Privacy policy
Who we are
Ordavena (ordavena.app) is a management tool for freelancers, micro-businesses and small companies, published by Renaud Patris, sole trader (natural person) trading as Red Panda Studio, registered with the Belgian Crossroads Bank for Enterprises under number 1043.832.341 (VAT BE 1043.832.341 — establishment unit 2.395.215.357), Rue Entre-Deux-Portes 108, 4500 Huy, Belgium. The publisher is the data controller for your account, subscription and browsing data. Questions about your data: privacy@ordavena.app.
Data processed and purposes
We process your account data (email, name), the management data you enter (customers, contacts, quotes, invoices, payments, receipts), technical and audit logs, and your subscription and billing data. Each category is used only for the corresponding purpose: providing the service, securing the platform and meeting our legal obligations. Subscription payments are processed by Mollie B.V. (Netherlands), a payment institution acting as a separate controller for payment data: Ordavena neither receives nor stores your card or account numbers (Mollie’s privacy notice: https://www.mollie.com/en/legal/privacy). When you subscribe from another Member State, your VAT number is checked with the European Commission’s VIES service. Messages sent through the contact form (name, email, company, message) are used only to answer you and kept for as long as it takes to handle your request.
Legal bases
Processing relies on performance of the contract (account, billing), on our legitimate interest (security, traceability, abuse prevention) and on our legal obligations (accounting, VAT). For the management data you enter about your own customers, you are the controller and Ordavena acts as processor.
AI assistance
The daily brief and the assistant send excerpts of your management data to an AI provider for drafting and analysis. Amounts are always computed by Ordavena, never by the AI; no sensitive action runs without your explicit confirmation; every action is logged. Your data is never used to train models.
Security of your data
Each company is isolated in its own space, at the heart of the database. Exchanges are encrypted in transit (TLS), documents are stored under private object keys, and every access — including our support interventions — is logged and visible in your activity log. Data is backed up every six hours, in encrypted form, to a volume separate from the database; backups are kept for 35 days and restoring them is checked automatically every day.
Cookies
Ordavena uses only strictly necessary cookies (login session). No advertising cookies or third-party trackers — hence no consent banner to click.
Retention periods
Management data is kept while your account exists. The account owner can request deletion from the settings: after a 30-day grace period (during which the request can be cancelled and export remains available), the data is deleted, and disappears from backups at the latest 35 days later. Legal retention of your own accounting documents is your responsibility: the full export (CSV and archive) lets you meet it before deletion. We keep our own subscription billing records for the legal period that applies to us.
Hosting and subprocessors
Your data is hosted in the European Union on an OVHcloud dedicated server (Roubaix, France), backups included. Transactional emails (reminders, notifications) are sent from our own infrastructure. Our sub-processors are: OVHcloud SAS (hosting and backups, France) and Mistral AI SAS (AI assistance and receipt reading, European Union). Any change to this list is announced 30 days in advance.
Transfers outside the European Union
Your data is hosted and processed in the European Union. Hosting is provided by OVHcloud (France) and AI assistance by Mistral AI (France) through its European endpoint. We do not ourselves transfer your data outside the European Economic Area; any access by Mistral AI’s own sub-processors (security, network) is covered by its DPA.
Your rights
You have the rights of access, rectification, erasure, portability, restriction and objection. In practice: you export your data at any time (CSV and a full archive, even after cancellation); the account owner can request deletion from the settings. To exercise a right, write to privacy@ordavena.app. You may also lodge a complaint with your supervisory authority (APD in Belgium, CNIL in France).
Changes to this policy
This policy may evolve with the product and the regulation. Any significant change is flagged on this page and, where relevant, by email. The date of the last update appears below.
Last updated: 21 October 2026. Questions: privacy@ordavena.app.