Privacy Policy

Who we are

Ordaily is an AI-powered executive assistant operated by Josh Macdonald, trading as Ordaily, based in Cape Town, South Africa. This policy explains how we collect, use, store, and delete personal information in compliance with the Protection of Personal Information Act (POPIA), the General Data Protection Regulation (GDPR), and our contractual commitments to customers.

Our Data Protection Officer can be contacted at help@ordaily.ai.

What information we collect

• Account data — name, email address, phone number, business details.
• Email content — when you connect a Gmail or Microsoft account, we read inbox content to triage, summarise, and draft replies.
• Calendar data — events, attendees, meeting titles, when you connect Google Calendar or Outlook.
• Meeting transcripts — when you connect Fireflies or Otter, transcripts are imported, summarised, and stored.
• Contacts — name, email, phone, company, role, last interaction.
• WhatsApp messages — inbound and outbound message content where the WhatsApp Business Platform is enabled.
• Voice recordings — short audio captured for transcription via OpenAI Whisper or ElevenLabs Scribe (not retained after transcription).
• Usage data — feature interactions, API call counts, costs, error logs for service improvement.

How we use it

• To classify, summarise, and draft responses to your emails.
• To prepare meeting briefs, transcripts, and action items.
• To deliver morning briefings combining email, calendar, and news context.
• To send and receive WhatsApp messages on your behalf.
• To provide voice transcription and voice-output features.
• To detect duplicate calendar events, follow-up needs, and research opportunities.
• To improve the service through anonymised usage analysis.

Who we share data with

We share strictly necessary data with third-party processors who operate under their own published privacy policies and data processing agreements with us:

• Anthropic (Claude) — for AI-powered analysis, summarisation, and drafting.
• OpenAI — for voice transcription (Whisper) and synthesis (gpt-4o-mini-tts).
• ElevenLabs — for premium voice synthesis (tier-dependent).
• Meta (WhatsApp Cloud API) — for WhatsApp Business messaging.
• Google — for Gmail, Calendar, Drive integrations.
• Microsoft — for Outlook, Teams integrations.
• Fly.io — for hosting infrastructure.
• Twilio — for SMS / voice fallback channels.
• Fireflies / Otter — for meeting transcript import (only if you connect).
• WHOOP — for wellness data integration (only if you connect).
• PayFast — for South African payment processing.

We do not sell your data. We do not share data with advertising networks or data brokers. All processors are contractually bound to use your data only as needed to perform the agreed service.

Limited Use of Google user data

Ordaily's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Data accessed via Google Workspace APIs (Gmail, Calendar, Contacts, Drive) is never used to develop, improve, or train generalised AI/ML models, nor transferred to others for that purpose. Our use of Google user data is limited solely to providing and improving the user-facing features described in this Privacy Policy.

Ordaily requests only the minimum Google OAuth scopes needed to deliver these features:

• gmail.readonly — to read inbox content for triage, summaries, and drafting context.
• gmail.send — to send the email replies you approve.
• calendar.events — to read and manage your calendar events for briefings and scheduling.
• drive.file — to access only the specific Drive files you create with or open through Ordaily.

You can review and revoke Ordaily's access to your Google Account at any time from your Google Account permissions page.

Where data is stored and for how long

Customer data is encrypted at rest using application-level encryption and stored in a primary database hosted by Fly.io. Backups are encrypted and retained for 30 days. Email, calendar, and meeting data is retained for as long as your account is active. You can request export or deletion at any time.

Voice recordings used for transcription are not retained after the transcript is produced (typically within seconds).

Your rights under POPIA and GDPR

• Right to access the personal data we hold about you
• Right to correct inaccurate data
• Right to request deletion (see our data deletion instructions)
• Right to data portability (export)
• Right to object to processing
• Right to lodge a complaint with the South African Information Regulator at inforegulator.org.za

To exercise any of these rights, email help@ordaily.ai. We confirm receipt within two business days and act within 30 days.

Children

Ordaily is not directed at children under 18. We do not knowingly collect personal information from anyone under 18.

Cookies

We use essential cookies for authentication and session management, and a small number of functional cookies for theme persistence. See our Cookie Policy for the full list.

Changes to this policy

When we make material changes to this policy, we update the “Last updated” date at the top and notify active customers via email at least 14 days before changes take effect.

Contact

Privacy questions: help@ordaily.ai
Data Protection Officer: help@ordaily.ai
General: help@ordaily.ai