Privacy policy

Last updated:

This policy explains, in plain English, what personal data orderdm.ai collects, why, and the choices you have. It is written in line with the General Data Protection Regulation (the EU GDPR and the UK GDPR), the Serbian Personal Data Protection Act (ZZPL) and the California Consumer Privacy Act, as amended by the CPRA. If anything is unclear, email us at orderdm.ai@gmail.com.

1. Who we are

orderdm.ai (“orderdm.ai”, “we”, “our”, “us”) runs the website at orderdmai.com and provides AI agent services and custom solutions to small businesses. For personal data collected through this website, orderdm.ai is the data controller.

Legal entity: ORDERDM.AI LTD, registered in England and Wales under company number 17395660. Postal address: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Privacy contact: orderdm.ai@gmail.com.

2. What this policy covers

This policy covers the personal data we process about visitors to this website and about people who contact us, book a trial or message our assistant.

When our AI agent runs inside a client’s Instagram account, we process the messages of that client’s customers on the client’s behalf, as a data processor. In that case the client is the controller and their own privacy policy applies; our handling of the data is governed by our contract with them. See section 12.

3. Data we collect

a) Data you give us

  • Trial and contact forms: name, email address, phone number, Instagram handle, business type, approximate number of products, approximate daily DM volume and the price estimate from the calculator. The shorter trial sign-up form that our ads link to asks for your Instagram handle, phone number, business type and approximate number of orders per day, and it also passes on the campaign tags from the link (UTM parameters, fbclid).
  • Chat assistant: the messages you type into the chat widget on this website, so that we and our AI provider can reply to you.
  • Booking a call: when you book a call, we send you to Google’s scheduling page; the details you enter there are handled by Google under its own privacy policy, and we receive the booking (your name, email and chosen time).
  • Connecting Instagram: when you connect your Instagram account to orderdm.ai, we receive an access token and basic account details from Instagram (for example, your account ID and username). We store them so that the AI agent can reply to messages and comments on your behalf. You can revoke access at any time in your Instagram settings, or just write to us.
  • Email: if you email us, we keep your message and contact details.

b) Data collected automatically

  • Usage and device data: pages viewed, the page that referred you, approximate location (for example, country), browser and device type, and similar data from server logs.
  • Cookies and similar technologies: see section 4. Analytics and ad measurement only run if you accept them.

We do not intentionally collect special category data (such as health data) or payment card details through this website.

4. Cookies and similar technologies

We use two categories of cookies:

  • Essential: needed for the site to work and to remember your cookie choice. They do not track you and cannot be switched off.
  • Analytics and marketing (optional): Microsoft Clarity and Meta Pixel (Facebook/Instagram), so we can see what is useful and measure how our ads perform. They load only after you click “Accept all” in our cookie banner. You can change your choice at any time via “Cookie settings” in the footer, or by clearing your cookies and using your browser settings.

5. How we use your data, and our legal bases

We use your data to:

  • respond to your enquiry, trial booking or chat message, and set up your trial (legal basis: performance of a contract, or steps taken at your request before entering into a contract);
  • provide, secure, maintain and improve our website and services (legal basis: our legitimate interests);
  • run optional analytics to improve the site and measure how our ads perform (legal basis: your consent);
  • send service messages and, if you opt in, occasional updates (legal basis: consent or legitimate interests); and
  • comply with legal obligations and enforce our terms (legal basis: legal obligation or legitimate interests).

We do not sell your personal data. Meta Pixel, which we use to measure how our ads perform, only loads with your consent.

6. Automated processing and AI

Our chat assistant uses a third-party AI model to generate replies to the messages you send it. It answers questions and can hand you over to a person; it does not make decisions that produce legal or similarly significant effects for you. Please do not enter sensitive personal data into the chat.

7. Who we share data with

We do not sell your data. We share it only with service providers (“processors”) who help us run orderdm.ai, under contracts that require them to protect it and to use it only on our instructions:

  • Web3Forms: delivers form submissions to us.
  • Google: email (Gmail), appointment scheduling and video calls (Google Calendar / Meet).
  • Microsoft Clarity: insights into how the site is used, such as heatmaps and session recordings (only with your consent).
  • Meta (Meta Pixel): measuring the performance of our Facebook/Instagram ads and conversions (only with your consent). Meta also processes this data for its own purposes, under its own privacy policy.
  • Workflow and AI providers: we use n8n to route chat messages to an AI model provider that generates the replies, and to handle Instagram account connections.
  • Cloudflare: hosting and delivery of this website.

We may also disclose data where the law requires it, to protect our rights and safety, or in connection with a business transfer such as a merger or acquisition.

8. International data transfers

We are based in the United Kingdom, and some of our providers operate outside the UK, including in the European Union and the United States. This means your data may be transferred to countries whose data protection laws differ from those of your own country. Where required, we rely on appropriate safeguards such as standard contractual clauses.

9. How long we keep your data

We keep form and email messages for as long as we are in contact with you and for up to 24 months afterwards, then delete or anonymise them. Chat transcripts are kept only as long as needed to reply to you and improve the assistant. Analytics and ad measurement data is kept according to the providers’ default retention periods (Microsoft and Meta). We keep some records for longer where the law requires it.

10. How we protect your data

We use encryption in transit (HTTPS), access controls and vetted providers. No method of transmission or storage is completely secure, but we work to protect your data and to notify you and the relevant authorities of a data breach where the law requires it.

11. Your privacy rights

If you are in Serbia, the European Economic Area or the United Kingdom, you have the right to access, correct or delete your data, to restrict or object to its processing, to data portability, and to withdraw your consent at any time (this does not affect processing already carried out). You also have the right to lodge a complaint with a data protection authority: in the UK, the Information Commissioner’s Office (ico.org.uk); in the EEA, the authority in your country; in Serbia, the Commissioner for Information of Public Importance and Personal Data Protection.

If you are in California, you have the right to know what personal information we collect and why, to access and delete it, to correct it, and to opt out of the “sale” or “sharing” of personal information. Note that we do not sell your personal information. Meta Pixel, which may count as “sharing” under the CCPA/CPRA, only runs if you accept cookies, and you can switch it off at any time via “Cookie settings”. We will not discriminate against you for exercising your rights.

To exercise any of these rights, email orderdm.ai@gmail.com. We will verify your request and respond within the time the law requires: one month under the GDPR, 30 days under the Serbian Personal Data Protection Act (ZZPL) and 45 days under the CCPA. You may use an authorised agent where the law allows.

12. Data we process for our clients

When our AI agent runs inside a client’s Instagram account, we act as a processor on that client’s documented instructions and process their customers’ messages only to provide the service. If you have messaged a business that uses orderdm.ai and want to access or delete your data, please contact that business (the controller), and we will help them respond.

13. Children’s privacy

This website and our services are not intended for children under 16, and we do not knowingly collect their personal data. If you believe a child has given us their data, email us and we will delete it.

14. Third-party links

Our website links to third-party services (such as Instagram and Google). Their handling of data is governed by their own policies, not this one.

15. Changes to this policy

If we make material changes, we will update the “last updated” date above and, where appropriate, notify active clients. Please check back from time to time.

16. Contact

For any question, request or complaint about privacy: orderdm.ai@gmail.com.