Privacy Policy

Last updated October 18, 2026

1. Who we are and what this covers

Forth Holdings LLC, doing business as OrderCard ("OrderCard", "we", "us" or "our"), provides a card vault for businesses. This policy explains how we handle personal information on our website (ordercard.io), our dashboard (app.ordercard.io), our documentation (docs.ordercard.io), our API and payment form, and when you contact us or use our support.

We play two different roles:

• For our own users and contacts, such as people who visit our website, contact us, or use the dashboard on behalf of a business, we decide how personal information is used. Most of this policy is about this role.
• For the businesses that use OrderCard ("merchants"), we store their customers' card and contact details and process their payments as their service provider, only on their instructions. Section 3 describes this. The merchant's own privacy notice explains how the merchant uses that information.

2. Information we collect about you

When you contact us

When you ask about OrderCard through our contact form, we collect your name, work email address, phone number, company website, company size, country, expected payment volume and your message. The form sends this to our team by email. It is not stored in our application.

Account information

Accounts are created by invitation. When you create one, we collect your name, email address and password. We store your password only as a one-way hash, and we keep hashes of your last four passwords so that they cannot be reused. You can add a phone number, which we plan to use for text message alerts. We also keep your workspace memberships, your role in each workspace, your notification choices, and your timezone and date format.

Sign-in and security information

To keep accounts secure, we collect:

• your second factor: an authenticator app secret (stored encrypted), the public part of any passkeys, or one-time email codes (kept only as a hash, for 10 minutes);
• sign-in times, failed sign-in attempts (including the email address entered), and account locks;
• the devices you sign in from (browser and operating system, IP address and when each was last used), so we can alert you when a new device signs in; and
• your active sessions (browser and IP address), which you can review and end from your security settings.

When you choose a password, we check it against known breached passwords using the Have I Been Pwned "Pwned Passwords" service. That service receives only the first five characters of a hash of your password, never the password itself.

Activity in your workspace

We record actions taken in each workspace through the dashboard or the API: what was done, who did it (a person's name or an API key), when, and from which IP address and browser. Members of your workspace can see this activity log. We keep it for security and to meet PCI DSS audit requirements.

Billing

Subscriptions are paid through Stripe. We give Stripe your workspace's name and its Owner's email address, and you enter payment details on Stripe's own pages. From Stripe we receive your plan, your subscription status and the brand and last four digits of the payment card on file.

Support and the AI assistant

When you contact support from the dashboard, we keep your messages and any images or PDFs you attach. Members of your workspace and our staff can see your workspace's support conversations. If a reply from our team is still unread after a while, we email you a link to it.

The AI assistant in the dashboard answers questions using our public documentation. It cannot see your workspace's data. We send your questions and the conversation so far to Anthropic, our AI provider, to generate answers. We keep your chats so you can come back to them, and our staff can read them to support you and improve the assistant. We also record how much each request used, without its content.

Our staff may use AI to help draft replies to support conversations. When they do, the conversation is sent to Anthropic, including the workspace name, the first name of the person who started it, its messages and the names of any attached files (not the files themselves).

We block card numbers in support messages and assistant questions. Please do not send card details, security codes or screenshots that show them.

Website and documentation visits

When you visit our website or documentation, our servers and Cloudflare, our network security provider, process your IP address, browser details and the pages you request. We do not use analytics, advertising or social media trackers.

Emails we send

We send emails about your account, its security, your workspace's activity and billing, and replies to your questions. You can turn off many of these emails in your notification settings. Security emails, such as sign-in codes and account lock alerts, are always sent.

3. Card data we process for merchants

This section explains how we handle information about people who pay merchants that use OrderCard ("cardholders"). We do this as the merchant's service provider, under our agreement with the merchant.

What we process. Card numbers, expiry dates, cardholder names, and the email addresses, phone numbers and billing addresses the merchant chooses to send. We also process details derived from the card number (brand, issuer, issuing country, card type, and the first six and last four digits), notes the merchant adds, and transaction details such as amounts, billing addresses, the cardholder's IP address and the responses from the merchant's payment gateway.

How we receive it. Through the OrderCard payment form embedded in the merchant's website or app, or from the merchant's own systems through our API.

Card security codes. The payment form collects the security code (CVV) so that it can be sent with the payment it was collected for. We hold it encrypted for at most 15 minutes, delete it once it is used, and never write it to a database or a log.

How we use it. To store cards securely, to send the merchant's charges, refunds and card checks to the payment gateways the merchant has connected, and to keep the service secure. We do not use cardholder information for our own purposes, sell it or use it for advertising.

Who receives it.

• The merchant's payment gateways (such as Fortis, NMI, Authorize.net, Converge or Deluxe) receive the card details, billing address and, for some gateways, email address, phone number and IP address needed to process each payment.
• The merchant can see your details through its dashboard, API and webhooks, but never the full card number or security code.
• If the merchant has chosen a Google font for its payment form, your browser loads that font from Google, which receives your IP address.

How long we keep it. If the merchant does not save a card within 24 hours, we delete its card number and your details. Saved cards are kept until the merchant deletes them, or until the merchant's account ends, as our Terms of Service describe. When a card is deleted, the merchant keeps a record of its brand, first six and last four digits and expiry date, and its transaction records keep the billing details sent with each payment.

Your rights. The merchant decides how your card information is used, so contact the merchant first. If you contact us, we will pass your request to the merchant if we can identify them.

4. How we use information

We use the information described in Section 2 to:

• provide the service, by running accounts and workspaces, storing and protecting cards for merchants, sending payments to their gateways, and sending the notifications they choose;
• keep accounts and OrderCard secure, including second factors, new device alerts, account locks, activity logs and the prevention of fraud and abuse;
• support you, by answering support requests and providing the AI assistant;
• bill for subscriptions;
• communicate with you about your account, security, billing and the questions you send us;
• improve OrderCard, by understanding how it is used, fixing problems and reviewing feedback and assistant chats; and
• meet our obligations under the law, the card network rules and PCI DSS, and enforce our Terms.

We do not use personal information for advertising. We do not sell it, share it for targeted advertising, or use it to train AI models.

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on these legal bases:

• performing our contract with you or your business;
• our legitimate interests in running, securing and improving OrderCard and in answering business enquiries;
• complying with legal obligations; and
• your consent, where the law requires it.

5. How we share information

Within your workspace. Other members of your workspace can see your name, email address and role, the activity you perform there and the support conversations you start.

Our staff. Authorized OrderCard staff can see account information, support conversations and assistant chats to support you and keep OrderCard secure. When staff act inside a workspace, they must give a reason, their access ends automatically, and every action appears in that workspace's activity log.

Service providers. We use these providers to run OrderCard. They may use the information only to provide their services to us.

Legal reasons. We may disclose information where we reasonably believe it is required by law, legal process, a government request or the card network rules, or to protect the rights, property or safety of OrderCard, our users or others.

Business transfers. If we are involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that deal, under the protections of this policy.

With your consent. We share information in other ways only when you ask us to or agree to it.

6. Cookies and browser storage

We use only the cookies OrderCard needs to work and to stay secure:

The dashboard also uses your browser's local storage to remember your sidebar and light or dark appearance, and the documentation site remembers your sidebar, tab choices and dismissed notices. This stays in your browser.

We do not use analytics, advertising or social media cookies. The payment form we host for merchants sets no cookies and uses no browser storage. Because we do not sell personal information or use it for targeted advertising, "Do Not Track" and Global Privacy Control signals do not change how OrderCard works.

7. How long we keep information

8. How we protect information

We protect information with administrative, technical and physical safeguards designed to meet PCI DSS. Card numbers are encrypted with AES-256 using keys held in a dedicated key management service. The systems that hold card data are separated from our website and dashboard. Connections to OrderCard use HTTPS. Every account must use a second factor, idle sessions lock, and access to card data is logged. No system is perfectly secure, but we work hard to protect your information. If we learn of a breach that affects your personal information, we will notify you as the law requires.

9. Your choices and rights

In your dashboard settings you can update your name, email address and phone number, review and end your sessions, and choose which notifications you receive. You can delete your AI assistant chats at any time.

To get a copy of your information, correct it, delete it, or close your account, email support@ordercard.io. We will confirm your identity before we act, and we will respond within the time the law requires. We may need to keep some information, such as activity logs required for security and PCI DSS, or billing records required for tax.

Depending on where you live, including the European Economic Area, the United Kingdom, Switzerland, California and other U.S. states, you may have the right to:

• access your personal information, or receive a copy in a portable format;
• correct or delete it;
• object to or restrict how we use it;
• withdraw consent you have given; and
• complain to your data protection authority.

We will not treat you differently for exercising your rights. You may use an authorized agent, and we may ask the agent for proof that you authorized them.

If you are a cardholder, your card information is controlled by the merchant you paid. See Section 3.

10. International users

We are based in the United States and store information there. Some of our service providers may process it in other countries. Where the law requires, we protect information transferred from the European Economic Area, the United Kingdom or Switzerland with appropriate safeguards, such as the European Commission's Standard Contractual Clauses.

11. Children

OrderCard is a service for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 18.

12. Changes to this policy

We may update this policy. We will post the new version here and update the date at the top. If a change materially affects how we use your personal information, we will tell you by email or in the dashboard before it takes effect.