ORDANE Privacy Policy

§1What this document is

• PV-1. A privacy policy is usually a description of what a company would like to be allowed to do. This one is a description of what happens. Every claim below was written against the site's own source: the pages, the browser script, and the seven server functions behind them.
• PV-2. Most of this document is about what Ordane does not collect. That is not modesty. It is the shortest honest version, and you can verify the largest claims in it yourself in under a minute. §4 tells you how.
• PV-3. Where a processor, a provider, or a platform is not chosen yet, this document leaves a visible gap rather than a comfortable sentence. The gaps block publication until they are filled.

§2Who is responsible for your data

• PV-4. The controller is Ordane Markets Ltd. The jurisdiction of incorporation, registration number and registered address are not specified in this version.
• PV-5. This version does not identify an appointed representative for readers in the European Union or the United Kingdom. Where a representative is required, their identity and contact details must be published here.
• PV-6. Contact for everything in this document, including every request under §10: [email protected]. One address, monitored, no form to fill in.

§3What we collect, and when

Four moments. Nothing is collected outside them.

• PV-7. Visiting a page also produces the ordinary request data every web server receives: your IP address, your browser type, the page, and the time. Our host handles it. We run nothing on top of it. See §4.
• PV-8. We do not collect a mailing address, a date of birth, a tax number, or a card number, because we never ask for them. Open the checkout page and count the fields: there are four, plus an optional code.
• PV-9. We never receive card details. There is no card rail. Payment is made in cryptocurrency, thirteen ways in total: USDT on TRON, Ethereum, BNB Chain, or Solana; USDC on Ethereum, BNB Chain, or Solana; or directly in BTC, ETH, SOL, TRX, BNB, or DOGE. USDT on TRON (TRC-20) is the recommended default. Whichever one you pick, a card number has nowhere to go.
• PV-10. Two different things, and only one of them records anything. The Trader Area demonstration runs entirely in your own browser: no login, nothing stored on our side, and prices generated rather than taken from a market. Close the tab and nothing of it remains, here or there. A purchased account is separate: it runs on the platform named in Terms of Service clause T-29, and that platform records account activity, orders, positions, balances, and the login metadata required to operate and audit a simulated account. Ordane reads that data to apply the published rules in the Rulebook and to answer a dispute about them, and for nothing else.

§4Cookies, analytics, and local storage

• PV-11. Necessary storage and optional tracking are separate. Authentication may use a session cookie to keep your account signed in — this is Security storage in PV-22, and it has no switch because the site needs it to operate. Optional tracking is split into five categories, each with its own switch (PV-22); all five run by default. Since 23 September 2026 the site no longer shows a consent card, so there is no in-page control to decline them; a choice recorded before that date is still honored, and PV-13 explains how to opt out now. The Intercom support chat is not part of that choice: it is described separately in PV-16b and is not affected by declining any category.
• PV-12. Ordane Pulse is our first-party measurement, gated by the Analytics storage category. Browser page and journey events are sent to /api/pulse by default, unless you decline that category. The server records limited page, campaign, device and country metadata. It derives a short-lived visit key from request data; this is not a permanent identity. Order and payment records required to operate your purchase are separate from optional browser analytics.
• PV-12a. Google Analytics 4 is gated by the Analytics storage category and runs by default. It receives page views and selected journey events, such as offer selection and checkout steps. Declining that category blocks further events from our integration.
• PV-12b. Meta Pixel and Conversions API are gated by two separate categories. Ad storage controls whether the browser pixel loads and measures page views and checkout activity at all; by default it does. Ad user data controls whether our server sends checkout and confirmed-payment events — your email and phone hashed, with an order-based event identifier for deduplication — to Meta's Conversions API; by default it does. Meta processes this data under its own privacy policy: Meta Privacy Policy. We do not send a completed-purchase event merely because a payment page opened.
• PV-12c. Microsoft Clarity is gated by the Analytics storage category and runs by default. It records clicks, scroll depth, and a replay of the visit so Ordane can see where the site fails. It writes the first-party cookies _clck and _clsk on your device. Name, email, and phone fields on checkout are masked and are not sent as readable text. Clarity is not wired to ads. Microsoft Corporation processes this data. Declining that category stops Clarity, and it does not load again on that browser.
• PV-12d. Ad personalization is its own category, separate from whether the Pixel loads at all. Declining it does not stop measurement under Ad storage or Ad user data; it puts the Meta Pixel in Limited Data Use (fbq('dataProcessingOptions', ['LDU'])), which restricts Meta's use of what it receives for ad targeting while still allowing the event to be counted.
• PV-12e. Personalization storage remembers the name, email, country and phone number you type at checkout, locally in your own browser, so a second purchase does not require retyping them. It never reaches our server on its own — checkout still sends what you type when you submit an order, exactly as PV-12b describes. Declining this category stops new values from being remembered and clears what was already stored.
• PV-12f. Cart recovery reminders. If you begin checkout but do not complete payment, we may send you one reminder by email and, if you opted in via the checkbox next to the phone field, one by WhatsApp, to help you finish your order. We use Reportana Tecnologia Ltda. as our messaging processor for these reminders. We retain this contact and order data for 30 days, matching our standard checkout retention window (PV-34). You can opt out anytime: reply STOP to a WhatsApp message, or use the unsubscribe link in any email. This is part of Functionality storage (PV-22) and carries no separate tracking-consent switch — it is not analytics or advertising, it is completing the order you started.
• PV-13. Your choice can be checked in the browser. By default, our integration loads Google Analytics, Clarity and Meta Pixel; sends browser Pulse events; sends Meta Conversions API events with your hashed data; lets Meta use that data for ad personalization; and remembers your checkout details locally. Since 23 September 2026 no consent card is shown, so every category runs from your first visit. A choice recorded before that date is still read and still stops that category for that browser. To opt out now, block or delete this site's cookies in your browser settings, or write to [email protected] and we will action the request. Functionality storage and Security storage are not part of this choice — the site needs them to operate, so they carry no switch (PV-22). Cloudflare hosting and its cookieless Web Analytics are a separate infrastructure measurement layer, unaffected by any of this. Existing provider data is not erased retroactively when you decline.
• PV-14. ord_consent_v3 stores your choice locally, one entry per category, as granted or denied; by default no key exists and every category runs. A choice made under the older, single-switch banner (ord_analytics_consent_v2, retired 2026-09-22) is still honored: declining under that banner reads as declining every category here, until you make a new choice on the card. ord_utm_first may keep permitted campaign and click identifiers in session storage for attribution while Analytics storage runs. Declining that category clears this attribution entry. A purchase may retain its consent and attribution snapshot as part of its server-side record.
• PV-15. Decide once, on the card. On your first visit, a card offers "Allow all" and "Let me choose" with equal weight; choosing opens the five categories, each with its own switch, plus "Allow selected". There is no separate control to reopen it afterward — to change your choice, clear this site's data in your browser, which brings the card back on the next visit. You can still use checkout after declining any category.

§5Who receives your data

• PV-16. Our host. The site, the launch list, and the order records run on Cloudflare (Pages, Workers, and Workers KV). Cloudflare processes this data on our instructions and for no purpose of its own.
• PV-16a. Microsoft Clarity. Gated by Analytics storage and on by default, Microsoft Corporation receives click, scroll, and session-replay data from your visit. Microsoft's privacy statement is published at https://www.microsoft.com/privacy/privacystatement. If you decline that category, nothing is sent to Microsoft Clarity.
• PV-16b. Intercom, for support. The support widget loads on every visit, independent of your analytics choice in PV-11: it loads whether you accept or decline optional tracking. It sets its own cookies (intercom-id, intercom-session, intercom-device-id) as soon as it loads, so that it can operate. A conversation shares what you type and technical data needed to run the chat with Intercom. See Intercom Privacy Policy.
• PV-17. The payment intermediary, which receives none of it. Payment is received on Ordane's behalf by its payment intermediary, Gateway (Franca, São Paulo, Brazil; CNPJ 58.516.344/0001-38), into a cryptocurrency wallet owned and controlled by Gateway. No other payment processor is involved. Gateway receives only the transfer into that wallet. No personal data is sent to it: your name, your email, your phone number and your country are never sent to Gateway. To confirm a payment, our server queries public blockchain data services for the network you paid on, and it sends them the receiving address and the transaction identifier, nothing about you.
• PV-18. The identity verification provider, once, at your first withdrawal. Not chosen yet. See §8.
• PV-19. Ordane's typefaces are self-hosted. Font files are served from ordanemarkets.com, so loading them does not send your IP address or browser type to a font provider. Google Analytics and Microsoft Clarity are separate and receive data by default, gated by Analytics storage (PV-22).
• PV-20. Legal authorities, where a law, a regulator, or a court order requires it, including anti-money-laundering obligations. Where we are permitted to tell you, we tell you.
• PV-21. There is no corporate group. Ordane has no parent, no affiliates, and no sister companies, so no data is shared with one.
• PV-22. The seven categories. Five have a real switch, each controlling exactly one thing: Analytics storage (Google Analytics, Microsoft Clarity, Ordane Pulse — PV-12, PV-12a, PV-12c), Ad storage (whether the Meta Pixel loads in your browser at all — PV-12b), Ad user data (whether our server sends your hashed email and phone to Meta's Conversions API — PV-12b), Ad personalization (whether Meta may use what it receives to target advertising, versus Limited Data Use — PV-12d), and Personalization storage (whether your checkout details are remembered locally for next time — PV-12e). Two have no switch, because the site needs them to operate: Functionality storage (checkout continuity and order recovery) and Security storage (your signed-in session, PV-11). Declining any of the five does not prevent purchasing or accessing an account.

§6Automated decisions

• PV-23. One automatic decision exists, and it is the only one. Ordane decides automatically whether a published rule in the Rulebook was breached. Nothing else about an account is decided by a machine: not who may open one, not who is paid, not who is refused. Those rules are numbered, public, and identical for every account, and a breach names the rule, the price and the instant it happened.
• PV-24. A denial has to cite the exact rule by section number, in writing, under G-0. A decision you cannot read is not a decision Ordane is allowed to make.
• PV-25. You can ask a person to review any automatic decision by writing to [email protected]. You get a written answer inside the same deadline as §10.

§7Payments happen on a public ledger

Neither of the documents this policy was drafted against mentions this. It is the single largest privacy fact about paying for an Ordane account, so it gets its own section.

• PV-26. Payment is made in cryptocurrency, on whichever of the networks named in PV-9 you choose. Every one of those networks is a public ledger. The address generated for your order, the amount, the time, and the wallet you paid from are public, permanent, and readable by anyone, with or without Ordane.
• PV-27. We store the receiving address and the transaction id alongside your order, which links your wallet to your name and email in our records. Nobody outside Ordane can make that link from the chain alone. Anyone who already knows your wallet address, by any other route, can see the payment.
• PV-28. We cannot delete anything from a blockchain, and neither can anyone else. Your erasure right reaches what we hold. It cannot reach the ledger. §10 states that limit rather than leaving you to discover it.
• PV-29. If that matters to you, pay from a wallet you do not use for anything else. We would rather tell you before you pay than explain it afterwards.

§8The identity check

• PV-30. Identity verification happens once, at your first withdrawal request. Not at purchase. Not again at every payout. There are no re-verification loops, with one bounded exception: Terms clause T-11 allows a second check only where a legal obligation requires it, named to you in writing, and that second check is still capped by Rulebook clause G-2 like any other review.
• PV-31. The review is bounded by G-2 in the Rulebook, which caps a documented review and states exactly what happens when the cap passes. This document does not restate that deadline: G-2 is its one home, and a number published twice is a number that drifts.
• PV-32. The provider that will run the check is not chosen. Its name, the documents it asks for, where it holds them, and how long it holds them will be published in this clause before the first withdrawal request can be made: not chosen at version 1.0
• PV-33. We do not buy information about you. No data brokers, no enrichment services, no background profiles assembled without your knowledge. What we know about you is what you gave us and what the payment left on the ledger.

§9How long it is kept

• PV-34. The truth as of this version: nothing expires on its own. The launch-list record and the order record are written without an expiry, and no process deletes them today. We write that down instead of claiming data is "securely deleted", because a promise the code does not keep is worse than an inconvenient fact.
• PV-35. A retention schedule, one line per record type with a real number of months against each, will be published in this clause before the first account is sold. The expiry will be set on the record itself, so deletion happens whether or not anyone remembers: not published at version 1.0
• PV-36. Until then, deletion happens when you ask. See §10. We keep only what a legal obligation requires us to keep, for as long as it requires, and we tell you which obligation.
• PV-37. The launch list is one email address and one timestamp. One message to [email protected] deletes it, and there is nothing else attached to it to delete.

§10Your rights, and how to use them

• PV-38. You can ask us to: confirm whether we hold data about you; give you a copy; correct it; delete it; export it in a machine-readable file; restrict or object to a use; or withdraw a consent you gave.
• PV-39. Write to [email protected]. We answer within 15 days. Not "a reasonable timeframe": fifteen days. If a request is genuinely complex and needs longer, we tell you inside those same fifteen days, say why, and give you a date.
• PV-40. No fee, no form, no account required, and no obligation to explain why you are asking.
• PV-41. We may ask you to confirm the email address the record sits under. We will not demand an identity document to exercise a privacy right, with one exception: a request for a copy of verification documents themselves, where handing them to the wrong person is the harm.
• PV-42. Two limits, stated plainly rather than discovered later: we cannot erase a blockchain transaction (§7), and we must keep what a law requires us to keep. Where we refuse part of a request, we say which part and why, in writing.
• PV-43. You can complain to the data protection authority where you live. In Brazil that is the ANPD. Nothing in this document requires you to come to us first, and nothing here waives that route.

§11How it is protected

• PV-44. Every page is served over HTTPS. There is no unencrypted version of any page on this site.
• PV-45. Prices are decided on our server, never in your browser. Editing the page cannot change what you are charged, and no price is trusted from the client.
• PV-46. Keys and secrets live in the host's environment, never in the code and never in a page. No key is ever sent to your browser.
• PV-47. The launch-list form carries a hidden field no human can see. Automated submissions that fill it are discarded and stored nowhere.
• PV-48. What this section does not say: that a breach is impossible, and that we are excused in advance for one. If a breach affects your data we will tell you and the authority, as the law requires, with what happened and what we did about it.

§12Where the data sits, and links out

• PV-49. Our host runs a global network and serves the site from the location closest to you, which means data may be processed outside the country you live in. The legal basis for those transfers is not specified in version 1.0.
• PV-50. The self-hosted font requests described in PV-19 stay on ordanemarkets.com. Our host's global network may still serve those files from infrastructure outside your country, as described in PV-49.
• PV-51. This site links out to third parties, including regulators and news sources cited on the Why Ordane exists page. Those sites have their own policies and we do not control them.
• PV-52. Ordane does not knowingly collect data from children. The minimum age to hold an account is set in the Terms of Service.

§13Changes, and the version that applies to you

• PV-53. A change produces a new version number and a dated line in the changelog below. Nothing changes silently.
• PV-54. "Your continued use is acceptance" is not used here. A change that materially widens what we do with your data is sent to the email address on your account before it takes effect.
• PV-55. Superseded versions stay published, so you can read what changed instead of taking our word for it.
• PV-56. This document, like the Terms of Service and the Refund Policy, exists in English only, and Ordane does not machine-translate any of these three and present the output as binding. The Rulebook is different, and Terms clause T-6 says so rather than leaving you to find out: it is published in eighteen machine-assisted translations as a reading convenience, the English text governs where one differs, and T-6 carries Ordane's dated commitments on that page carrying a visible notice and on a human-reviewed translation. Read T-6 before relying on a Rulebook page that is not in English.
• PV-57. If Ordane's business is ever transferred to another company under Terms clause T-49, your personal data transfers with it, and the acquirer is bound by this Privacy Policy for data already collected under it. A transfer of the business is not a new collection, is not a new purpose, and does not by itself expand what is done with your data.

§14Changelog

§15Contact

Any question, any request, any correction: [email protected].