Privacy Policy
Ordo is built privacy-first, in the EU. We collect the minimum we need to run the beta and improve the product, we explain every use in plain language below, and we don’t sell your data — and we never will.
1. Who we are
The data controller responsible for your personal data is:
- BOTOP LTD EOOD (trading as “Ordo”)
- Company No. (EIK): 208850878
- D-U-N-S® No.: 369865396
- Registered in Bulgaria (European Union)
- Registered office: 18 Shipchenski Prohod, Slatina District, Bl. A, Fl. 3, Sofia 1113, Bulgaria
- Privacy contact: [email protected]
2. What we collect
When you join the waitlist / founding beta, you give us:
- Your email address (required) — so we can contact you about the beta and launch.
- Your car(s) — make, model, and year, for each car you choose to add.
- Your consent to receive beta and launch emails.
- Beta questionnaire answers, if you choose to complete the screening questions.
Collected automatically when you use the website:
- Attribution data — how you reached us (e.g. a referral link or campaign source) so we can credit referrals and understand which channels work.
- Basic technical data — IP address, browser type, and request logs, kept for security and to keep the site running.
From your car and questionnaire answers we may derive a few things — for example whether your car is well-covered in our library, and whether you’re a good fit for a particular beta cohort. These are used only to select and prioritise beta testers.
When you use the Ordo app (at launch): your account email, the cars and maintenance/fuel logs you add, and your questions to the in-app assistant. Ordo is offline-first — most answers are produced on your device and never leave it. When a question does need our servers or a third-party AI model, we strip out obvious personal details first; and for questions answered by our AI assistant we keep an anonymised log of the question and answer, with no account or user identifier and with personal details automatically redacted, used only to measure and improve answer quality. We also record anonymous product-analytics and crash events (for example, that an answer was served from your device’s offline library, or that a screen was opened) through Google Firebase, to see which features work and to fix crashes; these events carry no account identifier and no raw question text. Subscriptions, when available, are handled by the app stores and our billing provider — we never see your card number.
3. Why we use it, and our legal basis
| What | Why | Legal basis (GDPR) |
|---|---|---|
| Beta & launch emails | Tell you when you’re in and when we launch | Your consent (Art. 6(1)(a)) |
| Your car(s) & questionnaire | Check coverage, select and prioritise beta testers | Consent / our legitimate interest in running a fair beta (Art. 6(1)(f)) |
| Referral & attribution | Credit referrals, understand our channels | Legitimate interest (Art. 6(1)(f)) |
| Security & server logs | Keep the service safe and available | Legitimate interest (Art. 6(1)(f)) |
| Providing the app | Deliver the service you signed up for | Performance of a contract (Art. 6(1)(b)) |
You can withdraw consent at any time — every email has an unsubscribe link, or just email us. Withdrawing consent doesn’t affect processing we already did.
4. Who we share it with
We do not sell your personal data, and we do not share it for anyone else’s advertising. We use a small number of trusted service providers (“processors”) who act only on our instructions:
- Email — Zoho (EU data centre), to send and manage our emails.
- Infrastructure & delivery — Cloudflare (CDN/security) and our own EU-hosted servers, to run the website and store data.
- App stores & billing (at launch) — Apple, Google, and our subscription provider, to process purchases.
- In-app AI (at launch, only when a question can’t be answered on your device) — our AI model provider, with obvious personal details removed first.
- Product analytics & crash reporting — Google Firebase, for anonymous in-app usage measurement and crash diagnostics (no account identifier, no question text).
We may also disclose data if required by law, or to protect our rights and users’ safety.
5. Where your data is stored & international transfers
Your data is stored in the European Union. Some providers may process limited data outside the EU (for example, security, analytics, or AI services). Where that happens, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.
6. How long we keep it
We keep waitlist and beta data until the beta ends and for a reasonable period afterwards, or until you ask us to delete it — whichever comes first. If you unsubscribe or ask for erasure, we remove your data promptly, except anything we’re legally required to keep. Security logs are kept only as long as needed for that purpose. Anonymised AI question-and-answer logs carry no identifier that ties them to you and are kept only as long as they’re useful for improving answer quality.
7. Your rights
Under the GDPR, you have the right to:
- Access the data we hold about you;
- Correct data that’s wrong or incomplete;
- Delete your data (“right to be forgotten”);
- Restrict or object to how we use it;
- Port your data to another service;
- Withdraw consent at any time.
To exercise any of these, email [email protected]. We’ll respond within one month. You also have the right to complain to your local data protection authority — in Bulgaria, the Commission for Personal Data Protection (CPDP, cpdp.bg).
8. Cookies & tracking
This website does not use advertising or third-party tracking cookies. Any referral or campaign information is passed in the page link itself, not stored as a tracking cookie. If we add analytics later, we’ll update this policy and ask for consent where required.
9. Security
We protect your data with encryption in transit, access controls, and EU-hosted infrastructure. No system is perfectly secure, but we take reasonable steps to keep your information safe and will notify you and the authorities of a breach where the law requires.
10. Children
Ordo is not intended for children under 16. We don’t knowingly collect data from them; if you believe a child has given us data, contact us and we’ll delete it.
11. Changes to this policy
We’ll update this page if our practices change and revise the “Last updated” date above. For material changes affecting the beta list, we’ll email you.
12. Contact
Questions or requests about your privacy? Email [email protected] — we read every one.
Ordo. Know your car. Own your journey.