Orda Privacy Policy

1. Who we are

Orda is provided by Green Hills Tech (“Green Hills Tech”, “we”, “us”, “our”), website ghtech.ai. For any question about privacy or this policy, write to us at support@ghtech.ai.

2. Scope

This policy applies to Orda, our business management service (ERP) for companies, including the web app at app.orda.ghtech.ai, the Orda phone apps for iPhone and Android, and the related services we provide (together, the “Service”).

It does not apply to other websites or apps that you open from Orda, such as WhatsApp or your email app when you choose to share a document. Those services have their own privacy policies.

3. Your company and us

Orda is used by companies and organisations (“customers”). A customer creates its company in Orda and invites its staff (“users”).

The business data that a customer and its users enter into Orda belongs to that customer. The customer decides what to enter and who may see it, so for that data the customer is the controller, and Green Hills Tech processes it on the customer’s behalf and on its instructions, only to provide the Service.

Green Hills Tech is responsible for the account data and technical data we need to run and protect the Service.

If your employer gave you access to Orda, please contact your company first with questions about the business data it holds. We will help your company answer them.

4. Data we collect

We collect only what we need to provide the Service:

• Account data: your name, email address and/or phone number, a hash of your password (we never store the password itself), the companies you belong to, your role and branch access, your language, number style and display preferences (theme, text size, contrast and motion), and when you last signed in.
• Security data: if you turn on two-step sign-in, the secret that links your authenticator app; a hash of your approval PIN (never the PIN itself); and one-time links for password reset, email verification and invitations.
• Sign in with Google: if you choose to sign in or sign up with Google on the web, Google confirms your identity to us and we receive your Google account’s email address and name. We never receive your Google password.
• Sessions: for each signed-in session, a description of the device or browser, the IP address, and when the session started and was last used. You can see your signed-in devices and sign them out in Settings → Security.
• Business data your company enters: customers, suppliers, items and prices, stock, sales and purchase documents, payments, accounting entries, targets, approvals, comments, imported files, attachments (such as receipt photos) and the company logo. This can include personal data about your company’s customers, suppliers and staff, such as names, phone and WhatsApp numbers, email addresses and addresses.
• Audit log: a record of each create, change, delete, post, approve and reject action: who did it, when, what changed (before and after) and where it came from (web, phone app or API). Companies need this record for accounting control.
• Notification tokens: if you allow notifications, a Firebase Cloud Messaging token for your phone or browser, with the platform and, for browsers, a description of the browser, so that we can send you approval requests and other alerts.
• Messages to us: if you contact us, your message and your contact details.
• Technical data: our servers may record technical information about requests, such as time, IP address, the page or function requested and error details, to run the Service, fix problems and protect it from misuse.

5. Phone app permissions

The phone app asks for a permission only when you use the feature that needs it. You can turn each permission off at any time in your phone’s settings.

• Camera: to scan barcodes, and to photograph a receipt when you choose to attach one to an expense. Barcode images are read on your phone and are not stored or sent to us; only the barcode number is used. A receipt photo you attach is uploaded and stored with the expense.
• Photos: to pick a receipt image to attach to an expense. Only the image you pick is uploaded.
• Notifications: to tell you about approvals waiting for you and other events in your company.
• Face ID, Touch ID or fingerprint: to unlock the app or confirm an approval. The check is done entirely by your phone’s own system. We never receive or store biometric data.

The app does not access your location, contacts, microphone or data from other apps.

6. Cookies and storage on your device

The web app uses one strictly necessary cookie to keep you signed in, and stores small settings in your browser, such as the theme and the selected branch. The phone app keeps your sign-in in the phone’s secure storage (Keychain on iPhone, Keystore on Android) and keeps your settings on the phone. We do not use advertising or analytics cookies.

7. What we do not do

• We do not sell or rent personal data.
• We do not show advertising and do not use data for advertising.
• We do not track you across other companies’ apps or websites.
• We do not include third-party analytics or advertising tools in the web app or the phone apps.
• We do not use your company’s business data for our own purposes, such as marketing.

8. How we use data

• To provide the Service: sign-in, the documents, stock, accounts and reports your company uses, approvals, PDF documents and notifications.
• To keep it secure: confirming who you are, two-step sign-in and approval PINs, keeping each company’s data separate, the audit log, and detecting and stopping misuse.
• To support you: answering your requests and your company’s administrators, and fixing problems. Our staff look at a company’s data only when this is needed for that purpose.
• To inform you about the Service, such as security notices and important changes. We do not send marketing messages through the Service.
• To meet legal obligations and respond to lawful requests from competent authorities.

9. Legal bases

We process personal data only when we have a valid reason:

• Contract: to provide the Service under our agreement with your company and to give you the account you use.
• Legitimate interests: to keep the Service secure, prevent misuse and support our customers, in a way that respects your rights.
• Consent: for optional features such as notifications, the camera and sign-in with Google. You can withdraw consent at any time in your phone or browser settings.
• Legal obligation: for example to keep accounting records or answer a lawful order.

10. Who processes data for us

We use a small number of service providers to run Orda. Each receives only the data it needs for its task:

• Hostinger: provides the cloud server, in a data centre in Frankfurt, Germany, where Orda’s application, database and files are stored.
• Google (Firebase): provides sign-in with Google on the web (Firebase Authentication) and delivers push notifications (Firebase Cloud Messaging).
• Apple: on iPhone, notifications are passed through the Apple Push Notification service to reach your device.
• Email delivery: when email sending is turned on in Orda (for invitations, password resets and documents you choose to email), those emails pass through the email delivery provider we use.

When you choose to share a document by WhatsApp or by your own email app, it is sent by that app under its own terms. We may also disclose data when the law or a binding order of a competent authority requires it, to protect the rights and safety of our users or of Green Hills Tech, or as part of a merger or sale of our business, in which case this policy will continue to protect the data.

11. Where data is stored

Orda’s servers, database and files are in Germany, in the European Union. Google and Apple may process sign-in and notification data in other countries, including the United States, under their own safeguards. This means your data is stored and processed outside Iraq.

12. How long we keep data

• Company data and its audit log: for as long as the company uses Orda. When the company stops using Orda, it can ask us to export its data, delete it, or both. We complete a verified request within 30 days, except for data the law requires us to keep.
• Your account: while you belong to at least one company, or until you ask us to close it. The record of your actions in a company’s audit log stays with that company’s data, because it is part of its accounting records.
• Sessions: a session stops working when you sign out, when it is signed out from Settings, or when it expires. Its record stays in the account’s security history.
• Notification tokens: no longer used once you sign out on that device, and deleted when Firebase reports them as no longer valid.
• Messages to us: as long as needed to handle your request and keep a record of it.
• We may keep data longer when the law requires it, for example accounting and tax records, or to resolve a dispute.

13. How we protect data

• All connections to Orda use encrypted HTTPS.
• Passwords and approval PINs are stored only as Argon2 hashes.
• Each company’s data is kept apart in the database with row-level security, so one company cannot see another company’s data.
• Roles and branch permissions decide who can see and do what inside a company, and the audit log records every change.
• Optional two-step sign-in, an approval PIN for approvals, and Face ID or fingerprint on the phone.
• The database and file storage are not reachable from the internet, and access to the servers is limited to authorised Green Hills Tech staff.

No system can be completely secure. Keep your password and PIN private and turn on two-step sign-in. If we become aware of a security breach that affects your data, we will inform the affected companies without undue delay and take steps to limit the harm.

14. Your rights

Subject to applicable law, you can ask us to:

• Access the personal data we hold about you and receive a copy.
• Correct data that is wrong or incomplete.
• Delete your data or close your account.
• Export your data in a commonly used format.
• Object to or limit certain processing, and withdraw consent you gave.

You can do many things yourself in the app: change your name, language and password, turn two-step sign-in on or off, sign out other devices, and turn notifications off. Company administrators can export lists and reports and turn off a user’s access.

For anything else, including deleting your account, write to support@ghtech.ai from the email address on your account. We will confirm your identity and reply within 30 days. Requests about a company’s business data will usually be handled with that company or on its instructions, because it controls that data. When we delete your account, your name may remain in the audit log of the companies you worked in, as part of their accounting records.

If you are not satisfied with our answer, you may complain to the competent authority in your country.

15. Children

Orda is a business tool for people aged 18 or over who use it for work. It is not intended for children, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

16. Changes to this policy

We may update this policy when the Service or the law changes. We will change the “Last updated” date above and, for important changes, tell company administrators in the app or by email before the changes take effect.