Privacy Policy

Ordo keeps all your travel bookings in one place. This policy describes what data we process, why we do it, which services we use and how long we keep the data. It applies to both the app and the website ordo.nu.

Data controller

Ordo is operated by John Guthed, Sweden, who is the data controller for the processing described here. Send questions about your data to support@ordo.nu.

What data do we collect?

• Account – Your email address, an internal user ID and your name if you sign in with Google or enter it in your profile
• Bookings – Details from your booking confirmations, such as times, places, booking references and travelers' names
• Forwarded emails and files – The emails you send to go@ordo.nu and files you upload, such as PDFs
• Photos – Images of paper documents you scan yourself with the camera in the app
• Device ID for notifications – A push token for your phone or browser, if you allow notifications
• Settings – Language, notification choices and other preferences in Ordo

The app does not collect your location and contains no advertising, analytics or tracking.

How do we use your data?

• Interpret your booking confirmations and add the bookings to the right trip
• Show your trips, timelines and insights, for example gaps in your plans or delays
• Send notifications and emails about your trips and your account
• Show a trip to the people you invite
• Troubleshoot and improve interpretation when something goes wrong

We never sell your data and do not use it for advertising.

Camera and scanning

The app only uses the camera when you tap scan. The image is sent for interpretation and saved as a PDF with the booking, so you can open the original later. We do not use the camera for anything else.

Notifications

If you allow notifications, we store a push token for your device. Notifications, such as flight changes and reminders, are delivered through Apple Push Notification service in the app and through your browser's push service on the web. The token is removed when you sign out of the app, when it expires or when you delete your account. You can turn off notifications in your phone or browser settings.

Shared trips

You can invite others to a trip, by email or with a link. The people you invite can see the trip with its bookings and insights, including the names that appear in the bookings. Unused link invitations are deleted 30 days after they expire.

How do we store and delete data?

• Account, bookings and insights – Kept for as long as you keep your account
• Files and scans – Kept with the booking for as long as you keep your account
• Forwarded emails – Deleted automatically 365 days after they arrive
• Emails that could not be interpreted or that you have corrected – Kept for up to two years for troubleshooting, then deleted automatically
• Location – The database and files are stored with Supabase in the EU (Ireland)

Data is encrypted at rest (AES-256) and always sent encrypted (TLS).

Delete your account

You can delete your account yourself under Account → Delete account, in the app and on the web. Your account and all your trips, bookings, files, emails and settings are then deleted immediately. This cannot be undone.

Third-party services

To deliver the service, we use the following external services:

• Supabase – Database, sign-in, file storage and server functions, in the EU (Ireland)
• Anthropic (Claude) – AI interpretation of emails, files and scans, and insights about your trips. Under Anthropic's terms, the data is not used to train their models
• Mailgun – Receives the emails you forward to go@ordo.nu
• Loops and Resend – Send emails from Ordo, such as confirmations and reminders. Receive your email address and name
• Apple Push Notification service – Delivers notifications to your iPhone. Receives a push token and the notification text
• Google – Sign in with Google, plus maps, addresses and place photos. Only addresses and place names from bookings are sent to the map features
• AeroDataBox – Flight status. Receives only flight numbers and dates
• Firecrawl, Open-Meteo and Unsplash – Ratings, weather and destination photos. Receive only names of hotels, restaurants and places, or coordinates, never data about you
• Notion – Our internal workspace for support requests, feedback and an overview of accounts (name, email and number of trips)

We only share what each feature needs. Some of these providers process data outside the EU, mainly in the United States.

The ordo.nu website

The website is delivered through Vercel. To understand how it is used, the website loads Google Analytics, Contentsquare and Albacross. They set cookies and record, for example, which pages are visited, approximate location and company information that can be derived from the IP address. None of this is in the app. You can block cookies in your browser settings.

Your rights

You have the right to:

• Access your data and get a copy of it – export under Account on the web
• Correct inaccurate data – edit bookings and your profile directly in Ordo
• Delete individual trips, bookings or your entire account
• Object to or restrict certain processing
• Lodge a complaint with the Swedish Authority for Privacy Protection (IMY) or the supervisory authority in your country

Contact us if you want to exercise any of these rights or have questions.

Changes to this policy

We may update this privacy policy as we improve the service. For major changes, we will notify you via email.