Scope
This policy covers the OrderSail marketing site (ordersail.com), the merchant dashboard, the storefront and point-of-sale apps, and the API — together, the "Service." It describes what we collect from merchants who run a shop on OrderSail and from their customers ("buyers") who place orders through it.
What we collect
Merchant account data: name, email, business details, and staff you invite to your account.
Buyer & order data, via merchants: when someone places an order on a merchant's storefront, we process the buyer's name, email, and shipping address, and the order/cart contents, on that merchant's behalf.
Payment data: card details go directly to Stripe — we never see or store them. We keep records of the transaction (amount, status, payout) but no cardholder data.
Usage data: standard web server logs (IP address, timestamps, requests) across the Service.
How we use it
To operate the Service: creating accounts, processing orders and payments, arranging shipping, sending transactional email (order confirmations, receipts, account notices), and providing support.
Who we share it with
We share data with the processors that make the Service work:
- Stripe — payment processing and payouts.
- Shippo — shipping labels and carrier rates, which requires full pickup/delivery addresses.
- Amazon Web Services (SES) — sending transactional email.
- Amazon Web Services — hosting for the Service and its data.
We don't sell personal data, and we don't share it with anyone else except to comply with the law or protect the Service from fraud and abuse.
Cookies & similar technologies
The marketing site (ordersail.com) does not currently set any cookies, including for analytics — we haven't added a web analytics tool yet. When we do, this section and our cookie disclosure will be updated before it ships.
The merchant dashboard uses one strictly-necessary, HTTP-only session cookie to keep you signed in. It isn't used for tracking or advertising. Other parts of the Service (the storefront and API) use bearer tokens instead of cookies.
Data retention
We keep account and order data for as long as an account is active, and for a reasonable period afterward for legal, accounting, and fraud-prevention purposes. We're a small team without automated data-aging yet — if you'd like something deleted sooner, contact us (below) and we'll handle it manually.
Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal data, or to object to certain processing. We don't yet have a self-service tool for this — email privacy@ordersail.com and we'll fulfill the request directly. Merchants can already pull their catalog, orders, and customer data through the API at any time.
Children
The Service isn't directed at children, and you must be at least 18 (or the age of majority where you live) to hold an OrderSail account. We don't knowingly collect data from children.
International transfer
OrderSail and its processors are based in the United States. If you're accessing the Service from outside the U.S., your data will be transferred to and processed in the U.S. Merchants who need a formal transfer mechanism for their own compliance can request our Data Processing Agreement (contact below).
Changes to this policy
We may update this policy as the Service changes. We'll update the "last updated" date above, and for material changes we'll make a reasonable effort to notify account owners directly.
Contact
Privacy questions or requests: privacy@ordersail.com, or use the contact page for any other channel.