Effective 10 October 2026. OrderRelay is an independent software project.
Catalogs and requests
Published business names, WhatsApp numbers, product details, prices and photos are public to anyone with the catalog link. Buyer catalogs are excluded from search indexing, which does not make the link private. Buyer requests are saved with consent, visible to their seller and retained for up to 90 days. Sellers can export or delete requests and delete catalogs.
Accounts and device storage
When enabled, email sign-in uses a link that expires after 15 minutes and can be used once. We store your account email and hashes of sign-in and session tokens. A secure, HttpOnly session cookie lasts up to seven days. Drafts and original management keys may be stored on your device. Linking an old catalog to an account revokes its original management key; the buyer link stays the same.
Images and service providers
Uploaded product photos are public and stored on Cloudflare D1. Free accounts have 5 MB of photo storage, Pro accounts 50 MB; each prepared upload is limited to 200 KB. Unused uploads expire after seven days. External image URLs load from their host, which may see visitors’ IP addresses; referrers are omitted. Cloudflare runs the application and database. Resend delivers account emails when configured. Paddle handles software subscriptions when billing is enabled; it processes payment information under its own policies. We do not receive full card details.
Statistics and protection
We retain limited conversion events for up to 90 days: entry and template clicks, editing, account sign-in, publication, buyer-link copying, requests, upgrade interest and confirmed software payments. A random identifier stored on your device can associate earlier visits with your account after sign-in. We store only a fixed entry, source category and upgrade reason; no full referrer, query string, login token or buyer message. Client clicks are unverified. These totals contain no buyer contact details, order text or management keys. Short-lived hashes of IP addresses enforce request limits. Launch-interest emails are stored with consent for a launch notification. Billing and refund records are retained to operate subscriptions and handle disputes. We do not sell personal information or use advertising tracking.
Contact: brunoco@signalstrata.co.