Privacy policy

This policy explains what information OrderFlow handles when you use its free tools, when a business uses an account, and when a business's customer opens a tracking page, and the choices each of them has. OrderFlow is operated by VertiTech Innovations, LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, United States ("we", "us"), which is responsible for this information.

The short version

• The tools run in your browser. What you type into them and the images you add are not sent to us.
• The forms and the demo save nothing: reloading or closing the page clears them. The job tracking template saves your sheet in this browser, on your device, and nowhere else.
• Businesses can create an account to track orders and share a private link with their customers. We keep that data to run the service.
• A customer who opens a tracking link does not need an account. We show them only what the business chose to share.
• We use Google Analytics to count visits and tool usage. It never receives anything you type or attach.
• We do not sell your personal information, show ads, or use advertising cookies.

The free tools

• The artwork approval form and the custom order form template keep what you type only in the open page.
• The job tracking template saves your sheet in your browser's local storage on this device, so it is still there when you come back. It is not sent to us. Select Clear this device on that page to delete it, or clear this site's data in your browser.
• The order tracking demo uses invented data and keeps your clicks and messages only in the open page.
• Proof images you add are read by your browser and shown on your own device. They are not uploaded.
• The printed page or PDF is created by your browser's own print function.
• Besides the job tracking sheet, the only thing this site stores in your browser is your cookie choice, described under Analytics.

Business accounts

When a business creates an account we keep:

• The account holder's email address, to send sign-in codes. There are no passwords.
• The business details: its name, industry, time zone and the contact email and phone it chooses to show its customers.
• The business's customers: name, email address, phone number and private notes the business writes about them.
• Orders: title, stages, estimated date, notes for the customer, private notes, updates and the history of who changed what and when.
• Sign-in sessions: a random identifier in a cookie that only this site can read. We keep a one-way hash of the IP address for at most an hour to limit abuse.

This data is stored in a MongoDB Atlas database, and sign-in emails are sent through Resend.

Who is responsible for customers' data. The business decides which of its customers to add and what to write about them. For that information the business is responsible towards its customers, and we process it on the business's behalf to run the service. We do not contact a business's customers for our own purposes.

Keeping and deleting it. The data stays while the account exists. In Settings, the business can download all of it and delete the business or the whole account at once.

Tracking pages for a business's customers

A tracking page opens from a private link the business shares. It shows the business's name and contact, the order's title, stages, estimated date, the note the business wrote for the customer and the updates it posted. It never shows the business's private notes, internal history or the customer's contact details.

Emails to a business's customers. When the business publishes an order, sends the link or moves the order on, we email its customer a short notice: the business's name, the order number, where the order is now and a button to the tracking page. The email never repeats updates, messages or notes. Changes made within a few minutes are grouped into one email. We keep a record of each email (when it was sent and whether it worked, not its content) for 90 days.

Messages and the code. To read or send messages on a tracking page, the customer asks for a 6-digit code, which we email to the address the business has for them. Entering it keeps that browser confirmed for that order for 30 days, using a cookie that only this site can read. Messages are kept with the order, and the business gets an email saying a message arrived, without its text.

Photos. A business can post photos of its work on an order. Before a photo leaves the business's device, the browser makes a smaller copy and removes the camera details and location stored in the file. Photos are kept in private storage on Vercel Blob, never at a public address: each page that shows them gets links that stop working after 15 minutes, and anyone who has the tracking link can see the photos posted on it. A photo stays while its order exists; when the business removes it, or deletes the order or the business, it is deleted from storage within a few minutes.

Proof approvals. A business can ask its customer to approve images of a proof. Proof images are kept like photos. To approve or ask for changes, the customer first confirms the 6-digit code described above. For each decision we keep the version, the decision, any comment, the time, the customer's email address with most of it hidden, and a one-way hash of the full address. We also keep the IP address and browser description (user agent) of the decision for 12 months, so the business can look into a disputed answer; after that we delete them and keep the decision. The business and its customer see this history on the order; it records who answered from a confirmed email address, and it is not an electronic signature.

When a tracking page is opened we record the time and a count of visits, so the business can see that its customer opened it. We keep a one-way hash of the IP address for at most an hour to limit abuse. Tracking pages do not use Google Analytics. Their only cookie is the one set after a customer confirms the code. The link works for anyone who has it until the business replaces it or turns it off.

When you email us

If you write to [email protected], we receive your email address and whatever you include in the message. We use it only to reply and to follow up on your request, and we delete it when it is no longer needed for that conversation.

Hosting

The site is hosted by Vercel. Like any web host, Vercel processes technical request data such as IP addresses to deliver pages and protect the service.

Sharing and selling

We share information only with the service providers named on this page (Google for analytics on public pages, MongoDB for the database, Resend for email and Vercel for hosting and photo storage), and only for the purposes described here. We do not sell personal information and we do not share it for cross-context behavioral advertising.

Where information is processed

We are based in the United States, and our service providers may process information in the United States and other countries.

Your rights

Depending on where you live, you may have the right to ask what personal information we hold about you, to correct it, or to delete it. To make a request, email [email protected]. We may need to verify your identity before acting on it. We will not treat you differently for making a request.

Children

OrderFlow is meant for working adults and is not directed to children under 13. We do not knowingly collect information from children.

Analytics

We use Google Analytics 4, provided by Google LLC, to understand how many people visit, which pages and tools they use, and whether the tools work.

Google Analytics collects:

• pages viewed, the referring site, and the time of the visit;
• device and browser type, screen size, language, and approximate location (city or region) derived from your IP address;
• a small set of events, such as "tool started", "export completed" or "validation error", and which of our buttons you selected, with categorical details only: which tool, which form variant or page size, and the name of the form field that had an error.

Events never include what you type or attach: no names, jobs, specifications, notes, dates, email addresses, file names or images.

Google Analytics uses first-party cookies (named _ga and _ga_ followed by an identifier) to recognize a returning browser. Google Analytics 4 does not log or store full IP addresses. Advertising features, Google signals and ads personalization are turned off, and advertising storage is always denied.

Visitors in the European Economic Area, the United Kingdom and Switzerland. Analytics cookies are off by default, and a banner asks whether you accept them. Until you accept, Google may receive only cookieless measurements that do not identify your browser.

Visitors elsewhere. Analytics cookies are on by default.

Your choice. Use Cookie settings at the bottom of any page to accept or reject analytics cookies at any time. We remember your choice in your browser's local storage, not in a cookie. If you reject them, Google may still receive cookieless measurements that do not identify your browser.

Global Privacy Control. If your browser sends a Global Privacy Control signal, analytics cookies are turned off unless you accept them in Cookie settings.

Other ways to opt out. You can block or delete cookies in your browser settings, or install Google's Google Analytics opt-out browser add-on. Google explains how it uses data from sites that use its services in its own policy.

We keep Google Analytics event data for 14 months.

Changes

If this policy changes, we will update this page and the review date shown on it.

Contact

VertiTech Innovations, LLC
131 Continental Dr, Suite 305, Newark, DE 19713, United States

Email: [email protected]