Privacy Policy (Ordafy Pay)

1. Who we are

Ordafy Limited (England and Wales, company number 16063522) is the data controller for personal data processed through Ordafy Pay (pay.ordafy.com) in connection with payment links and related merchant tools. This notice adds Pay-specific detail to our ecosystem-wide Privacy Policy on ordafy.com; both apply where relevant.

2. What we process on Pay

Depending on how you use Ordafy Pay, we may process:

• Merchant / org users: account identifiers, organisation membership, link metadata (e.g. line descriptions, amounts, currency), optional customer contact fields you provide for a link, and audit timestamps.
• Payers: data needed to complete Checkout (e.g. email where entered), technical data (IP, device/browser), and payment references. Card data is handled by Stripe; we do not store full card numbers or CVV on Ordafy servers (PCI SAQ-A style scope).

3. Purposes and legal bases

We process data to provide payment links and Checkout, authenticate users, prevent abuse, comply with law, improve security, and report to merchants. Legal bases may include contract, legitimate interests (e.g. fraud prevention, service improvement), and legal obligation where applicable.

4. Stripe and subprocessors

Stripe processes card payments and may act as a processor or independent controller for certain fraud and compliance processing. See Stripe's privacy notice for how they handle payment data. We may use other infrastructure providers (e.g. hosting) under contract.

5. Retention

We keep data only as long as needed for the purposes above, including legal, tax, and dispute resolution periods. Link and transaction records may be retained in line with financial and platform policies.

6. Your rights

You may have rights to access, rectify, erase, restrict, or object to processing, and to data portability, depending on your location. Contact privacy@ordafy.com or info@ordafy.com. You may lodge a complaint with a supervisory authority.

7. International transfers

Data may be processed in the UK, EEA, or other countries where we or our providers operate, using appropriate safeguards where required.

8. Cookies

See our Cookie Policy for Pay and shared sign-in cookies where applicable.