What we collect, and why.

Ordence is business software for Indian traders, makers and other businesses: orders, stock and money in one system, working alongside Tally. It is offered business to business, by invitation.

Ordence is a business being incorporated in India, operated by its founders until incorporation. In this policy “Ordence”, “we” and “us” mean that business and, once it is incorporated, the incorporated entity, which takes over every commitment made here.

Pending incorporation: the registered name, registration number and registered office of the incorporated entity will be stated here once incorporation completes.

One address reaches us for everything in this policy: hi@ordence.com. There is no phone line.

India's Digital Personal Data Protection Act, 2023 (the “DPDP Act”) separates a Data Fiduciary, who decides why and how personal data is processed, from a Data Processor, who processes it on a fiduciary's behalf. Ordence is each of these, in two separate places.

This website asks you for personal data in a few places only, and each field is labelled on the form before you send anything.

Before a form is accepted, your own browser does a small calculation set by our server, which our server then checks. It makes sending forms in bulk slow for a script and costs a person a moment. It uses nothing you typed, sets no cookie, and nothing about it is sent to any other company. If it does not finish, the form asks you to try again, and you can always write to hi@ordence.com instead.

A submission our spam checks flag (a hidden field only a script would fill, or a form sent faster than a person can type) is not emailed to anyone. It is written only as a short line in our server log, without your name, email address, phone number or message, on the terms in section 7. If you wrote through a form and heard nothing, email hi@ordence.com directly.

We do not ask for, and ask you not to send through this website, sensitive details such as bank account numbers, PAN, Aadhaar, passwords, health information or anything about a child.

We use what you send for these purposes only:

Basis. When you send a form or an email you give us that information voluntarily, for the purpose stated next to the form. We rely on your consent, given by that clear action after reading the notice beside the button, and on section 7(a) of the DPDP Act, which allows processing for the specified purpose for which a person has voluntarily provided their data. Technical and security processing (section 3, last row, and the spam check on the forms) is done to keep the service safe, and anonymous counting (section 14) involves no personal data that we keep.

What we do not do. We do not sell your data, share it for anyone else's marketing, add you to a newsletter or mailing list, build an advertising profile, or make any automated decision about you. A person reads every enquiry and decides what happens next.

Withdrawing consent. You can withdraw consent at any time, as easily as you gave it: one line to hi@ordence.com. We then stop using your details and delete them, except anything a law requires us to keep. Withdrawal does not affect what was lawfully done before it.

Some of the work of running this website is done by other companies, acting for us under their own contractual terms. Section 11 of the DPDP Act lets you ask who your data has been shared with, so this is the whole list for this website.

Nobody else receives what you send. We tell you here before we add a new company to this list. Services a customer connects to its own Ordence system (WhatsApp Business, its email provider, an AI provider) are that customer's choice and are covered by its agreement, not by this table.

We may disclose personal data where Indian law requires it, for example to comply with a court order or a lawful request from a government agency, and only to the extent required.

What you send through this website passes through Cloudflare's network and our server with Railway in Singapore, and is kept as email and as rows in a private Google Sheet with Google, whose data centres may be outside India. Railway keeps the server's short-lived log lines. Nothing from this website is stored only in India today.

The DPDP Act permits transfer outside India except to countries the Central Government restricts by notification. We will not transfer personal data to a restricted country, and we will update this policy before changing where data is held.

We keep personal data only as long as the purpose needs it, and these periods are ours to keep to. Rows in our Sheet are deleted automatically once their period ends, emails in our mailbox on a set routine, and server log lines by our hosting provider.

You can ask us to delete your enquiry sooner, at any time (section 11). An enquiry that becomes a customer relationship is then governed by that agreement.

Each customer gets a dedicated Ordence system, with its own database, configured to its trade. It holds what that business puts into it: customers, orders, stock, invoices, books and documents. Some of it is personal data about the customer's own customers and staff. That business is the Data Fiduciary for it; we are its Data Processor.

We process that data only on the customer's documented instructions and only to provide the service. We do not sell it, mine it, use it to train AI models, or use one customer's data for another. Where the customer keeps its accounts in Tally, Tally and its data remain the customer's.

If you are an individual whose details sit in a customer's system, write to that business first, because it decides what is held. If you write to us, we will pass your request to that business the same day and tell you we have done so. The full commitments are in the data processing terms.

We use reasonable security practices and procedures, as required by section 8(5) of the DPDP Act and section 43A of the Information Technology Act, 2000 with the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. For this website that means: encrypted connections (HTTPS with HSTS) for every page and form; bot and abuse checks on every form; no IP address in the record of what you send; access to the mailbox, sheet and server limited to the people who reply to enquiries, with two-step sign-in; and no name, email address, phone number or message in any server log line. The security page describes the safeguards for customer systems.

No system is perfectly secure, and we do not claim otherwise. Section 10 says what happens if something goes wrong.

If personal data we are responsible for is exposed, we will tell the people affected without delay and in plain words: what happened, what data, what we have done, and what you can do. Customers hear from us within 48 hours of us confirming an incident affecting their system.

We will also report to the authorities where the law requires: to the Data Protection Board of India under section 8(6) of the DPDP Act and rule 7 of the DPDP Rules, 2025 (an intimation without delay and a detailed report within 72 hours, once rule 7 is in force), and to CERT-In where its directions under section 70B of the IT Act require.

For data in a customer's system, the customer is the fiduciary and gives those notices; we give it the facts quickly enough to do so.

Where we are the Data Fiduciary, you have these rights under the DPDP Act. Write to hi@ordence.com from the address you used with us (or tell us how to confirm it is you). You do not need a lawyer, a form or a reason, and there is no charge.

We reply in writing within one working day to confirm we have your request, and complete it within 15 days. If we cannot do something, we will say why.

The DPDP Act also asks something of you (section 15): give accurate details, do not impersonate anyone, and do not file a false or frivolous complaint.

Under the DPDP Act and rule 5(9) of the IT (Reasonable Security Practices) Rules, 2011, we have designated a Grievance Officer to handle complaints about how we process personal data. The Grievance Officer is one of the people who run Ordence, not a department or an outside agency.

If you are not satisfied with our answer, or do not get one in time, you can complain to the Data Protection Board of India once the DPDP Act's complaint provisions apply to your case. The Act asks you to use our grievance route first.

Ordence is business software sold to businesses. This website is not directed at anyone under eighteen, and we do not knowingly collect their personal data. If you believe a child has sent us details, write to us and we will delete them.

A customer that puts children's data into its own Ordence system carries the DPDP Act's duties for it as fiduciary, including verifiable parental consent, and should tell us before signing.

This website counts how its own pages are used, first-party, with no outside analytics product. When something worth counting happens (a page is viewed, a form is started or sent, a button is pressed, a search finds nothing, a calculator gives a first result, a checklist is printed, a demo workspace is opened), the page sends a short message to /api/e on this same domain.

The server accepts only a fixed list of event names and drops everything else. Each line written to the server log holds: the time, cut to the minute; the event name; the page path without its query string; a few details in a fixed shape (counts, same-site paths, fixed choices, short labels we wrote, a referring website's hostname, campaign tags from our own links); and, on a page being compared with another version of itself, a letter saying which version. A search that found nothing is logged cut to 80 characters, and dropped entirely if it contains an @, so an email address typed into search is never kept.

It does not hold: an IP address, a browser string, a full referring address, a cookie, a session or visitor identifier, a country, or a time more precise than the minute. To refuse floods, the server turns your IP address into a short keyed code held in memory for one minute and then discarded; the key is never written down and changes when the server restarts.

We consider these lines not to be personal data, because nothing in them identifies or can reasonably be linked to you. They are not stored in a file: they are short-lived lines in our server log, kept by our hosting provider for a limited period (section 7). If you disagree with that assessment, write to us.

Our cookie. This website sets one cookie of its own, ordence_notice, which remembers for a year that you have dismissed the notice at the bottom of the screen. It is strictly necessary for that notice to stay dismissed and is not used for anything else.

Cloudflare's security cookies. Cloudflare, which protects the site, may set its own security cookies (such as __cf_bm or cf_clearance) to tell people from bots. They are strictly necessary for security and are not used for advertising or analytics.

There are no advertising cookies, no third-party analytics, no tracking pixels and nothing that follows you to another website.

Browser storage. The site also keeps a few small items in your browser's own storage. They stay on your device unless this list says otherwise, and none of them identifies you.

Session storage is cleared when you close the tab. You can clear all of it, and block cookies, in your browser's settings; the site still works, though the notice will reappear and forms will be checked again.

This policy is written to the DPDP Act, 2023 and the DPDP Rules, 2025 (published 13 November 2025, G.S.R. 846(E)), and to the Information Technology Act, 2000 and its 2011 rules on reasonable security practices. The Rules come into force in stages: the Data Protection Board provisions at once, consent managers a year later, and the core duties on notice, security, breach reporting, retention and rights eighteen months after publication, in May 2027. Until then, section 43A of the IT Act and the 2011 rules apply. We follow this policy now, ahead of those dates.

We will update this policy when what we collect, who handles it or the law changes, and change the date at the top. If a change affects how we use data you have already given us, we will tell you by email before it takes effect, and where the law requires fresh consent we will ask for it.

Questions, requests about your own data, or a grievance: hi@ordence.com. All contact is by email; there is no phone or WhatsApp line. You get a written reply within one working day.

Related documents: terms of use for this website, service terms for customers, and data processing terms.