Privacy Policy
Last updated: 6 July 2026
1. Who we are
Ordo is an invoicing and back-office service for EU freelancers and small businesses, operated by KriPa Web, obrt za računalno programiranje, vl. Kristijan Pavlic Tumpa, Vankina ulica 8, 10000 Zagreb, Croatia, OIB 27744574396, MBO 99336766(the “controller” for the personal data described in this policy). You can reach us at privacy@ordo-eu.com.
2. Data we collect
- Account data: email address, password (hashed), company name, address, country, VAT number, IBAN, logo, and locale.
- Billing data: subscription plan and Stripe customer/subscription identifiers. Card details are processed by Stripe and never touch our servers.
- Business records you create: clients (names, addresses, emails, VAT numbers), invoices, quotes, credit notes, payments, expenses, and uploaded receipts.
- VAT validation records: results of VIES VAT-number checks, stored with a timestamp as a legally useful audit trail.
- Usage data: product analytics events and error reports (via PostHog), used to keep the service working and improve it.
3. Why we process it (legal bases)
- Contract (Art. 6(1)(b) GDPR): providing the service - creating and sending invoices, calculating VAT, processing payments, managing your subscription.
- Legal obligation (Art. 6(1)(c)): tax and accounting record-keeping obligations that apply to invoicing data.
- Legitimate interest (Art. 6(1)(f)): service security, abuse prevention (rate limiting), error monitoring, and product analytics.
4. Your clients’ data
The client records, invoices, and receipts you create in Ordo are your business data: you are the controller of your clients’ personal data and Ordo processes it on your behalf to provide the service. When you use the AI reminder feature, the relevant invoice details (client name, invoice number, amount, due date, and the service description) are sent to Anthropic’s Claude API to draft the email; they are not used to train AI models. When you send an invoice, the recipient’s email address and the invoice PDF are transmitted via Resend.
5. Processors and sub-processors
We share data only with the service providers needed to run Ordo, under data processing agreements:
| Provider | Purpose | Location / transfer basis |
|---|---|---|
| Supabase | Database, authentication, and file storage (invoices, receipts, logos) | EU region |
| Vercel | Application hosting and content delivery | EU/US (Data Privacy Framework) |
| Stripe | Subscription billing and invoice payment processing (Stripe Connect) | EU/US (Data Privacy Framework) |
| Resend | Transactional email delivery (invoices, reminders, invitations) | EU/US (Data Privacy Framework) |
| Anthropic | AI-generated payment reminder drafts (invoice number, client name, amount, due date, service description) | US (Data Privacy Framework) |
| PostHog | Product analytics and error monitoring | EU region |
| Storecove | Cross-border e-invoice delivery (Peppol), where enabled | EU |
| FINA (Financijska agencija) | Croatian eRačun exchange, fiscalization and statutory reporting (certified information intermediary), for Croatian users who enable it | Croatia (EU) |
Where providers process data outside the EEA, transfers rely on the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses.
6. Retention
Account and business data are kept for as long as your account exists. Invoicing records may need to be retained by you for statutory periods under national tax law (typically 6-11 years); exporting them before deleting your account is your responsibility. When you delete your account, your profile, clients, invoices, and related records are permanently deleted.
7. Your rights
Under the GDPR you can request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest. You can delete your account (and all data) yourself in Settings, or contact us at privacy@ordo-eu.com. You also have the right to lodge a complaint with your supervisory authority - in Croatia, the Personal Data Protection Agency (AZOP).
8. Cookies
Ordo uses strictly necessary cookies for authentication (Supabase session cookies), which are always active. Optional PostHog analytics cookies load only after you accept them in the cookie banner; if you decline, no analytics cookies are set. We do not use advertising cookies.
9. Changes
We will post any changes to this policy on this page and update the date above. Material changes will be announced in the app or by email.