Privacy Policy

1. Information we handle

• Account information. Your email, account ID, profile, and age declaration.
• Workspace content. Prompts, messages, uploads, connected content retrieved for your requests, answers, task outputs and preferences. These may contain personal information about you or others.
• Connection information. Connected provider and account details, permissions, connection settings, and credentials such as OAuth tokens or API keys you provide.
• Billing information. Your plan, credit purchases, payment and refund records, and transaction references. Payment providers process your payment information.
• Service records. Usage, credits, task and error logs, security events, and technical request data needed to operate, protect and troubleshoot Ordeum. We also handle information you send to support.

We use this information to run your account and workspace, perform requested work, handle usage and billing, provide support, protect Ordeum against security threats and abuse, and meet legal obligations.

2. AI processing, human access and sharing

Automated processing

We process prompts, responses, uploads and connected content automatically. Staff must not routinely browse, sample or annotate personal conversations, or access content for purposes unrelated to providing and protecting Ordeum.

Relevant prompts, context, files and tool results may be sent to the AI and technical providers handling your request. Safety providers may process content for automated checks, including moderation. Processing may occur outside your country, including outside Singapore. Section 7 also applies.

Conversations, files and outputs may be saved for history, ongoing work and requested features (see section 3).

Limited human access

Staff access is limited to support with your explicit permission, necessary investigation of specific security incidents, fraud or abuse, or legal requirements. A support request does not permit access to unrelated conversations or files.

Such access must be authorized and recorded, kept confidential, and limited to the people, content and time required.

Security review with a limited purpose

Automated checks use requests, content and activity records to protect accounts and detect abuse. Reviews use technical logs, risk signals and redacted information where sufficient; original content is accessed only for that security purpose.

Automated safeguards help detect sensitive information and can flag or pause risky actions before they run. They reduce risk but may not catch every case.

Service providers and sharing you choose

Connecting to an external service may send it the information needed for your action. Review the destination and permissions first. That service's privacy terms and section 7 apply.

Hosting, storage, payment, safety, security and support providers process information needed to operate Ordeum. Data use and retention follow each service's terms and agreement with us; AI providers may retain data under those terms. Section 7 also binds recipients of the relevant data.

Authorized recipients can access what you share. Subject to the limits above, we may disclose information when legally required or necessary to address a specific threat to users or the service. Share only content you are authorized to share, including under your organization's confidentiality rules.

3. Retention, disconnection and deletion

Saved conversations, files and outputs support history, ongoing work and requested features, subject to our retention practices and deletion requests. Temporary files and operational records may have different lifetimes. We delete or anonymize personal information when no longer needed for these purposes or legal or legitimate business needs.

Security, billing and legal records remain while needed for their purposes. Deleted content may remain in backups until they are deleted or overwritten. Deletion does not automatically remove copies shared with others or records independently held by external services.

Disconnecting a service in connector settings removes stored connection credentials and stops further access. It leaves content already saved in Ordeum or the source service. Delete relevant conversations or files, or contact support for broader removal.

To request account deletion or broader data deletion, email support@ordeum.ai from your account email. We may verify ownership and will explain what must be retained and why. Do not send passwords or access tokens.

4. Security and site technologies

Access controls, HTTPS for our public services and encrypted connector-credential storage help protect your information. Report suspected unauthorized access to support promptly.

Cookies and browser storage support sign-in, security, language and appearance. Cloudflare services may process technical request data for security and aggregate performance measurement.

5. Your choices and requests

You can manage connections, revoke access and delete workspace content. Local law may also give you rights to access, correct or export information, restrict or object to processing, or complain to a privacy authority. Send requests to support@ordeum.ai; we assess them under applicable law.

You can withdraw consent-based processing by contacting support. We will explain any effects on features and information we must retain by law.

The service is for users aged 18 or older, subject to higher local minimums. We record self-declared age and declaration time, without identity verification in this age check. Under-18 declarations prevent access. Contact us for corrections or deletion of underage account data.

6. Changes and contact

We update this policy and its date as practices change. Material changes are announced through the service or appropriate account contact channels.

Questions: support@ordeum.ai. See also our Terms of Service.

7. Google sign-in, connections and Limited Use

Google sign-in

Google sign-in supplies basic profile information, such as your name, email and photo, to create or access your account. It does not grant Gmail or Drive access. Google handles password entry; Ordeum never receives your Google password.

Optional Gmail and Drive connections

Gmail and Drive connectors are not currently offered for new connections. If made available, they are optional and require separate authorization; availability and requested permissions are shown when connecting. The terms below apply to any existing connection and to Google user data retained from earlier connections.

• Gmail. With authorization, Ordeum searches and reads message headers and bodies to find information, summarize or answer questions. Agent can send plain-text email after you review and approve the recipients, subject and body. It cannot delete messages or change mailbox settings.
• Google Drive. With authorization, Ordeum searches files and reads metadata, supported content or exports for summaries, analysis and questions. With additional file access, Agent can create and update supported text files created by Ordeum, following your conversation approval settings. It cannot share or delete Drive files.

Search and read permissions may cover multiple files or messages. Retrieved content serves your requested features; relevant material may reach the AI provider and appear in conversations or outputs. Google content saved in conversations or outputs is retained and deleted as described in section 3.

Google data and Limited Use

Ordeum follows the Google API Services User Data Policy, including its Limited Use requirements, and the Google Workspace API User Data and Developer Policy for Google Workspace data.

• We use Google user data only to provide or improve the user-facing features you request. We do not sell this data or use it for advertising, creditworthiness or lending decisions.
• We do not use Google user data, or content derived from it, to train, retrain or improve generalized AI or machine-learning models.
• Transfers of Google user data are limited to providing or improving those features, with your consent where required, or the security, legal and business-transfer exceptions allowed by Google’s policies. These restrictions also apply to recipients processing the data for us.
• People do not read Google user data unless you specifically agree to access particular data, access is necessary for security or legal compliance, or another exception expressly permitted by Google’s Limited Use rules applies.

New uses of Google user data require disclosure and consent under Google’s policies. Connected Gmail and Drive content is not used for advertising analytics.

Disconnecting Google services

Disconnect in connector settings to remove stored credentials and prevent further access through that connection. You can also revoke permission in your Google Account’s third-party connections. Reconnecting requires authorization again.

Disconnection leaves original Gmail messages and Drive files intact. It also leaves saved Ordeum conversations, outputs and shared copies. Delete the relevant conversations or files, or ask support to remove retained connected data.