Orden OS (“Orden,” “we,” “us”) provides a salon-suite management platform for owners and the providers who lease space from them. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have.
1. Who this applies to
This policy covers two kinds of users:
- Owners — salon-suite operators who sign up directly at useorden.com/signup.
- Providers — independent professionals (stylists, estheticians, etc.) invited by an owner to claim a profile in that owner’s directory.
2. Information we collect
Information you provide directly:
- Account credentials: email and password (passwords are stored as bcrypt hashes; we never see or store your plaintext password).
- Profile information: name, phone, birthday, anniversary, business name, specialty, license/booth fee, photo, and any custom fields the owner configures.
- Onboarding documents and contracts: files providers upload to complete onboarding tasks (e.g. ID, signed agreements, certifications).
- Calendar entries: events you create, including titles, dates, and any linked profile references.
- Payment details: the bank account or card used to pay rent. Full account and card numbers are entered with, and held by, our payment processor — Orden stores only limited details such as the bank name, card brand and expiry, and whether a payment method is on file. We also store amounts, dates, fees, refunds and failed or returned payments.
- Business details for text messaging: if an owner turns on texting, the business’s legal name, Employer Identification Number (EIN), address and a contact person’s details, which mobile carriers require to register a business as a sender.
Information we collect automatically:
- IP address, used for rate limiting login and signup attempts.
- Session cookies, used to keep you logged in (we don’t use third-party tracking cookies or analytics cookies).
- Failed login attempts and account lockout state, used for security.
- Server logs, including request timing and errors, for debugging and abuse detection.
- Signing records: when you sign a document, agree to a rent schedule, or respond to a charge, we record the date and time, your IP address and your browser or device type, and keep them with the signed record. The salon that sent you the document can see this record.
- Visitor counts on our public marketing pages, collected without cookies and without building a profile of you.
3. How we use your information
- To provide the service: authenticate you, render your dashboard, store and serve files you upload, send transactional email (account creation, invites, password resets, lockout notifications).
- To secure the service: rate limit, detect brute-force attempts, lock accounts after repeated failures, isolate data between companies.
- To communicate with you: respond to support inquiries, send service updates if relevant.
- To comply with law: respond to lawful requests, enforce our Terms of Service.
We do not sell your personal information. We do not use your data to train AI models. We do not show you ads.
4. Multi-tenant isolation
Every record in Orden is scoped to a company (one owner’s salon). Users belonging to one company cannot read or modify data belonging to another. This is enforced at the API layer on every request.
Within a company, owners can see all provider profiles and onboarding documents. Providers can see their own profile and the documents the owner has shared with them. This is by design — it’s how the salon-suite relationship works — and it’s explained in onboarding.
5. Service providers we share with
We use a small set of third-party services to operate Orden. We share only what each one needs:
- Resend (transactional email) — receives recipient email address, name, and message content for invites, password resets, and lockout notifications.
- YokeDev (hosting and managed infrastructure) — runs our application servers and database. All your data lives on infrastructure they manage on our behalf.
- Backblaze (file storage) — stores photos, onboarding documents, contracts and database backups. Files are served only through our authenticated API (not via public URLs).
- Cloudflare — protects and delivers useorden.com, and holds a second copy of our files and backups so no single provider holds the only copy. Like any provider of this kind, it sees the request itself: IP address, browser and the page requested. It also provides the cookieless visitor counts described above.
- Stripe (payments) — processes rent payments today and receives the payment and identity information needed to move money and meet its legal obligations. We are moving payments to Finix Payments, Inc. and its partner banks; as each salon moves, business verification details, tax identification numbers and bank account details are sent to Finix, which uses and shares them under its own privacy policy, including with its partner banks and payment networks.
- Telnyx (text messaging) — delivers text messages and receives phone numbers and message content. To register a business as a sender, Telnyx and the mobile carriers’ registration system also receive the business details listed above.
Each of these vendors has its own privacy practices. We rely on their security and terms, and they may use your information only to provide services to us.
We don’t share your mobile number or your text-message consent with anyone for their own marketing or promotional purposes. Your number goes only to our text-message provider, to deliver the messages you agreed to receive.
6. Security measures
- Passwords stored as bcrypt hashes (12 rounds).
- HTTPS enforced for all traffic in production.
- Session cookies are HTTP-only and secure-flagged.
- IP-level rate limiting on login and signup.
- Per-account lockout after repeated failed login attempts, with email notification.
- Server-side validation of all uploads (file type, size, content).
- Tenant isolation enforced on every API request.
No system is perfectly secure. If you discover a vulnerability, please report it to [email protected].
7. Data retention
We keep your data while your account is active. If you ask us to delete your account, we delete or de-identify your personal information within 30 days of confirming your request, except where we need to keep it longer — payment records for legal, tax, accounting and fraud-prevention reasons, signed documents and their signing records, and text-message consent records so we can keep honoring opt-outs.
Deleted information can remain in backup copies until they expire. Routine daily database backups expire after 30 days, and occasional backups taken before major system changes are kept for up to 12 months. Backups are not used for any other purpose.
8. Your rights
You can:
- Access the personal information we hold about you (most of it is visible in your profile and dashboard).
- Correct inaccurate information by editing your profile, or by contacting us if you can’t edit it directly.
- Request deletion of your account and the personal data tied to it.
- Request a copy of your data in a portable format.
To exercise any of these, email [email protected] from the address on your account.
9. Children’s privacy
Orden is a business tool for adults. It isn’t directed at children, and we don’t knowingly collect information from anyone under 13. Separately, you must be 18 or older to have an Orden account or to use payments, because our payment partner requires it. If you believe a child has provided us with information, please contact us and we’ll delete it.
10. International users
Orden is operated from the United States. If you use Orden from outside the U.S., your information will be transferred to and stored in the U.S. By using Orden, you consent to that transfer.
11. Changes to this policy
We’ll update this policy as Orden evolves. When we make material changes, we’ll bump the policy version and ask you to agree again the next time you sign in. The current version and effective date are shown at the top of this page.
12. Contact
Questions about this policy or how we handle your data: [email protected].