Privacy Policy
Last updated 6 September 2026
Orderly turns photographed and scanned paperwork into spreadsheets. That means you hand us documents — receipts, invoices, bank statements — that say a lot about you or your clients. This page explains exactly what happens to them.
The short version. We keep your documents for 30 days so you can come back to a batch, then they are deleted automatically. We send them to Anthropic to be read, and to nobody else. Neither we nor Anthropic use them to train AI models. We do not sell data, and there is no advertising on this site.
Who we are
Orderly is operated from Australia and is bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Contact: privacy@orderly.page.
What we collect
| What | Why |
|---|---|
| Your email address | It is your account. We have no passwords — signing in means clicking a link we email you, so the address is the login. |
| The documents you upload | To read them and return the data. This is the service. |
| The data extracted from them | To show you the review screen and build your exports. |
| Page counts and processing records | To meter your allowance and to have an accurate record of what you were charged for. |
| Your IP address | Rate limiting and abuse prevention only — stopping one person from creating unlimited free accounts. Kept for up to 30 days. |
There is no analytics script, no advertising network, and no third-party tracker on this site. The only cookie we set is the one that keeps you signed in.
Who your documents are shared with
We use a small number of providers, and each one only receives what it needs:
| Provider | Receives | Where |
|---|---|---|
| Anthropic | The contents of documents you upload, in order to read them | United States |
| Cloudflare | Hosting, file storage and the database | Global edge network |
| Resend | Your email address, to deliver sign-in links | United States |
Uploading a document therefore involves an overseas disclosure, principally to the United States. If that is not acceptable for the documents you handle, please do not upload them.
Anthropic does not use data submitted through its API to train its models, and deletes it within 30 days. We do not sell, rent or share your documents or your extracted data with anyone else, and we will not start without asking you first.
Support access
We do not read your documents as a matter of course, and we never log their contents. If you contact us about a specific problem, we may need to look at the document involved to diagnose it — we will ask you before doing so.
How long we keep things
| Data | Kept for |
|---|---|
| Uploaded documents | 30 days from upload, then deleted automatically |
| Extracted data and review edits | Until you delete the batch or close your account |
| Account and billing records | As long as your account exists, then as required by Australian tax law (generally five years) |
| IP addresses used for rate limiting | Up to 30 days |
Closing your account deletes your documents and extracted data. We keep the minimum billing record the law requires us to keep.
How it is protected
- Everything is served over HTTPS.
- We store no passwords at all. Sign-in links are single-use, expire in 15 minutes, and are stored hashed, so even our own database cannot be used to log in as you.
- Files are stored under a prefix specific to your account, and every request for a document checks that it belongs to you.
- Document contents are never written to our logs.
No system is perfectly secure. If a breach occurs that is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.
Your rights
You can ask us to give you a copy of the personal information we hold about you, correct it, or delete it. Email privacy@orderly.page and we will respond within 30 days.
If you are unhappy with how we have handled your information, you can complain to us first, and then to the Office of the Australian Information Commissioner at oaic.gov.au.
Children
Orderly is a business tool and is not intended for anyone under 16. We do not knowingly collect information from children.
Changes
If we change this policy in a way that materially affects you, we will email you before it takes effect. The date at the top always reflects the current version.