Privacy notice

Last updated: October 8, 2026

1. Controller

2. Data processed

We process names and email addresses provided by the parties, the case title and optional address, inventory items, condition and price information, notes, uploaded images, invitation, access and approval times, payment and delivery status, and technical security and audit events. Ordivant does not store complete card or bank-account details.

3. Purposes and legal bases

• Preparing and performing the Ordivant service contract and responding to requests: Article 6(1)(b) GDPR.
• Compliance with statutory retention, tax and evidence duties: Article 6(1)(c) GDPR.
• Service security, abuse prevention, fault analysis, and the establishment or defence of claims: Article 6(1)(f) GDPR.
• Data relating to an invited party is received from the initiating party and processed to operate the shared case under Article 6(1)(b) or (f) GDPR.

4. Recipients

The other invited party can see content intended for the shared case. Hosting and support providers may be used for technical operation. Under Managed Payments, Stripe processes payment, transaction, tax and fraud-prevention data as merchant of record; checkout and Stripe's privacy information identify the acting Stripe or Link entity and provide further details. Brevo processes transactional email and delivery information. Authorities or courts receive data only where legally required or necessary to enforce rights.

5. International transfers

Evidantra LLC is established in the United States. Productive processing in the United States or another country outside the EEA may only be activated after an applicable transfer mechanism and the relevant safeguards have been assessed and documented. The actual recipients and safeguards will be published before production processing and may be requested at support@evidantra.com.

6. Retention

Unpaid cases are generally deleted 30 days after the last relevant interaction. Paid open cases use the deletion date shown in the case. After completion or expiry, content, participant and image data is deleted automatically unless a mandatory retention duty or the establishment, exercise or defence of legal claims requires limited longer retention. Payment and accounting records remain subject to applicable statutory retention periods.

7. Cookies and local storage

Ordivant uses only technically necessary signed session cookies for participant and administration access. There are currently no advertising, tracking or analytics cookies and no profiling.

8. Required information

The initiating party's name and email address, the case title and the inventory details needed for the requested workflow are required to provide the service. Optional fields are marked accordingly.

9. Automated decisions

No solely automated decision with legal or similarly significant effect and no profiling takes place.

10. Your rights

Subject to applicable law, data subjects may request access, correction, erasure, restriction, portability and object to processing. Consent may be withdrawn for the future. A complaint may also be lodged with a competent data-protection authority.

Send requests to support@evidantra.com. Further contractual information is available in the Consumer Information.