Last updated: 15 October 2026 · Applies to all users of ordo-eu.com
Cookies are small text files stored on your device when you visit a website. They allow the site to remember your preferences, keep you logged in, and understand how you use the service. We also use similar technologies such as local storage and session tokens.
This policy covers cookies set by ordo-eu.com and its subdomains, as required by EU Directive 2002/58/EC (ePrivacy Directive) and the Croatian Electronic Communications Act.
Essential cookies do not require your consent as they are strictly necessary for the service to function. All other categories require your consent, which you can give or withdraw at any time via our cookie banner or cookie settings.
These cookies are required to operate the service. Without them, features like login and secure payments would not work. They cannot be disabled.
These help us understand how Ordo is used so we can improve it. On this marketing site the analytics are cookieless and aggregated. Inside the app they are linked to your account (user ID and email), so we can see which features are used - which is exactly why they wait for your consent.
The consent banner offers this category so that a future feature cannot quietly skip the question. Nothing uses it today: preferences you set yourself, such as theme and language, are stored because you asked for them and are listed under Essential below.
We do not currently use marketing or advertising cookies. If this changes, we will update this policy and request your consent before setting any marketing cookies.
| Cookie / Token | Category | Duration | Purpose |
|---|---|---|---|
| sb-<project>-auth-token | Essential | Up to 400 days, or until you sign out | Supabase authentication in the app - keeps you signed in. A long session may be split across several cookies ending in .0, .1 and so on. |
| sb-<project>-auth-token-code-verifier | Essential | During sign-in | Protects a sign-in in progress, such as signing in with Google, against interception |
| ordo-aid | Essential | 10 minutes | Remembers which workspace you are working in, signed so it cannot be altered. Holds no personal data beyond an internal workspace ID. |
| ordo-mfa | Essential | 10 minutes | Remembers whether your account uses two-factor authentication, so the app does not ask our authentication provider on every page. Signed so it cannot be altered; holds nothing but that yes/no answer and your internal user ID. |
| ordo_consent | Essential | 1 year | Records your cookie consent choice on ordo-eu.com (a cookie and a local storage copy) |
| Vercel Web Analytics | Analytics | No cookie set | Privacy-friendly, aggregated usage analytics on this marketing site (pages visited, performance). Cookieless and loaded only after you accept the Analytics category in our consent banner. |
| ordo_analytics_consent | Essential | Until you clear it | Stored in your browser (local storage, not a cookie) inside the Ordo app. Remembers whether you accepted or declined product analytics, so you are not asked again on every visit. Set whichever way you answer, including “decline”. |
| PostHog | Analytics | 1 year | Product analytics inside the signed-in app - which pages and features get used, so we know what to improve. Loaded only after you accept analytics; decline and PostHog is never started at all. It never receives invoice contents, client details or amounts. Hosted in PostHog's EU Cloud region. |
| theme, ordo-locale, ordo:getting-started:* | Essential | Until you clear them | Local storage in the app, not cookies: the light or dark theme and interface language you picked, and which getting-started steps you have finished or hidden. Written only when you make that choice, and never sent to us. |
Session cookies are deleted when you close your browser. Persistent cookies remain until their expiry date or until you delete them.
Some third-party services we use may set cookies on your device. We have limited control over these:
| Provider | Purpose | Their Policy |
|---|---|---|
| Stripe | Payment processing and fraud prevention. Set by Stripe on its own checkout page when you pay (for example __stripe_mid and __stripe_sid), never on ordo-eu.com: Ordo sends you to Stripe to pay rather than loading Stripe into its pages. | stripe.com/cookie-settings |
| Cloudflare Turnstile | Where it is switched on, a bot check on the app's sign-up, sign-in and password-reset forms. It tells people from scripts without tracking cookies and runs only on those forms. | cloudflare.com/turnstile-privacy-policy |
No Google connection when loading Ordo. The typefaces (Outfit on this site, Inter in the app) are served from Ordo's own domains via Next.js built-in font optimisation - your browser never contacts Google's font servers. Google is contacted only if you choose to sign in with Google.
When you first visit Ordo, a cookie consent banner will appear. You can accept or decline non-essential cookies. You can update your preferences at any time by clicking “Cookie Settings” in the footer.
All major browsers allow you to view, delete, and block cookies. Note that blocking essential cookies will prevent the service from functioning:
You may withdraw consent for non-essential cookies at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.
We will update this Cookie Policy when we add new cookies or change our cookie practices. The “Last updated” date at the top of this page will reflect the most recent revision. Material changes will be communicated via the cookie consent banner on your next visit.
Questions about our use of cookies or to exercise your rights:
Ordo - Privacy
Email: privacy@ordo-eu.com
Supervisory authority: AZOP (azop.hr)