1. Who we are
Ordavium (“we”, “us”) provides a document workspace at ordavium.pro. This policy explains how we handle personal data when you visit our website, use the service, sign a document sent through it, or contact us.
For account and website data, we are the data controller (a “data fiduciary” under India’s Digital Personal Data Protection Act, 2023). For the content a customer puts in its workspace, the customer is the controller and we process that content on its behalf and on its instructions.
2. What we collect
Information you give us
- Account details: your name, email address and password (stored only as an Argon2 hash).
- Workspace content: files you upload, drafts, templates, comments, questions and the answers to them.
- Messages you send us through the contact form or by email.
- Billing details when you subscribe, handled by our payment provider.
Information about signers
When someone is asked to sign through Ordavium, we process their name, email address, the signature they draw or type, any details they fill in, and when, from which IP address and on which device they viewed and signed. This forms the document’s evidence record.
Information collected automatically
- IP address and browser details, used for security, rate limiting and showing you your active sessions.
- Records of actions in a workspace, for the activity feed and audit trail.
- The essential cookies described in our cookie policy.
We do not use advertising cookies or third-party analytics trackers, and we do not buy personal data.
3. How we use it
- To provide the service: storing, indexing, searching and summarising documents, answering questions and writing drafts.
- To run e-signature requests and keep their evidence records.
- To keep accounts and workspaces secure, and to prevent abuse and fraud.
- To send emails the service needs, such as verification, invitations and signature requests, and alerts you can switch off in account settings.
- To answer your questions and provide support.
- To meet legal, tax and accounting obligations.
4. AI processing
To summarise, answer and draft, we send the relevant passages and your instructions to an AI model provider, which returns the result. We use providers only on terms that stop them using that content to train their models or keeping it beyond what is needed to provide the result.
We never use your workspace content to train AI models. If a workspace connects its own model API key or endpoint, that processing is also governed by the workspace’s own agreement with that provider.
AI output can be wrong. Drafts cite their sources so that people can check them, and we recommend that a qualified person reviews anything before it is relied on.
5. Legal bases
Where the GDPR or UK GDPR applies, we rely on:
- Contract: to provide the service you or your organisation signed up for.
- Legitimate interests: to secure the service, prevent abuse and improve it, balanced against your rights.
- Legal obligation: to keep financial and evidential records.
- Consent: where we ask for it, which you can withdraw at any time.
Under India’s DPDP Act, we process personal data for the purposes you consent to when you create an account or submit a form, and for the legitimate uses the Act allows.
7. International transfers
Some providers process data outside your country. Where data leaves the EEA, the UK or India, we rely on adequacy decisions, standard contractual clauses or other safeguards the law recognises, and we do not transfer data to countries the Indian government has restricted.
8. How long we keep it
| Data | Kept for |
|---|---|
| Account details | While your account exists, then deleted within 30 days of closure |
| Documents, drafts and comments | Until deleted by the workspace, or 30 days after the workspace closes |
| Private questions and search history | 90 days |
| Notifications | 90 days |
| Workspace activity feed | 1 year |
| Audit trail and signature records | Up to 7 years, for legal and evidential purposes |
| Contact form messages | Up to 2 years after the conversation ends |
| Security logs | Up to 90 days |
9. Security
We protect data with encryption in transit, role-based access checked on every request, short-lived sessions, encrypted storage of members’ API keys and a tamper-evident audit trail. No system is perfectly secure; if we become aware of a breach affecting your data, we will tell you and the relevant authorities as the law requires. See our security page for details.
10. Your rights
Depending on where you live, you can ask us to:
- give you a copy of your personal data, or send it to another provider;
- correct or complete it;
- delete it, unless we must keep it by law;
- restrict or object to how we use it;
- withdraw consent you have given;
- nominate someone to exercise your rights if you die or become unable to (India).
Write to support@ordavium.pro. We will reply within one month, or sooner where the law requires. If your data is in a customer’s workspace, we will pass your request to that customer and help them answer it. You can also complain to your data protection authority, such as the Data Protection Board of India, the UK ICO or your EU supervisory authority.
11. Children
Ordavium is a business service for people aged 18 and over. We do not knowingly collect data from children; if you believe a child has given us data, contact us and we will delete it.
12. Changes to this policy
We will post any changes here and update the date above. If a change is significant, we will tell account holders by email before it takes effect.
13. Contact and grievances
For any question or complaint about privacy, including grievances under India’s DPDP Act, write to support@ordavium.pro with “Privacy” in the subject, or use our contact form. We aim to resolve grievances within 30 days.