ordryx sends email through the shop's own mail account. Phone and browser notifications are off until the shop's owner turns them on. Each one is encrypted end to end, so the notification service (Google, Mozilla, Apple or Microsoft) sees only that a message went to a device, and when.

9. The Ordryx app for Shopify

The app connects a Shopify store to the shop's own Ordryx. The shop's Ordryx then reads the store straight from Shopify, not through us.

What the app may read and write

Orders, fulfillments, products and locations. It writes only one thing, and only if the shop's owner turns on Tell Shopify the tracking number (it starts off): when a label is bought in Ordryx, a fulfillment with the carrier and tracking number, cancelled again if the label is voided. From orders waiting to ship it reads the ship-to name, address and phone, which Shopify calls protected customer data; never the customer's email. What's kept, and for how long, is in section 8.

What our account handles

• Connecting. Our account turns Shopify's sign-in into the store's key and passes the key to the shop's Ordryx without keeping it, and again each hour when the key is renewed. We keep the store's myshopify address, which Ordryx it's connected to, when, and the name of the staff member who connected it.
• The app's page in Shopify. To check that only the store's owner connects or disconnects, we ask Shopify who's looking at the page, and hold their name, Shopify's number for them and whether they own the store, for 10 minutes. Shopify sends their email with these; we don't keep it. Their name and whether they own the store also go with each thing they ask from the page to the shop's Ordryx, which uses them to check who may do what.
• When an order changes. Shopify tells our account only the order's number and the time it changed. We don't read or keep even that; we only tell the shop's Ordryx to look.
• When a customer asks a store to forget them. We pass the order numbers to the shop's Ordryx and keep them only until it confirms. It clears those orders' addresses, and every copy of them (section 8), as soon as it receives them, even with its Shopify module switched off, and never reads them again. Shopify asks for this to be done within 30 days. A shop's Ordryx that stays offline receives them later; when they wait on one that's offline, has External access off, or is too old to take them, we're alerted, and the shop's owner is emailed after 3 days, in time to act within the 30 days.
• When a customer asks a store for their details. Shopify asks for that customer's data to be given to the store's owner directly, within 30 days. We pass the request on to the shop's Ordryx, keeping only Shopify's request number and the order numbers, never the customer's email or phone. The shop's Ordryx shows it with its due date (Sales › Customers' data), and someone at the shop given See customers' addresses downloads that customer's data as a file (JSON or CSV), with what was already cleared and when, and sends it to them. Ordryx never emails it. If the request waits on a shop's Ordryx that's offline, it's handled as a request to forget, above.
• When a store asks to be erased (Shopify sends this 48 hours after an uninstall), we clear the name of who connected it and our older records of it, and pass the erasure to each Ordryx that had the store before that uninstall. That Ordryx clears the ship-to of every one of the store's orders, waiting or done, and every copy of them, unless it still reads the store with a key Shopify takes. We keep the erasure until it's acknowledged, then a week. Our record of which Ordryx a store is connected to goes once that Ordryx confirms the app is gone. A notice that a store was uninstalled or moved is kept 100 days once acknowledged.

Uninstalling

The shop's Ordryx stops reading the store. It clears the addresses of orders still waiting to ship as soon as it hears of the uninstall and confirms it with Shopify, and every other order's 29 days after the uninstall (by Shopify's time), or sooner when the store's erasure arrives. The order records stay in the shop's Ordryx.

10. Ordryx for WooCommerce

The plugin connects a WooCommerce store to the shop's own Ordryx. The shop's Ordryx then reads the store's orders and products itself, with a read-only key. What it keeps is in section 8.

What the plugin sends to our account

• When you type the code and press Continue: the code, the site's address and name, its WordPress, WooCommerce and plugin versions, whether orders are in WooCommerce's own tables, the name of the Administrator connecting, and that they ticked to agree to our terms (since the plugin 0.5.4).
• When an order changes: a signed notice that something changed, at most once a minute. It names no order.
• Once a day, and when the Ordryx tab opens: a signed check of the connection.
• When someone presses Sync now, Pause, Resume or a sales channel, or deactivates, disconnects or deletes the plugin: what they did, and their name.
• When WordPress erases a customer's details from orders: those orders' numbers, so the shop's Ordryx forgets the customer at once.
• With every signed call: the site's own address, so our account refuses one from a copy of the site, such as a staging copy, and nothing from a copy acts for the live store (since the plugin 0.5.1).

What our account keeps

The store's number with us, the site's address and name, which Ordryx it's connected to, the name of the Administrator who connected it and their agreement to our terms (section 4), a secret shared with the site (encrypted), and WooCommerce's number for Ordryx's key, never the key itself. A notice owed to the shop's Ordryx (paused, disconnected or deleted, and by whom) is kept until it's received, then 30 days. A disconnected store's record goes 30 days after. When the Ordryx it's connected to is removed from its account, the store's record goes a month after the plugin's next check, or a year after the removal if the plugin never checks again. Shipped orders (with the name of who shipped them), the read-only key, what the tab shows and erasure lists pass through without being kept.

What the plugin writes to the store

When an order is shipped from the shop's Ordryx, the plugin marks it Completed and adds the tracking (where the store keeps tracking, or else as a note to the customer, which WooCommerce emails), and a private note naming who shipped it in Ordryx. WooCommerce may then email the customer. Only a tracking number, a carrier's plain name and a link to that carrier's own tracking page reach the customer: Ordryx refuses a typed tracking number that isn't letters and digits as carriers make them, and the plugin leaves out a carrier's name that isn't a plain name (since Ordryx 0.0.219 and the plugin 0.5.3). Once the store is disconnected, the plugin deletes Ordryx's key from the store. Deleting the plugin removes its settings and Ordryx's key from the store, on every site of a multisite network (since the plugin 0.5.2).

11. The Ordryx POS app

The app for taking payments on a phone isn't released yet. As planned, it signs a person in to their shop's own Ordryx, and its sales go there, to the shop's own Ordryx, not to us. Card details are handled only by Stripe's software and reader, never by Ordryx. As planned, it has no crash reporting or analytics, and no tracking or advertising.

Linking a phone to a shop's Ordryx records the phone's name, its kind and its network address at the scan in the shop's activity log. A phone that isn't used for 30 days is unlinked.

12. Feedback and support

Send feedback in Ordryx sends us its kind and your message, a reply email if you give one, the page you were on if you tick it, the shop's name, version and revision, whether it's hosted (and, if you write within two days of an update, which version it came to), and your username. If you tick it (it starts ticked when you write just after an update), it also sends a small diagnostics file: versions, settings without any secrets, health checks, recent errors, speed figures and the newest log lines. It never includes the shop's database, customers, orders, contractors, passwords or keys, and anything that looks like a secret is scrubbed out.

Conversations are kept by our account, in our dashboard, and in your shop's own Ordryx.

13. Who else handles it

We use these companies to run Ordryx. Each gets only what it needs for its job. Only two of them hold or can see a shop's data, or yours: DigitalOcean, which runs our server, and Fastmail, which sends our email. The others see only what the table says. The same companies are listed in Annex B of our terms.

Our backup server. Hosted shops' off-site copies, and the nightly backups of our account and our dashboard, are kept on a server in Colorado, USA, under Ordryx LLC's control, on encrypted storage. No other company runs it. Everything reaches it already encrypted: a shop's off-site copies with the shop's passphrase, our own backups with ours.

No AI assistant reads anything from a hosted shop or our servers. If one ever did, its company would be listed here first.

The shop's own choices

A shop's Ordryx also talks to companies the shop chooses, with the shop's own accounts: its shipping companies, its Shopify or WooCommerce store, Stripe for card payments at the till, its mail provider, its own storage for off-site copies, and its AI assistant. Those are the shop's providers, under the shop's agreements with them, so they aren't listed above. We don't choose them and don't get what they keep.

What we never do

We never sell personal information. We never share it for advertising. We don't build profiles of people or make automated decisions about them.

We give personal information to the police or a court only with a valid legal order. If it's a shop's records, we tell the shop first, unless the law forbids it.

If Ordryx LLC is ever sold or merged, the information moves only under these same promises, and we tell shops 30 days before.

14. How long copies last

Each part above says how long the original is kept. A shop's Ordryx also makes copies, and so do we. A copy keeps what was in the original the day it was made, and we don't edit copies to take one thing out. Something deleted is gone from every copy once the copies made before it have aged out.

No copy holds a shipping label's file or customs form, and the database in a backup holds customers' ship-to addresses only encrypted, without the key (backups made before Ordryx 0.0.206 and 0.0.209 hold them until they age out). Each backup is built afresh, so nothing cleared before it is left in its free space.

The folders a restore sets aside (before-restore-…) are kept until they're removed by hand. A removed hosted shop's go with its folder, 30 days after the removal (section 6).

15. Keeping it safe

• On the way. Everything that crosses the internet goes over HTTPS, except a shop's own email if its owner sets the mail connection's security to None. None works only for a mail server on the shop's own network; a server anywhere else is refused (since Ordryx 0.0.225). On a shop's own network, once the shop is linked to its Ordryx account and its owner's test of HTTPS passes, a browser opening Ordryx at the plain address is sent on to the HTTPS one (a device that can't reach it is told how to fix that, and may carry on over plain HTTP for 12 hours), and the owner can turn on Require HTTPS, which then refuses sign-ins over plain HTTP (since Ordryx 0.0.217). A shop that isn't linked uses plain HTTP on its own network.
• Where it's stored. Passwords are kept only as one-way hashes. Two-step keys, saved passwords and keys (for shipping companies, stores and mail), W-9s and tax IDs, and every order's ship-to (name, company, address and phone) are encrypted with a key kept beside the shop's Ordryx. The shop's own backups leave that key out. Off-site copies take it along, sealed with the shop's passphrase, unless the owner says not to (for Ordryx off-site, always).
• Backups. Off-site copies are always encrypted, with the shop's passphrase, before they leave. A shop's backups kept beside it are encrypted when its owner turns that on. For Ordryx off-site, the copies reach our backup server already sealed, and it can't open them; our hosting server keeps the passphrase so copies run by themselves. Connecting a Shopify store requires a shop's own backups to be encrypted: its Ordryx reads none of the store's orders until its backups are locked (Settings › Backups › On this server › Lock them), except to send back a tracking number (since Ordryx 0.0.225).
• Signing in. Two-step sign-in is required for everyone on a shop's staff; contractors in the contractor portal, who see only their own work, may choose it. The Ordryx account takes a password and a two-step code, or a passkey.
• Hosted shops apart. Each hosted shop runs on its own, with no extra rights, and can't reach another shop or our private network.
• Our staff. Who at Ordryx can reach a hosted shop's records, and how, is in section 6.

If something goes wrong

If information we hold for a shop is reached by someone who shouldn't have it, we'll tell that shop within 24 hours of knowing it's affected, and help it tell its customers as the law requires. If it's information about you that we hold for ourselves (your account, your answers), we'll tell you, as the law requires. For a Shopify store's information, we'll tell Shopify within 24 hours. Our security incident response policy and our data protection policy aren't published: we give them to shops, and to Shopify, on request.

16. Your choices and how to ask

About what we hold

• See it. Download my account data in your account gives you a copy. Email us for anything else we hold about you.
• Correct it. Change your details in your account, or ask us.
• Delete it. Delete your account yourself, or ask us to delete your answers to our questions or anything else.
• Stop our emails. We email only about your account and your shops, and testers who asked. To stop testing emails, reply to one and say so.

Email privacy@ordryx.com. We may ask you to sign in, or to write from the email we have, so we know it's you. We'll answer within 30 days. Asking never changes how we treat you.

Ordryx is offered only to businesses in the United States, for now. Colorado's Privacy Act and California's CCPA probably don't reach Ordryx LLC at its size; we answer requests as above all the same.

If you bought from a shop that uses Ordryx

Your details are that shop's records, so ask the shop. It can see them in its own Ordryx and give you a copy. It can correct where an order ships to; some details, such as the name and email on an order already shipped, it can't remove there yet. When a shop erases you in WordPress, or in Shopify with the Ordryx app, its Ordryx forgets you too. If the shop runs Ordryx itself, we can't see your details at all. If you write to us, we'll pass your request to the shop. For a shop we host, we act on it only on the shop's instructions, as its processor.

If you work for, or make things for, a shop

Staff and contractors: your details are the shop's records too. Ask the shop.

17. Children

Ordryx is for businesses. It isn't meant for children, and we don't knowingly collect anything about anyone under 13. If you think a child sent us something, email us and we'll delete it.

18. Where it's kept

In the United States. Our server is at DigitalOcean in New York. Hosted shops' off-site copies and our own backups are on a server in Colorado, USA, under Ordryx LLC's control, on encrypted storage. Fastmail, which sends our email, keeps it in the United States. If you're elsewhere, what you send us goes to the US.

Ordryx is offered only to businesses in the United States, for now. If it's ever offered abroad, this page will change first. A shop's own buyers may live anywhere, and their details are kept in the United States; the shop is responsible for its own notices to its buyers.

19. Changes to this page

We'll change this page when Ordryx changes, and update the date at the top. Before a change takes effect, we email the address on each Ordryx account 30 days ahead.

20. Contact us

• About your information (to see, correct or delete it, or any question about this policy): privacy@ordryx.com.
• A security problem: security@ordryx.com. It's also published at https://ordryx.com/.well-known/security.txt.
• Anything else: info@ordryx.com.
• Legal notices: by post to the address above.