Orden OS (“Orden,” “we,” “us”) provides a salon-suite management platform for owners and the providers who lease space from them. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have.
1. Who this applies to
This policy covers two kinds of users:
- Owners — salon-suite operators who sign up directly at useorden.com/signup.
- Providers — independent professionals (stylists, estheticians, etc.) invited by an owner to claim a profile in that owner’s directory.
2. Information we collect
Information you provide directly:
- Account credentials: email and password (passwords are stored as bcrypt hashes; we never see or store your plaintext password).
- Profile information: name, phone, birthday, anniversary, business name, specialty, license/booth fee, photo, and any custom fields the owner configures.
- Onboarding documents and contracts: files providers upload to complete onboarding tasks (e.g. ID, signed agreements, certifications).
- Calendar entries: events you create, including titles, dates, and any linked profile references.
Information we collect automatically:
- IP address, used for rate limiting login and signup attempts.
- Session cookies, used to keep you logged in (we don’t use third-party tracking cookies or analytics cookies).
- Failed login attempts and account lockout state, used for security.
- Server logs, including request timing and errors, for debugging and abuse detection.
3. How we use your information
- To provide the service: authenticate you, render your dashboard, store and serve files you upload, send transactional email (account creation, invites, password resets, lockout notifications).
- To secure the service: rate limit, detect brute-force attempts, lock accounts after repeated failures, isolate data between companies.
- To communicate with you: respond to support inquiries, send service updates if relevant.
- To comply with law: respond to lawful requests, enforce our Terms of Service.
We do not sell your personal information. We do not use your data to train AI models. We do not show you ads.
4. Multi-tenant isolation
Every record in Orden is scoped to a company (one owner’s salon). Users belonging to one company cannot read or modify data belonging to another. This is enforced at the API layer on every request.
Within a company, owners can see all provider profiles and onboarding documents. Providers can see their own profile and the documents the owner has shared with them. This is by design — it’s how the salon-suite relationship works — and it’s explained in onboarding.
5. Service providers we share with
We use a small set of third-party services to operate Orden. We share only what each one needs:
- Resend (transactional email) — receives recipient email address, name, and message content for invites, password resets, and lockout notifications.
- YokeDev (hosting and managed infrastructure) — runs our application servers and database. All your data lives on infrastructure they manage on our behalf.
- YokeDev Object Storage (file storage) — stores photos, onboarding documents, and contracts. Files are served only through our authenticated API (not via public URLs).
Each of these vendors has its own privacy practices. We rely on their security and terms.
6. Security measures
- Passwords stored as bcrypt hashes (12 rounds).
- HTTPS enforced for all traffic in production.
- Session cookies are HTTP-only and secure-flagged.
- IP-level rate limiting on login and signup.
- Per-account lockout after repeated failed login attempts, with email notification.
- Server-side validation of all uploads (file type, size, content).
- Tenant isolation enforced on every API request.
No system is perfectly secure. If you discover a vulnerability, please report it to [email protected].
7. Data retention
We keep your data while your account is active. If you close your account, we delete your personal information within 30 days, except where we’re required to retain it for legal, accounting, or fraud-prevention reasons. Backups containing data may persist for up to 90 days after deletion before they roll off.
8. Your rights
You can:
- Access the personal information we hold about you (most of it is visible in your profile and dashboard).
- Correct inaccurate information by editing your profile, or by contacting us if you can’t edit it directly.
- Request deletion of your account and the personal data tied to it.
- Request a copy of your data in a portable format.
To exercise any of these, email [email protected] from the address on your account.
9. Children’s privacy
Orden is not directed at children under 13. We don’t knowingly collect information from children under 13. If you believe a child has provided us with information, please contact us and we’ll delete it.
10. International users
Orden is operated from the United States. If you use Orden from outside the U.S., your information will be transferred to and stored in the U.S. By using Orden, you consent to that transfer.
11. Changes to this policy
We’ll update this policy as Orden evolves. When we make material changes, we’ll bump the policy version and ask you to agree again the next time you sign in. The current version and effective date are shown at the top of this page.
12. Contact
Questions about this policy or how we handle your data: [email protected].