Ordainer Privacy Policy

Version: Beta preview 2026-10-09. Last updated: October 9, 2026.

1. About this policy

1.1 This policy explains how Ordainer ("we", "us"), a business based in Ottawa, Ontario, Canada, handles personal information when we decide why and how it is used (in privacy law terms, when we are the "controller" or the organisation accountable for it). That covers:

• (a) people who visit our website or try the public demo;
• (b) people who sign up for and use an account (account owners);
• (c) billing contacts; and
• (d) people who email us (for example for support).

1.2 What this policy does not cover. Our customers are businesses that sell APIs or tools (we call them "vendors"). Vendors use our service to check their own customers' AI agents against plan limits. When a vendor sends us data about its customers (for example customer names or IDs, agent key details, and the audit records of allow or deny decisions), we process that data on the vendor's behalf and under its instructions. Our Data Processing Addendum with the vendor covers that data, not this policy. If you are a vendor's customer and have a question about that data, please contact the vendor. If you contact us, we will pass your request to the vendor where we can.

1.3 Our service is for businesses. Most of the personal information we hold is business contact information, such as a work email address.

1.4 Beta. During the beta, the service runs on our beta environment, hosted by Render and Neon in the United States (Ohio region). Our database has 7-day point-in-time recovery, and there is no off-site backup copy yet (section 8, Backups). No payments are taken during the beta.

2. Who is responsible

2.1 Ordainer is a business based in Ottawa, Ontario, Canada. Until our company is incorporated, Ordainer is run as an unincorporated business. You can ask us at any time for the full legal name and address of the person operating Ordainer: email support@ordainer.ai.

2.2 Accountability. Our Privacy Officer is accountable for our privacy practices, including our compliance with this policy and with privacy law, and, under Quebec law, is our person in charge of the protection of personal information. Contact our Privacy Officer at support@ordainer.ai with "Privacy" in the subject. You can ask us for the Privacy Officer's name.

3. What we collect

3.1 When you visit our website or use the public demo

• (a) Hashed IP address. The public "produce a deny" demo limits how often each visitor can click and gives each visitor their own demo counter. To do that, we turn your IP address into a one-way, salted hash and store only that hash, never your raw IP address. Demo clicks are recorded with that hash. A salted hash is still personal information (it is pseudonymous: someone holding our database and the salt could work out the address), so we protect it and delete it on the schedule in section 8.
• (b) Hosting logs. Our hosting provider (Render) keeps our application's logs for 7 days. Our application code does not store or log raw IP addresses: it keeps only the salted hashes described in (a), 3.2(c) and 3.2(f). Our platform providers do log IP addresses: Render, and Cloudflare, which runs Render's network edge, record the client IP address of requests in their own platform logs, which they keep under their own policies. This includes the small request each page of our website and docs sends to count visits (see (c)), which reaches our API host; our code does not store or log the IP address for it. Our website and docs are also hosted on Render, so the same applies to every request to them. We don't control how long Render and Cloudflare keep these platform logs.
• (c) We do not use analytics, advertising or tracking cookies, pixels or similar tools. We count website visits and clicks on our sign-up buttons as daily totals only (per page, button and campaign label), on our own servers, with no cookies, no IP address and nothing that identifies you.

3.2 When you sign up and use an account

• (a) Email address. Used to sign you in (we email you a one-time link from login@ordainer.ai), to identify your account, and to send you service emails.
• (b) Organisation name. We create it from the domain of your email address when you first sign up.
• (c) Sign-in records. For each sign-in link: your email address, a one-way hash of the link's secret token (never the token itself), a salted hash of your IP address (used to limit sign-in requests), the time it was created, used and expires, and, if the link you followed had one, a tag showing where you found us (for example a campaign or partner name).
• (d) Session records. When you sign in we store a one-way hash of your session token (never the token itself), an anti-forgery token, and the session's expiry.
• (e) Account activity. Your account settings and usage, such as how many test decisions you have made this month, when your account made its first decision and first deny, when you reset your sandbox, and alerts we sent you.
• (f) Acceptance records. When you accept our Terms of Service and Data Processing Addendum and confirm you have read this policy, we record the versions you accepted, the date and time, your email address, a salted hash of your IP address, and the request ID.
• (g) Change log. When you edit a plan or move a key between plans in the console, we record who made the change (your email address), when, and the values before and after.
• (h) Operational logs and SDK health reports (service and diagnostic data about your integration).
  • Operational logs. When your product sends us a decision request that we reject or that fails with an error, we add it to a daily count per organisation, day, error code and client (our SDK's name and version, or "other"). We keep these counts for 400 days. For every decision request that reaches us, our application also writes one log line with the request ID, our internal ID for your account, the status, the decision (if any), the error code (if any), timings (for example how long the request and its database work took) and queue and limit flags (for example whether the request waited in line). These logs never contain your API key, an IP address or the content of the request (section 8).
  • SDK health reports. Planned, not yet in use. This applies only if and when we build it. Our Node.js SDK would then count, for each day, the calls it could not check with us (timeouts, network errors, server errors and replies it could not read), split by whether it let the call run or blocked it, and record the slowest call time. It would send these counts with your next decision request, and we would store them as daily totals for your organisation. They would contain no tool arguments, no identifiers of your own customers or end users, no IP addresses and no other request content. Along with them we would record only the SDK's name and version (for example, which release of our SDK you run). You would be able to switch them off in the SDK settings (the clientStats option).

3.3 Billing

• (a) Payments are handled by Stripe. You enter your card details on Stripe's pages, and we never see or store your full card number. During the beta, no payments are taken: Stripe is used only for paid plans and the test checkout.
• (b) We send Stripe your email address and organisation name to create your billing record.
• (c) We store the Stripe customer and subscription IDs, your subscription status, your billing interval, and key dates (for example when a payment failed, when Stripe's payment retries end, when your live keys are cut off (the cutoff, on day 14 after the first failed payment), when the comeback period for paying a missed invoice ends, or when a subscription ends).

3.4 When you contact us, and emails we send

• (a) If you email us (for example at support@ordainer.ai), we keep your email address, your message and our reply. Please include the request ID of any decision you are asking about, and do not send us personal information about your own customers unless you need to.
• (b) We keep a copy of the service emails we send you (recipient, subject and text), for example billing warnings and usage alerts, so we can send them reliably and only once.
• (c) We use AI tools to help draft and send replies to support emails. Some routine replies may be sent without a person reviewing them first. A member of our team reviews every reply about a wrong deny, security, privacy or billing before it's sent, and you can always ask for a person by replying "human". To do this, the AI tools process the content of your email and our reply.

3.5 Error logs. When something goes wrong, our application records the request ID, the type of request and the page or API path in its error log. Our application code does not write callers' IP addresses to these or any other logs (our platform providers log them separately, section 3.1(b)), and Render keeps these logs for 7 days. The operational log lines in section 3.2(h) are kept the same way.

3.6 We do not knowingly collect sensitive personal information (such as health information or government ID numbers) and ask you not to send it to us.

4. Why we use it, and our legal bases

The "legal basis" column is needed under the EU and UK General Data Protection Regulation (GDPR). In Canada, we rely on your consent, which may be implied where the purpose is obvious (for example using your email to sign you in), and on the exceptions that privacy law allows.

We do not send marketing emails today.

Where we rely on legitimate interests, you can object (section 9).

We do not make decisions about you, as an account holder, based solely on automated processing that have legal or similarly significant effects. (The allow/deny decisions our service makes are about vendors' customers' AI agents, on the vendor's instructions, and are covered by the vendor's Data Processing Addendum.)

5. Cookies

We use only two cookies. Both are strictly necessary for the service to work, so we do not ask for consent and do not show a cookie banner.

Both are set only on our own domain, can only be sent over secure connections, and cannot be read by scripts on the page. If we ever add analytics or advertising cookies, we will update this policy and ask for consent where required first.

6. Who we share it with

6.1 We do not sell your personal information, and we do not share it for cross-context behavioural advertising (targeted advertising based on your activity across other businesses' websites or services). We have not done so in the past 12 months.

6.2 Service providers. We use these providers to run the service. They process personal information on our behalf, under contracts, and only for the services they provide to us.

Render uses Cloudflare (United States) for its network edge; see Render's sub-processor list at https://render.com/security. Render and Cloudflare record client IP addresses in their own platform request logs.

Planned, not yet in use: We plan to add a daily encrypted off-site backup with Backblaze in Canada; it isn't in use yet, and we'll update this page before it starts.

If we use a separate host for our website or docs, we will add it here before it goes live.

We keep an up-to-date list at https://ordainer.ai/legal/subprocessors.

6.3 Stripe's own role. Stripe also processes payment information for its own purposes (for example fraud prevention and meeting financial regulations) under its own privacy policy.

6.4 Legal reasons. We may disclose personal information if the law requires it, to respond to valid legal requests, or to protect the rights, property or safety of us, our customers or others.

6.5 Business changes. If we incorporate, reorganise, change our name, merge, are acquired, or sell all or part of our business, personal information may be transferred to the new or successor organisation, which will remain bound by this policy for that information. Where the law requires, we will use it only for the purposes in this policy and tell you.

7. Transfers outside your province or country

7.1 Where your information is stored. We are based in Canada. Most of your personal information is stored and processed in the United States: during the beta, our beta environment, application and logs are hosted by Render and our database by Neon, both in the United States (Ohio region), and our emails are sent through Resend. Our support and team mailboxes are hosted by Microsoft (Microsoft 365); the Microsoft 365 data region for our account hasn't been verified in our admin tools yet (our email was bought through GoDaddy), so that mailbox data may be in the United States or Canada, and we'll update this page when we confirm which. The AI assistant that helps draft and send support replies is run by Cursor (Anysphere, Inc.) in the United States. While it is there, it is subject to US law and may be accessible to US courts, law enforcement and national security authorities under that law. We do not yet keep an off-site backup copy (section 8, Backups). Stripe processes payment information under its own terms (sections 6.2 and 6.3).

7.2 Quebec. If you are in Quebec, your personal information is communicated outside Quebec, to the providers in section 6.2 (in the United States and, for Microsoft 365 mailbox data until we confirm otherwise, possibly Canada). Before that happens, we carry out a privacy impact assessment. It takes into account the information's sensitivity, the purposes, the safeguards (including contract terms), and the laws of the place it goes to. We put a written agreement in place with each provider that reflects that assessment (Quebec's Act respecting the protection of personal information in the private sector, ss. 8 and 17).

7.3 EU and UK. Canada has an EU adequacy decision for organisations covered by Canada's federal private-sector privacy law (PIPEDA), and UK law recognises it in the same way. For onward transfers to the United States, we rely on the safeguards in our providers' data processing terms, such as the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, or the provider's certification under the EU-US Data Privacy Framework and its UK extension, as applicable. You can ask us for a copy of the relevant safeguards (section 9).

8. How long we keep it

We keep personal information only as long as we need it for the purposes in this policy, or as the law requires.

Backups. Our database host (Neon) keeps 7-day point-in-time recovery history so we can recover the service after a failure or mistake. Information we delete can stay restorable from that history for up to 7 days after deletion, and is then gone from that history. There is no off-site backup copy yet. We plan to add a daily encrypted off-site backup with Backblaze in Canada; it isn't in use yet, and we'll update this page before it starts. The copy of billing records we keep in Canada for tax purposes (see "Invoices and payment records" above) is a separate accounting record, not a database backup.

Holds. If you have asked for access to your personal information, we keep it for as long as you need to use any remedies under Canadian privacy law, even if a deletion date passes. We may also keep information longer where the law requires it, or to deal with a legal claim, and then only for that purpose. To do this we put the account on hold: automatic deletion and clean-up for that account pause until the hold ends. If you delete your own account, that deletion still goes ahead.

When we delete. When information is no longer needed, we delete it. Where we keep statistics, we use only information that has been anonymized so that no one can be identified.

If we use personal information to make a decision about you, we keep it long enough for you to be able to ask for access to it, as Canadian law requires.

9. Your rights

9.1 Everyone. You can ask us to:

• (a) tell you whether we hold personal information about you, give you access to it, and tell you how we have used and shared it;
• (b) correct it if it is wrong or incomplete;
• (c) delete it, where we no longer need it or the law requires (account owners can also delete their whole account in the console when they have no active subscription and no subscription with an unpaid balance that is still inside the payment window in section 10.1 of our Terms of Service, whether Stripe shows it as past due or unpaid); and
• (d) withdraw your consent, where we rely on consent (this may mean we can no longer provide the service).

9.2 Quebec residents also have the right to ask for your computerized personal information in a structured, commonly used technological format, and to ask us to stop disseminating it or to de-index any hyperlink attached to your name where the law allows.

9.3 EU and UK residents also have the right to: restrict our use of your information; object to our use of it based on legitimate interests; receive it in a portable format; and complain to a data protection authority (section 10).

9.4 United States residents. Depending on where you live, and to the extent these laws apply to us, US state privacy laws (for example California's Consumer Privacy Act) may give you the right to: know what personal information we collect, use and disclose; access it; correct it; delete it; and opt out of its sale, its sharing for cross-context behavioural advertising, and profiling. We do not sell or share personal information (section 6.1), and we do not use or disclose sensitive personal information for purposes that would give you the right to limit it. We will not discriminate against you for using your rights. You may use an authorised agent; we may ask for proof of their authority. If we refuse your request, you may appeal by replying to our decision, and if your appeal is refused you can contact your state attorney general. Some of these state laws exempt information collected in a business-to-business context.

9.5 How to ask. Email support@ordainer.ai with "Privacy" in the subject, from the email address on your account if you have one. We may need to confirm your identity before acting, for example by sending a one-time link to that address. We will respond within the time the law requires (generally 30 days in Canada, one month in the EU and UK, and 45 days in California), and tell you if we need more time. The time to respond (for example, 30 days under Canadian and Quebec law) starts when your request reaches us at any of our email addresses (support@ordainer.ai or sales@ordainer.ai), even if it doesn't have "Privacy" in the subject. We pass every such request to our Privacy Officer, who is accountable for our privacy practices (PIPEDA s. 8(3); Quebec's Act respecting the protection of personal information in the private sector, s. 32). Requests are free unless they are clearly unfounded or excessive.

9.6 If you are a vendor's customer asking about data a vendor sent us, see section 1.2.

10. Complaints

Please contact us first (section 2.2); we would like the chance to fix things. You can also complain to a regulator:

• Canada: the Office of the Privacy Commissioner of Canada (priv.gc.ca).
• Quebec: the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).
• Alberta and British Columbia: the provincial Information and Privacy Commissioner, where their private-sector privacy laws apply.
• EU: the data protection authority in the country where you live or work, or where you think the problem happened.
• UK: the Information Commissioner's Office (ico.org.uk).
• California: the California Privacy Protection Agency or the California Attorney General.

11. Security

11.1 We protect personal information with safeguards suited to its sensitivity, including:

• (a) storing sign-in link tokens and session tokens only as one-way hashes, and making sign-in links single-use and valid for 60 minutes;
• (b) storing IP addresses only as salted one-way hashes (for sign-in links, acceptance records and the public demo), never the raw address;
• (c) using encrypted connections (HTTPS/TLS) for the website, console and API, and to our database;
• (d) cookies that are sent only over secure connections and cannot be read by page scripts, and anti-forgery protection on every console form;
• (e) limits on sign-in requests (per email address and per IP address), and on API requests made with an invalid key (per IP address, or per /64 prefix for IPv6; for this the address is held only in our application's memory, usually for about a minute after the last failed attempt and never more than 24 hours, and it is also cleared by a memory sweep or restart; our application code never writes it to its database or logs);
• (f) keeping each account's data separate, so every console page only shows the signed-in account's data; and
• (g) limiting access to production systems to the people who need it to run the service.

11.2 No system is perfectly secure, and we cannot guarantee the security of information sent to us over the internet. We do not hold any security certification today.

12. Data breaches

If a breach of security safeguards involving personal information under our control happens, we will:

• (a) Canada: report it to the Privacy Commissioner of Canada and notify affected people as soon as feasible where it creates a real risk of significant harm, and notify other organisations that could reduce the harm;
• (b) Quebec: promptly notify the Commission d'accès à l'information and affected people where a confidentiality incident presents a risk of serious injury, and take reasonable steps to reduce the risk;
• (c) EU and UK: where required, notify the relevant authority within 72 hours of becoming aware of it, and notify affected people without undue delay where there is a high risk to them;
• (d) United States: notify affected people and authorities as required by applicable state breach notification laws; and
• (e) keep a record of every breach and confidentiality incident, as Canadian and Quebec law require.

13. Children

Our service is for businesses and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact support@ordainer.ai with "Privacy" in the subject and we will delete it.

14. Changes to this policy

We may update this policy. We will post the new version here with a new "Last updated" date. If we publish a new version, we will email account owners before it applies to them. For a material change, we will tell account owners by email at least 30 days before it takes effect, and ask for consent where the law requires. Changes needed for legal reasons may take effect sooner.

15. Contact us

Our Privacy Officer is accountable for our privacy practices and, under Quebec law, is our person in charge of the protection of personal information. Contact our Privacy Officer at support@ordainer.ai with "Privacy" in the subject. You can ask us for the Privacy Officer's name. Ordainer, a business based in Ottawa, Ontario, Canada (unincorporated until our company is incorporated). You can ask us for the full legal name and address of the person operating Ordainer. Support: support@ordainer.ai