Privacy Policy

1. Who we are

Ordvaro is a business software service that helps organizations process customer purchase orders, extract structured order information, validate that information against their ERP system, manage exceptions, and create ERP sales orders after human approval or explicitly configured automation rules.

Ordvaro is operated by KODPRENEUR DOOEL, Kiril Pejchinovikj 50, 2000 Shtip, Republic of North Macedonia ("Ordvaro", "we", "us", or "our").

For privacy questions or requests, contact us at [email protected].

2. Scope of this Privacy Policy

This Privacy Policy explains how we collect, use, store and share personal data when you visit ordvaro.com, create or use an Ordvaro account, belong to an Organization using Ordvaro, submit purchase orders or other documents, connect an ERP system, request a demo, or otherwise communicate with us.

Ordvaro is intended primarily for business and professional use.

For account, website, sales and administrative information, KODPRENEUR DOOEL generally determines the purposes of processing and acts as the data controller.

For purchase orders, ERP records and other business data submitted by a customer Organization for processing through Ordvaro, the customer Organization generally determines why that information is processed. In those circumstances, the customer generally acts as controller and KODPRENEUR DOOEL processes the information on the customer's behalf as a processor or service provider.

Where required, additional data-processing terms may apply between KODPRENEUR DOOEL and the customer.

3. Personal data we process

We may process account and Organization information such as your name, work email address, Organization membership, user role and account settings.

We process purchase orders and related documents submitted by email or upload, including PDFs, images, spreadsheets, CSV files and text. These documents may contain customer names, business addresses, contact details, product information, quantities, prices, purchase-order numbers, delivery information and other order-related data.

When an Organization connects an ERP system, Ordvaro may access customer, item, pricing, company and sales-order information required to validate and process orders.

We maintain operational and audit information, including actions relating to document processing, order validation, exception resolution, approvals, automation, ERP order creation and configuration changes.

We may process technical information such as IP addresses, browser or device information, timestamps, application logs and security information where necessary to operate and protect the Service.

Subscription transactions are processed by our Merchant of Record. Ordvaro may receive information about your plan, subscription status and transaction identifiers, but Ordvaro does not store complete payment-card details.

If you contact us for sales, support or another reason, we may retain the information contained in that communication.

4. How we use information

We use information to provide and operate Ordvaro, authenticate users, manage Organizations, receive and process purchase orders, extract structured information from documents, validate orders against ERP data, identify exceptions, apply customer-configured automation rules, create ERP sales orders, provide support, manage subscriptions, maintain audit records, prevent fraud and abuse, protect the Service, investigate technical issues and comply with legal obligations.

Where applicable data-protection law requires a legal basis, our processing may be based on performance of a contract, compliance with legal obligations, legitimate interests in operating and securing a business software service, or consent where consent is specifically required.

Where we process data on behalf of a customer Organization, we process that information according to the customer's documented instructions and the applicable agreement.

5. AI-assisted document extraction

Ordvaro uses artificial intelligence to convert unstructured purchase-order documents into structured order information.

AI extraction may produce incomplete or inaccurate results. Ordvaro is therefore designed so that AI extraction is not treated as the final authority for business correctness.

Extracted information is processed through deterministic validation rules and compared with the Organization's ERP information. Orders requiring judgment may be routed to a person for review. Automatic processing occurs only where the Organization has configured the applicable automation rules and eligibility requirements.

Ordvaro does not use one customer's purchase-order data to train models for another customer.

Ordvaro currently uses OpenAI API services for document extraction.

6. Service providers and subprocessors

We use third parties where necessary to provide Ordvaro.

• OpenAI provides AI/API services used for document extraction.
• Amazon Web Services provides services including SES, S3 and SNS that are used for inbound purchase-order email processing and related storage and messaging.
• Microsoft provides Microsoft Dynamics 365 Business Central where a customer chooses Business Central as its ERP. Access occurs through the ERP connection configured specifically for that Organization.
• AgentaOS acts as Merchant of Record for subscription transactions and processes payment, taxation, invoicing and related billing information.

Our production application may also rely on hosting, database, email, monitoring, backup and security providers required to operate the Service. We will keep our disclosures consistent with the providers actually used in production.

We do not sell personal data and do not share customer information for third-party advertising.

7. International data transfers

Some service providers may process information outside the country where you or your Organization are located. Where applicable law requires safeguards for international transfers, we or our providers use appropriate lawful transfer mechanisms.

8. Cookies and similar technologies

Ordvaro currently uses cookies and local browser storage necessary to provide the Service, including authentication, security and interface preferences.

We currently do not use third-party advertising cookies or third-party behavioral tracking cookies. Accordingly, Ordvaro does not currently display a marketing-cookie consent banner.

If we introduce non-essential analytics, advertising or similar tracking technologies in the future, we will update this Privacy Policy and implement any consent mechanisms required by applicable law before using them.

9. Data retention

We retain information only for as long as reasonably necessary to provide the Service, maintain security and audit records, comply with legal obligations, resolve disputes and enforce agreements.

Raw inbound email copies stored as part of Ordvaro's email-intake process are generally configured for short-term retention and may be removed after approximately 30 days.

Order records, extracted order information, customer mappings, audit records and account information may be retained while an Organization maintains an active account and for a reasonable period afterward where necessary for operational, contractual, backup, accounting, security, dispute-resolution or legal purposes.

Where a customer is entitled to deletion or return of data, we will process the request subject to information we are legally required or reasonably permitted to retain. Backup copies may remain for a limited period until they cycle out of backup systems.

10. Security

We use technical and organizational measures designed to protect information against unauthorized access, disclosure, alteration or destruction.

These measures include tenant isolation, access controls, encrypted transport, private document storage and encryption of sensitive ERP credentials at rest. ERP credentials are not displayed in full after they have been saved.

No online service can guarantee absolute security. Customers are responsible for maintaining the confidentiality of their own accounts, users and ERP credentials.

11. Your privacy rights

Depending on applicable law and where you are located, you may have rights to request access to, correction of, deletion of, restriction of, portability of, or objection to certain processing of your personal data.

Where processing is based on consent, you may have the right to withdraw that consent.

Where Ordvaro processes your information solely on behalf of a customer Organization, we may refer your request to that Organization because it controls the relevant data.

Privacy requests can be sent to [email protected]. We may need to verify your identity before completing a request.

Where applicable, you may also have the right to lodge a complaint with the relevant data-protection authority.

12. Customer responsibilities

Customer Organizations are responsible for ensuring that they have the necessary rights and lawful basis to submit purchase orders, customer information, employee information and other data to Ordvaro.

Customers are also responsible for providing required notices to their employees, customers or other individuals where applicable law requires them to do so.

13. Children's privacy

Ordvaro is a business service and is not intended for use by children. We do not knowingly offer Ordvaro directly to children for personal or consumer use.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date above. Where a material change significantly affects how customer information is processed, we will provide reasonable notice where appropriate.

15. Contact