Privacy Policy

Document version: 2.2 · Effective date: 29 September 2026
Previous version: 2.1, effective 24 September 2026

This Privacy Policy (the “Policy”) describes how Individual Entrepreneur Abrarov Fail Faritovich (the “Operator”, “we”) collects, uses, stores and protects the personal data of users of the Ordio CRM service (the “Service”), available through the web version (ordio.ru) and the mobile applications for iOS and Android.

1. Personal data operator

Individual Entrepreneur Abrarov Fail Faritovich.

OGRNIP is the Russian State Registration Number of an Individual Entrepreneur; INN is the Russian Taxpayer Identification Number.

2. Consent to data processing

By registering with the Service, you confirm that you have read this Policy, the Terms of Servicein Russian and the Consent to the Processing of Personal Datain Russian, and you consent to the processing of your personal data on the terms set out in them.

3. What data we collect

3.1. Registration and account. Username, email address, password (stored in encrypted form), email confirmation status.

3.2. Email confirmation. After registration, access to the Service is allowed immediately. A message with a confirmation link is sent to the email address you provided. If the email is not confirmed within 3 days, sign-in is blocked until it is confirmed. The message can be requested again.

3.3. Password recovery. When password recovery is requested, a link for setting a new password is sent to the email address.

3.4. Organization data. Company name, invitation code, details used for documents (INN, OGRN, legal address, bank details, the director’s full name), if you have provided them.

3.5. Working with orders. The client’s full name, phone number and address, a description of the item, the status and deadlines of the order, comments and correspondence within the order.

3.6. File uploads. Files and photographs attached to an order (drawings, measurement photos and so on); images are compressed automatically to save space in the organization’s storage.

3.7. Activity log. For our own technical needs we keep a log of key actions: signing in, opening sections (orders, calculators), creating, cancelling and completing an order, time spent in a section, the IP address and the user agent of the device or browser. The log does not contain the personal data of the clients in your orders (phone numbers, addresses and order amounts do not go into it) and is accessible only to the administrator of the Service.

3.8. Product event log. Separately from the activity log, we record depersonalised usage events: the event type, the platform, the application version, the device model, the operating system version, a session identifier, and referral tags (UTM) if you arrived through a link carrying them. The IP address is not stored in this log — only an irreversible hash of it is recorded, from which the address cannot be recovered. The log is not transferred outside the Service and is not used for advertising.

3.9. Web server logs. Like any web server, our server keeps a technical log of requests: the IP address, the date and time, the requested address, the response code and the user agent. These logs are needed for diagnosing failures and protecting against abuse, and are kept for no more than 14 days, after which they are deleted automatically.

3.10. Document signing. When a contract or an acceptance certificate is signed, the signature record retains the signatory’s full name, the image of the signature, the date and time, the IP address and the user agent of the device. This is part of the evidentiary trail of the signing and is kept together with the signed document.

3.11. Push notifications. The device identifier (push token) — for delivering notifications about events in orders: a new order, a chat message, a new file, a status change, a completed measurement. On iPhone, notifications are delivered through the Apple Push Notification service; on Android, through Google Firebase Cloud Messaging. The push token is used only to deliver notifications, is not used for advertising or tracking, and is deleted together with the account.

3.12. Technical data. Device type, operating system version.

4. How we use the data

• To provide the order management, document handling and organization file storage features
• For registration, email confirmation and password recovery
• To send push notifications about order statuses
• For technical support and for replying to enquiries sent through the “Write to us” form
• For the operation of organizations (employee records, storage limits)
• We do not sell your data to third parties
• We do not use the data for advertising

5. No advertising and no third-party analytics

The Service does not use Yandex.Metrica, Google Analytics, Firebase Analytics, Amplitude, advertising pixels, third-party tracking SDKs or any other third-party analytics. The only collection of behavioural data is our own logs (see clauses 3.7 and 3.8), accessible only to the owner of the Service, not transferred outside it and not used for advertising.

6. Data storage

User data is stored on servers located in the territory of the Russian Federation. We take technical measures to protect the data against unauthorised access.

7. Transfer of data to third parties

• Apple Inc. — for sending push notifications to iPhone through APNs (the device push token and the text of the notification are transferred: the name of the employee who performed the action, the order number and, depending on the event, the new order status or the name of the uploaded file)
• Google LLC — for sending push notifications to Android through Firebase Cloud Messaging (the device push token and the text of the notification are transferred: the name of the employee who performed the action, the order number and, depending on the event, the new order status or the name of the uploaded file). No other Firebase or Google services, including analytics, are used
• The hosting provider — for the technical hosting of the Service’s servers in the territory of the Russian Federation
• The email provider — for delivering address confirmation messages, password recovery messages and replies to enquiries; the recipient’s address and the contents of the message are transferred

There are no other third parties that receive access to your data.

8. Responsibility for client data

The user is responsible for having lawful grounds for entering the personal data of their own clients into the Service.

9. Document templates

The application provides templates of contracts and acceptance certificates for informational purposes only. Individual Entrepreneur Abrarov Fail Faritovich is not a law firm and bears no responsibility for the legal correctness of the documents produced. Before signing, it is recommended that you consult a qualified lawyer.

10. Your rights

• To request access to your data
• To demand correction or deletion of the data
• To delete your account and all personal data associated with it

Send requests to: info@ordio.ru

11. Account deletion

An account can be deleted by you, without contacting support — in the mobile application, under “Profile” → “Delete account”, confirmed with your password. When an account is deleted, personal data (username, email, password, profile) is deleted; orders and files belonging to the organization are retained as organization data in depersonalised form, as they are the working data of the business rather than the personal data of the user being deleted. If you are the sole owner of an organization that holds data of other employees, you will first need to transfer ownership or delete the organization.

12. Children

The Service is not intended for persons under 18 years of age.

13. Changes to the Policy

We will notify you of material changes through the application or by email.

14. Contacts