Privacy Policy

ORDR, Inc. its affiliates and subsidiaries (collectively “ORDR,” “we”, “our” or “us”) knows you care about how your Personal Information is used and shared, and we take your privacy seriously. Please read the following to learn more about our Privacy Policy. By using or accessing ORDR’s Website or by using any of ORDR’s hosted products (the “ORDR Solution”) or through communicating with ORDR regarding its software (the “ORDR Software”) in any manner, you acknowledge that you accept the practices and policies outlined in this Privacy Policy, and you hereby consent that we may collect, use, and share your information in the following ways.

ORDR may make changes to this Privacy Policy. The most current version of the Privacy Policy will govern ORDR’s use of information about you and will be located at https://ordr.net/privacy-policy. If ORDR makes material changes to this Privacy Policy, ORDR will notify you by posting a notice on our website and may send an email to the address ORDR has on file for your account, if applicable.

This Privacy Policy explains:

1. Our privacy policy was updated on March 18, 2026
2. Changes to this privacy policy
3. The type of information we collect
4. How ORDR collects your information; tracking and cookies
5. How ORDR uses your information
6. Correcting and updating your information
7. Consent to commercial electronic messages
8. Rights to object or restrict processing of Personal Information
9. Right to be informed of appropriate safeguards where personal information is transferred to a third country or to an international organization
10. Who we may share information with
11. How we handle “Do Not Track” requests
12. Linked sites and ORDR solution
13. Data security
14. Retention of your information
15. ORDR IQ: AI Security and Confidentiality
16. Notice of privacy rights to California residents
17. Notice of privacy rights to residents of the European Economic Area
18. How to contact us

ORDR may collect information that you provide to ORDR in connection with your use of the ORDR Solution or the ORDR Software when you:

• Register your account with ORDR as a user of the ORDR Software or the ORDR Solution (including through registration as an employee, contractor or other user of the ORDR Software or the ORDR Solution on behalf of a ORDR customer (“Customer”)
• Make changes to your user profile information
• Send email messages, forms, or other information to ORDR or other users using the ORDR Solution or the ORDR Software, or
• Install, use or otherwise interact with the ORDR Solution.

This information may include your first and last name, your address, email address, telephone number, your location, and any additional information you provide to ORDR during the account registration process or via the ORDR Solution.

ORDR may also collect certain technical information about your use of the ORDR Solution. This technical information may include technical information about your device(s), browser type and version, geo-location information, computer and connection information, statistics on page views, traffic to and from the ORDR Solution, ad data, Wi-Fi connection information, internet protocol (“IP”) address, and standard web log information.

Additionally, when expressing an interest in obtaining additional information about the ORDR Solution or the ORDR Software or registering to use the ORDR Solution or the ORDR Software, we or a Customer may require you to provide us with personal contact information, such as your name, company name, address, phone number, and email address (“Required Information”). Although ORDR uses third party service providers to process payments, when purchasing access to the ORDR Solution or the ORDR Software, we may require a Customer to provide our payment processing service providers with financial and billing information, such as billing name and address, credit card number, and the number of employees within the Customer that will be using the ORDR Solution or the ORDR Software (“Financial Information”). We may also ask an actual or prospective Customer to provide additional information, such as company annual revenues, number of employees, or industry (“Optional Information”). Required Contact Information, Billing Information, and Optional Information about Customers are referred to collectively as “Customer Data.”

When you register for an account with ORDR either directly or through a Customer, we may ask you to provide us with certain information in order to create your account, and to provide you with our ORDR Solution or the ORDR Software. This information is collected by us when you fill out forms that may be provided to you through the ORDR Solution.

ORDR, and third parties we interact with, including our third-party service providers, may use cookies, web beacons, hashed identifiers derived from email addresses for the purposes of cross-device tracking for targeted advertising, local shared objects (sometimes called “flash cookies”), and similar technologies in connection with your use of the ORDR Solution to provide and support the ORDR Solution (collectively referred to in this policy as “Cookies”). Cookies are small data files that may have unique identifiers, and reside, among other places, on your mobile device, in emails we send to you, and on our applications. Locally shared objects or “flash cookies” are data files that can be created on your computer by the websites you visit and are a way for websites to store information for later use. Locally stored objects are different than cookies because they are stored in different parts of your computer than cookies. Web beacons are small strings of code that provide a method for delivering a graphic image on a web page or in an email message for the purpose of transferring data.

If Cookies are used, they may be used to collect information about you and your use of the ORDR Solution, such as your browser type, preferences, data relating to content that has been displayed to you or that you have clicked on, and the date and time of your use. Cookies may also be used in order to further features and processes on the ORDR Solution, provide authentication and security for your transactions using the ORDR Solution, store your preferences, facilitate relevant advertising, and help us learn more about how users engage with the ORDR Solution.

We sometimes use service providers to help us provide certain products and services or to integrate other features. These third-party providers may collect information when you view or use them, including information about you and your device or browser. They may do this using Cookies or similar technologies. These third-party providers also may use these technologies to help share information with us, like how you use their website or application. To learn more about the information they collect or receive, review their privacy policies.

As part of using our ORDR Solution, ORDR’s Customers may submit to ORDR electronic data or information (“Submitted Data”) that constitutes personal information of other individuals. Such data may include an individual’s name, email address, phone number or any other data that the Customer chooses to submit to us. ORDR generally has no direct relationship with the individuals to whom Submitted Data may pertain. ORDR processes Submitted Data on behalf of our Customers and any uses of Customer Data by ORDR are done so pursuant to our Terms and Conditions or a separate agreement in place between ORDR and the applicable Customer, which governs our treatment of Submitted Data.

ORDR may use your information to:

• Provide access to the ORDR Solution to communicate with you
• Personalize, customize, measure, and improve ORDR’s products, services, content, and advertising
• Prevent, detect, and investigate potentially prohibited or illegal activities or a breach of the applicable agreement(s) between you and ORDR
• Analyze the accuracy, effectiveness, and usability of the ORDR Solution or the ORDR Software
• Generate and review reports and data about ORDR’s user base and ORDR Solution usage patterns
• Compile aggregate data for internal and external business purposes
• Resolve disputes and troubleshoot problems; and
• Contact you with information, including promotional, marketing, and advertising information and recommendations that ORDR believes may be of interest to you.

Consistent with applicable laws, including United States CAN-SPAM laws, if you do not wish to receive commercial emails, you may unsubscribe following the instructions on any email. We may still send you administrative notices, however.

We endeavor to protect the privacy of your account and other Personal Information we hold in our records, but unfortunately, we cannot guarantee complete security. Unauthorized entry or use, hardware or software failure, and other factors, may compromise the security of user information at any time. In particular, you acknowledge that ORDR is not responsible for any loss of any passwords or login information which you receive for access to the ORDR Solution which results from your failure to keep that information secure

Customers may update or change their account information through their account settings accessible using the Customer account page included in the ORDR Solution. Access to your ORDR account page will require your ORDR Solution username and password. To update your Information or to delete your account information, please email notices@ORDR.net.

You can access or change your profile and contact information or delete your account through the ORDR settings page. If you choose to delete or deactivate your account, you can no longer retrieve content or reactivate your account.

You have the right to request access to any Personal Information which ORDR may have about you by contacting notices@ORDR.com. The information will be provided in a machine-readable format. You may also ask that we transfer the Personal Information to a third party, which we will do if technically feasible.

You also have the right to review, add and update your Personal Information. You may also request the deletion of your Personal Information where

• the personal information is no longer necessary in relation to the purposes for which it was collected or otherwise processed,
• you withdraw consent to ORDR’s possession of the information on which the processing is based and where there is no other legal ground for ORDR’s retention of the information,
• you object to ORDR’s possession of the information and there is no overriding legitimate basis for the retention,
• the personal information has been unlawfully obtained or processed, or
• the personal information has to be erased for compliance with a legal obligation in the European Union or other law to which ORDR is subject.

When you update information, however, we may maintain a copy of the unrevised information in our records. Some information may remain in our records after your deletion of such information from your account. We may use any aggregated data derived from or incorporating your Personal Information after you update or delete it, but not in a manner that would identify you personally.

If your individual personal information has been submitted to us by a Customer as Submitted Data and you wish to exercise any rights you may have to access, correct, amend, or delete such data, please first inquire with the Customer (or his/her organization) directly

If you provide us with an email address, you expressly consent to receiving Commercial Electronic Messages from ORDR about your use of the Website, the ORDR Solution, the ORDR Software and our Products. If you have any questions about ORDR’s Commercial Electronic Messages, you can contact ORDR at:

ORDR, Inc.
2445 Augustine Dr.
#601
Santa Clara, CA 95054
Attention: Privacy Officer or by emailing notices@ordr.net

In addition, you may opt out of receiving Commercial Electronic Messages at any time by emailing notices@ordr.net.

If ORDR has your Personal Information as a result of your relationship with one of ORDR’s Customers, you should first contact that Customer before contacting ORDR. You may, however, at any time revoke your consent to the collection, processing and use of your Personal Information by emailing notices@ORDR.net. Upon receipt of your request, ORDR will delete your personal data provided ORDR may retain any data which is required for billing and accounting purposes or which is subject to legal retention requirements. In addition, if you discover any errors in data, you may contact us by emailing notices@ORDR.net and we will correct it. You can always opt not to disclose information to us, but keep in mind some information may be needed to take advantage of product features or may be required by your relationship with one of ORDR’s customers.

ORDR enters into agreements with its customers regarding the safeguards that have been put in place to protect your Personal Information for transfer outside of Switzerland or the European Economic Area. For transfers to countries without an adequacy decision by Switzerland or the European Commission, ORDR puts appropriate safeguards through contractual obligations..

ORDR may disclose the information we collect from you to the following third parties:

Users of the ORDR Solution; Public Information.
When you share information with us via the ORDR Solution, ORDR may share your information to other users, in accordance with the privacy settings you or the respective Customer has chosen for your account or that are applicable to that information. To the extent you share any information to a public audience or via a publicly accessible portion of the ORDR Solution such as an online customer community or forum, that information may be available to anyone who has access to that customer community or forum..

ORDR’s solution Providers.
ORDR may share your information with third-party contractors, agents, collaborators, or service providers who provide certain services to ORDR or on ORDR’s behalf, such as operating and supporting the ORDR Solution. ORDR may also request your information from a previous service provider, which we need to provide our services to you. Alternatively, ORDR may pass on your information to a service provider that ORDR Customers have chosen to replace ORDR.

Companies that Acquire ORDR’s Business or Assets.
If ORDR becomes involved in a merger, acquisition, sale of assets, securities offering, bankruptcy, reorganization, or dissolution or if the ownership of all or substantially all of ORDR’s business relating to the ORDR Solution otherwise changes, ORDR may provide your information to a third party or parties in connection with the applicable transaction.

ORDR’s Affiliates.
ORDR may share some or all of your information with ORDR’s parent company, subsidiaries and corporate affiliates, joint ventures or other companies under common control with ORDR.

ORDR Customers.
If ORDR has received your information as part of Submitted Data, ORDR may share that information, or any modifications or revisions to that information with that Customer.

Switching ORDR Solution Providers.
ORDR may request your information from your previous service provider, which we need to provide our services to you. Alternatively, ORDR may pass on your information to a service provider that you have chosen to replace ORDR.

Aggregate Information.
ORDR may share information relating to our visitors and users with affiliated or unaffiliated third parties on an aggregate basis, however this information will not identify you personally.

Legal Requirements.
ORDR may share your information with law enforcement, governmental agencies, or authorized third parties, in response to a request relating to a criminal investigation or alleged illegal activity or any other activity that may expose ORDR you, or any other ORDR user to legal liability, or to protect ORDR’s rights or property, or during emergencies when safety is at risk. ORDR may also share your information in response to court orders, subpoenas, or other legal or regulatory requests, and ORDR may provide access to your information to ORDR’s legal counsel and other consultants in connection with actual or potential litigation. ORDR shall remain liable under the Principles if its agent processes such personal information in a manner inconsistent with the Principles, unless ORDR proves that it is not responsible for the event giving rise to the damage.

You may be able to adjust your browser settings or other settings so that “do not track” requests are sent to our websites and mobile applications. ORDR does not use any tracking technology that would respond to any “do not track” requests that are sent to our services. ORDR does not collect personally identifiable information about your online activities over time and across different websites when you use the ORDR Solution; however, certain service providers that use Cookies may collect your personally identifiable information over time and across different websites.

ORDR’s website or application may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.

ORDR takes reasonable measures to protect the information you provide to ORDR or submit through the ORDR Solution against misuse, loss, theft, unauthorized use, disclosure, or modification. Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk and your information may be disclosed to third parties in unforeseeable situations or situations that are not preventable even when commercially reasonably protections are employed, such as in the case that ORDR or if the ORDR Solution are subject to a hacking or other attack. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorized access.

We retain information about you only for as long as it is necessary and relevant for ORDR’s operations, and for ORDR’s customers to work with their consumers. Information about you that is no longer necessary and relevant for ORDR’s operations will be disposed of securely. ORDR may also retain information collected from you to comply with the law, prevent fraud, resolve disputes, troubleshoot problems, assist with any investigation, and take other actions permitted by law or disclosed in this Privacy Policy.

ORDR is committed to delivering AI that meets the highest standards of security, privacy, and enterprise readiness. ORDR IQ works with any large language model that offers enterprise-grade licensing with strong guarantees around data protection, confidentiality, and zero data retention. Customers can bring their own LLM or AI infrastructure and configure it directly through the ORDR UI.

In addition, ORDR’s sophisticated machine learning models used for device profiling have been developed in-house, operate entirely within ORDR’s data center, and does not expose customer data to third-party models, external training, or infrastructure that has not already been subject to customer security review.

ORDR IQ uses secure, enterprise-grade AI capabilities to deliver intelligence and automation across your environment while keeping your data private, protected, and fully under your control. All AI processing is handled with strict confidentiality, and customer data is never used to train external models.

Security Architecture

Access Control

• Access is restricted to authorized ORDR personnel and designated customer users only
• Integrated Single Sign-On (SSO) with strong identity verification
• Role-based access controls consistent with enterprise governance policies

Infrastructure

• ORDR IQ operates in an isolated private-cloud environment
• Segmented from public-facing networks
• Hosted on enterprise-grade, SOC 2 Type II–certified infrastructure
• Built with industry-standard AI security protocols

Data Protection

Zero Data Retention

• Zero Data Retention (ZDR) is always enabled
• No prompts, responses, or metadata are stored by the AI provider
• No data is used for AI model training—ever

Confidential Processing

• All input is processed in real-time only
• Data is immediately deleted after computation
• No persistent storage of sensitive information
• Data is never shared with third parties or used outside the customer environment

Confidentiality & Compliance Guarantees

Data Lifecycle

• Data exists only during active processing
• Automatic, instant deletion post-processing
• No long-term logging, caching, or replication

Compliance Alignment

• Supports enterprise security and governance frameworks
• Aligns with customer regulatory requirements (HIPAA, PCI, SOX, NERC, etc.)
• Detailed audit logs available for access, usage, and administrative actions

Risk Mitigation Controls

• No exposure to external or unapproved APIs
• End-to-end encrypted data transmission
• Continuous monitoring and security telemetry
• Periodic internal and external security assessments

TThe California Consumer Privacy Act requires businesses to disclose whether they sell Personal Data. As a business covered by the CCPA, we do not sell Personal Data. We may share Personal Data with third parties or allow them to collect Personal Data from our sites or Services if those third parties are authorized service providers or business partners who have agreed to our contractual limitations as to their retention, use, and disclosure of such Personal Data, or if you use ORDR sites or Services to interact with third parties or direct us to disclose your Personal Data to third parties.

California law requires that we detail the categories of Personal Data that we disclose for certain “business purposes,” such as to service providers that assist us with securing our services or marketing our products, and to such other entities as described in Sections 8 and 10 of this Privacy Statement. We disclose the following categories of Personal Data for our business purposes:

Identifiers;

Commercial information;

Internet activity information;

Financial information; and

Inferences drawn from any of the above information categories.

California law grants state residents certain rights, including the rights to access specific types of Personal Data, to learn how we process Personal Data, to request deletion of Personal Data, and not to be denied goods or services for exercising these rights.

If you are a California resident under the age of 18, you may ask us to remove content or information that you have posted to our website(s). Please note that your request does not ensure complete or comprehensive removal of the content or information, because, for example, some of your content may have been reposted by another user.

For information on how to exercise your rights, please refer to Section 15 of this Privacy Statement. If you are an authorized agent wishing to exercise rights on behalf of a California resident, please contact us using the information in the “Contacting Us” section above and provide us with a copy of the consumer’s written authorization designating you as their agent.

We may need to verify your identity and place of residence before completing your rights request.

You have the right to ask us not to process your personal data for marketing purposes. We will usually inform you (before collecting your data) if we intend to use your data for such purposes or if we intend to disclose your information to any third party for such purposes. You can exercise your right to prevent such processing by checking certain boxes on the forms we use to collect your data. You can also exercise the right at any time by contacting us at notices@ORDR.net.

If you have questions or complaints regarding ORDR’s Privacy Policy or practices, please contact notices@ORDR.net or via postal mail at

ORDR, Inc.
2445 Augustine Dr.
#601
Santa Clara, CA 95054
Attention: Privacy Officer