Privacy Policy

Who is responsible for what

Your employer (the organization that holds the Ordinex account) decides what is recorded about its crews and controls that data. Ordinex is the service provider that stores and processes it on the organization's behalf. If you are a worker or foreman and want to see, correct or delete records about you, ask your employer first; we will help them answer you. You can also write to us directly at the address below.

What we collect

• Account data: name, email, role and organization, given at signup or through an invitation.
• Field records your organization enters: safety forms, inspections, incident reports, deliveries, schedules, documents, photos and signatures.
• Extra Work Order approvals: when a general contractor approves or declines an Extra Work Order by link, their name, signature, e-mail address, IP address and the time are stored with that record.
• Work and pay records: hours, timesheets, production quantities, time off and sick days, pay rates, job costs and certifications.
• Location: when your organization turns on GPS for the time clock, the phone's location is recorded at check-in and check-out. Admins and the foremen on that job can see it.
• Technical data: device, browser and IP address, needed to run the service securely, and push-notification addresses if you allow notifications.

Some of these records are sensitive, such as incident reports, sick days and pay rates. Inside an organization they are limited by role: pay rates and payroll are visible to admins only, and sick days to admins and in-house foremen.

How your data is isolated

Ordinex is multi-tenant: every organization's data lives in a shared database, walled off by row-level security policies enforced at the database layer, not just in application code. One organization's records are never queryable by another organization's users.

How we use it

To operate the platform (render forms, generate PDFs, send the e-mails and notifications your organization has set up), to bill your subscription, to keep the service secure, and to improve the product. We do not sell your data, and we do not use your field records to train any model or share them with anyone for their marketing.

Third-party processors

These companies process data for us, each under its own data-processing terms and only to provide its service:

• Supabase — database, sign-in and file storage, hosted in Canada (AWS ca-central-1).
• Stripe — subscription billing and payment.
• Resend (on Amazon SES, United States) — sends the app's e-mails, including safety-form PDFs your organization sends to its safety contacts.
• Cloudflare — hosts the website and app, and stores the nightly off-site backup copy of files.
• GitHub — runs the automated jobs that make that backup.
• Google — Google Workspace for our support e-mail, and Google Ads on our marketing pages and the signup page (see Cookies).
• Microsoft Clarity — records how visitors use our marketing site (ordinex.ca), to help us improve it (see Cookies). It does not run inside the app.
• Meta — the Meta Pixel on our marketing pages and the signup page measures our Facebook and Instagram ads (see Cookies).
• Browser push services (Apple, Google, Mozilla) — deliver notifications to devices that allowed them.

Where your data is processed

The main database and files are stored in Canada. Some processors above operate outside Canada, mainly in the United States (e-mail delivery, backups and the services listed), so some data may be processed or stored there and may be accessible to authorities under those countries' laws.

How long we keep it

Records are kept while your organization's account is active, so the organization can meet its own record-keeping obligations. When an organization closes its account or asks us to delete data, we delete it from the live service and confirm in writing. Backup copies are removed by hand within 30 days of the request.

Your rights

Organization admins can export the full organization — every table, every file — at any time from the Settings tab, no request required. Anyone can ask to access, correct or delete personal information, or withdraw consent, by writing to us below. We answer within 30 days.

Security and breaches

Data is encrypted in transit and at rest, access is limited by role, and we review our security regularly. If a breach creates a real risk of significant harm, we notify the affected organizations, and the Privacy Commissioner where the law requires it, without undue delay.

Cookies

The app uses only what it needs to keep you signed in and to work offline. Our marketing site (ordinex.ca) and the signup page load Google Ads and the Meta Pixel, which set advertising cookies to measure our ads, including that a company was created after an ad click (never what you typed). The marketing site also loads Microsoft Clarity, which records clicks, scrolling and page movement as anonymous sessions and heatmaps; what you type into forms is masked and never recorded. Both sites also keep one small cookie of our own for 90 days that remembers how you first found us (for example, the post or website that sent you), so we know which channels bring in new companies. Cloudflare counts page visits without cookies. You can turn off personalized ads at adssettings.google.com and in your Facebook or Instagram ad preferences, or block third-party cookies in your browser; the app keeps working either way.

Changes to this policy

If this policy changes materially, we'll notify organization admins by email before the change takes effect.

Contact

Questions or requests about this policy: [email protected].