Privacy Policy

01Scope, application and the operator of the Service

1.1 This Policy applies to the Ordinal desktop application for macOS and Linux (the “App”), the Ordinal website at ordinalcomputer.com and its subdomains (the “Website”), and the remote computing systems operated by or for Ordinal that execute Boosted Jobs (the “Processing Systems”). Together these are the “Service”.

1.2 Ordinal Computer is not an incorporated entity. No company has been registered, so there is no corporate body behind this Policy and no registered business address to print. Ordinal is operated from New York City by the persons building it, and those persons are responsible for the Processing described in this Policy. References in this Policy to “Ordinal”, “we”, “us” and “our” mean whoever is operating the Service at the relevant time. If an entity is later formed to operate the Service, that entity assumes this Policy and the obligations described in it, and this section will be updated to name it. Substitution of that kind does not release any person from, and does not affect, any liability that accrued before it took effect.

1.3 This Policy does not apply to any third party product, website, platform or service, whether or not it is reached from the Service or used alongside it. Section 16 addresses such services.

1.4 Where you use the Service under a separate written agreement with Ordinal that addresses the Processing of information, that agreement governs to the extent of any conflict with this Policy.

This Policy describes our practices as they operate during the Beta. Except where Applicable Data Protection Law provides otherwise, this Policy is a description of those practices and is not intended to create rights or obligations beyond those provided by Applicable Data Protection Law and by the Terms.

02Defined terms

2.1 In this Policy, capitalised terms have the meanings given below. Terms defined in the Terms of Use and used but not defined here have the meaning given in the Terms.

2.2 Headings are for convenience only and do not affect interpretation. The words “including”, “includes” and “such as” are not words of limitation. The singular includes the plural and the reverse.

03Beta status and the Boost control

3.1 The Service is pre-release software made available during the Beta. Its functionality, architecture and data handling are subject to change. Where a practice is not settled, this Policy describes the mechanism you can observe and rely on rather than stating a figure or a guarantee that a given build may not match. No service level, availability commitment or support commitment is made by this Policy or by the Terms.

3.2 Boost is a switch and you operate it. Local Work is executed on your own device and the Input Content and Command Text for that work are not transferred to the Processing Systems. A Boosted Job is transferred to the Processing Systems, because that is what boosting is. This is the primary and most reliable privacy control available to you, and it is under your hand.

3.3 The statement in section 3.2 is narrower than a statement that nothing leaves your device. With Boost disabled, the App may remain signed in to your Account and may continue to generate Diagnostics and Connection Data as described in sections 4.4 and 4.5.

3.4 Accordingly, and without limiting section 12: if a project is subject to a confidentiality obligation, or contains material you are not free to transfer to a third party for Processing, do not Boost it. Execute it as Local Work. Before Boosting sensitive material, inspect the state of the control rather than assuming it.

04Categories of information Processed

4.1 Account Data. When you create an Account we Process the information you supply, which includes your email address and any display name you choose. Where you authenticate through a third party identity provider rather than with a password, we receive the basic profile information that provider transmits to us and we do not receive your password for that provider. Where your Account belongs to a Team, we also Process the Team to which it belongs and the role you hold in it. The Service is free during the Beta, there is no billing system and no payment processor, and accordingly no payment card or bank account information is collected by us. If paid plans are introduced, this Policy will be updated before any charge is made.

4.2 Input Content and Results

When you Boost a job, the Input Content that job requires is copied from your device to the Processing Systems so that the work can be executed there. Input Content may include source files, scenes, media, dependencies and configuration drawn from the project directory you are working in. After the first run, the Service ordinarily transfers only the parts of your project that have changed since the previous run, so a subsequent run of the same project ordinarily transfers less than the first. A full transfer may occur, for example where material previously stored is no longer held. Results are held on the Processing Systems while they are returned to your device, and thereafter for the purposes set out in sections 5 and 8.

Two consequences are stated expressly, because they are material and easily overlooked:

• The Processing Systems must be able to read Input Content in order to execute it. The Service is not end to end encrypted, and we make no representation that User Content is unreadable to the systems that execute it.
• The Service caches and deduplicates. Work that has already been performed may be answered from stored Input Content and Results rather than executed again, and identical material may be stored once rather than repeatedly. What you can observe is that an identical job returns faster and transfers less. This Policy does not represent that a cached item is isolated to your Account alone, and it does not represent that cached items are pooled across users, because neither statement should be made loosely in a document of this kind. What you may rely on is that User Content reaches us through jobs you Boost, that you may ask what we hold, and that you may ask us to delete it under section 13. If the answer is material to you before you Boost particular material, ask us at the address in section 19 and we will describe the behaviour of the build you are running. Until you have that answer, execute the work as Local Work. Section 11.4 of the Terms of Use states the same position, and the undertaking in section 7 of this Policy and in section 11.3 of the Terms is not narrowed by caching or deduplication: nothing here permits us to publish, sell, or make User Content available for browsing, or to use it to train machine learning models.

4.3 Command Text and Job Metadata

To execute a Boosted Job we Process the Command Text and the Job Metadata, which includes the tool and version invoked, arguments and settings required for execution, file names and paths within the project, sizes, timings, queue and exit status, resource usage, and which Processing Systems performed the work.

Command lines and file paths frequently carry more information than they appear to. A path may disclose a client name. An argument may disclose a credential if you place one there. Treat this category as content rather than as neutral telemetry. Assume that whatever a Boosted Job requires in order to execute may travel with it, including values drawn from the environment in which it runs. Do not place a secret in Command Text or in an environment value and then Boost it. If a build requires a credential, execute it as Local Work.

4.4 Diagnostics

The App may report crashes and errors. Diagnostics may include the App version, operating system version, a stack trace, and the state of the App at the time of failure. If you wish to know what the build you are running reports, or to have it stop reporting, write to us at the address in section 19 and we will describe what that build does and how to disable it where disabling is available.

4.5 Connection Data

Operating a networked service generates records of connections to it. Connection Data includes an internet protocol address, timestamps, request and response characteristics, and an identifier for the App build making the request. An internet protocol address constitutes Personal Data in some jurisdictions, and is listed here for that reason.

4.6 Website and correspondence

The Website exists to describe the product, to make a build available, and to allow you to request a demonstration. We do not operate advertising on it, we do not sell what it collects, and we do not construct a behavioural profile of you from it. If you write to us or request a demonstration, we Process that correspondence and the information you place in it. If you require a precise account of what the Website places in your browser on the day you visit, your browser will enumerate it, and we will answer the same question by email. We do not currently respond to browser “Do Not Track” signals, for which no uniform standard exists.

4.7 Information you choose to provide

We Process any other information you elect to send us, including material you attach to a support request, a bug report or a security report. Please do not send us material you do not intend us to hold.

05Purposes of Processing

5.1 We Process the categories described in section 4 for the following purposes, and we reserve the right to Process each category for any purpose in this section for which it is reasonably required:

• Provision of the Service. To create and administer Accounts, to authenticate you, to associate Boosted Jobs with your Account, to apply limits and quotas, to transfer, schedule, queue, execute, cache, deduplicate and return User Content, and to deliver Results to your device.
• Operation and continuity. To operate, monitor, maintain, troubleshoot, repair, restore and back up the Service and the Processing Systems.
• Security and abuse prevention. To protect the Service, its users and third parties against fraud, unauthorised access, abuse of compute, interference, circumvention of limits, and other misuse, and to investigate suspected breaches of the Terms.
• Diagnosis and improvement. To identify, reproduce and correct defects, and to understand the performance and reliability of the Service, including through aggregate and non-identifying measures such as job duration and cache effectiveness.
• Communication. To respond to you, to provide support, and to send administrative and service messages, including notices of material changes.
• Legal and compliance. To comply with law and binding legal process, to respond to lawful requests, to enforce the Terms, and to establish, exercise or defend legal claims.
• Corporate and organisational events. To evaluate, negotiate and give effect to an incorporation, financing, merger, acquisition, reorganisation or transfer of the Service or its assets, subject to section 9.6.

5.2 We do not Process Command Text or Job Metadata for billing, because the Beta is free and no billing system exists.

5.3 A project you Boost may contain Personal Data relating to other persons, because real projects do. You determine what enters a Boosted Job. We Process such material to execute that job, to return the Result, and for the operational, security and legal purposes in section 5.1, and we do not examine it for unrelated purposes. If you require a written arrangement governing Personal Data for which you are responsible, write to us before you Boost it. See also section 12.

06Legal bases, where applicable law requires one

6.1 Where Applicable Data Protection Law requires a legal basis for Processing, we rely on the following, as the circumstances require: performance of a contract with you, namely the Terms; our legitimate interests in operating, securing, defending and improving the Service and in preventing abuse of it, where those interests are not overridden by your interests and fundamental rights; compliance with a legal obligation to which we are subject; the establishment, exercise or defence of legal claims; and your consent, where we ask for it and you give it.

6.2 Where we rely on consent, you may withdraw it at any time by writing to us. Withdrawal does not affect the lawfulness of Processing carried out before withdrawal, and it does not affect Processing carried out on another basis.

6.3 This Policy describes what we in fact do. Nothing in it is an assertion that the Service holds a certification, an adequacy finding, a registration or a status under any particular privacy regime. Where Applicable Data Protection Law confers rights on you in respect of information we hold, we will honour those rights in accordance with that law, and section 13 explains how to make a request.

07Model training, sale and advertising

7.1 We do not use User Content to train machine learning models, and we do not provide User Content to any third party for that purpose.

7.2 We do not sell Personal Data, and we do not share Personal Data for cross-context behavioural advertising. We do not disclose User Content to advertisers.

7.3 We engage Service Providers for compute, storage and operational functions in order to operate the Service, and we use them for that purpose. If we become aware that a Service Provider on which we depend asserts a right to use material passing through it for its own purposes, we will discontinue that provider or disclose the position.

7.4 We analyse aggregate and non-identifying measures of system behaviour, including job duration and cache effectiveness, in order to improve the Service. Those measures are not User Content and do not identify you.

Sections 7.1 and 7.2 are undertakings about our own conduct, which is why they are stated without qualification. Nothing elsewhere in this Policy narrows them.

08Retention

8.1 We retain each category of information for as long as is reasonably necessary for the purposes in section 5, and thereafter as permitted or required under section 8.3. Retention is stated below as a purpose rather than as a number of days. A number in a privacy policy is a representation, and a rule that is true of the running system is worth more than a figure that reads well and may not be.

8.2 Nothing in section 8.1 requires us to delete information that has been aggregated, de-identified or otherwise rendered incapable of being associated with you, and we may retain and use such information without further obligation, provided we do not attempt to re-identify it.

8.3 We may retain information for longer than the periods described in section 8.1 where retention is reasonably necessary to comply with a legal obligation or binding legal process, to detect, prevent or address fraud, abuse or security incidents, to enforce the Terms, or to establish, exercise or defend legal claims, and in each case only for the period for which that purpose subsists and only in respect of the information required for it. There is no billing system, so there is no billing record to retain.

09Disclosure of information

9.1 We disclose information only as described in this section. Recipients are identified by the role they perform rather than by name, because the identity of a provider changes while the role does not. If you require the identity of the providers in the chain for the Service as it operates today before you send work to it, write to us on reasonable notice and we will tell you in confidence, for your own use and not for publication.

• Infrastructure and hosting providers who supply the compute, storage, networking and hosting on which the Service and the Processing Systems operate.
• Operational Service Providers performing functions such as error reporting and email delivery.
• A payment processor, if paid plans are introduced. None is engaged today, because nothing is charged during the Beta.
• Professional advisers, including legal, accounting, insurance and security advisers, where reasonably required and under a duty of confidence.

9.2 Personnel. A small number of persons operating Ordinal can reach the systems that hold User Content and Account Data, because a running service must be capable of being operated and repaired. That access exists to operate, secure and repair the Service, to respond to your requests, and to meet our legal obligations. It is not used to examine User Content for unrelated purposes and it is not used to build anything upon your work.

9.3 Teams. Where your Account belongs to a Team, treat what you Boost on it as visible to the persons who administer that Team, including the fact of the run, the Command Text, file paths and the Result. If material is personal, Boost it from a personal Account, or do not Boost it.

9.4 Legal process and protection of rights. We may disclose information where we believe in good faith that disclosure is required by law, regulation or binding legal process, or is reasonably necessary to respond to a lawful request from law enforcement or a public authority, to enforce the Terms, to investigate suspected violations, to protect the rights, property or safety of Ordinal, its users or the public, or to establish, exercise or defend legal claims. Where we are permitted to notify you before disclosing, and it is practicable to do so, we will.

9.5 At your direction. We disclose information to a third party where you instruct us to do so or otherwise consent.

9.6 Corporate and organisational events. There is no entity to acquire today. If the Service is later incorporated, financed, merged, acquired, reorganised, or transferred in whole or in part, including in an insolvency or on a sale of assets, information described in this Policy may be transferred or disclosed as part of or in contemplation of that transaction, subject to customary confidentiality protections in the case of disclosure before completion. Information transferred in such a transaction remains subject to this Policy until you are notified of a replacement policy.

10International transfer

10.1 Ordinal is operated from New York City in the United States. Boosted Jobs may be executed on systems located in a country other than your own, and Service Providers may Process information in more than one country. If you use Boost, information may be transferred across a border and Processed in a jurisdiction whose data protection law differs from that of your own jurisdiction. By using the Service you acknowledge this transfer and Processing.

10.2 Where Applicable Data Protection Law requires a transfer mechanism or safeguard for such a transfer, we will implement an appropriate mechanism. Wherever information is Processed, we apply this Policy to it.

10.3 The Service does not offer a region control, and you should not assume that one is available. If the location of execution is material to you, ask us before you Boost, and execute the work as Local Work in the meantime.

11Security

11.1 We implement measures we consider reasonable and appropriate to protect information against unauthorised access, loss, misuse and alteration, having regard to the nature of the information and the state of the Service during the Beta. We would rather describe those measures accurately than impressively, and each statement below is either observable by you or one we are prepared to answer for in writing.

• In transit. User Content moves between the App and the Processing Systems over an encrypted connection.
• Not end to end. The Processing Systems read Input Content in order to execute it. Encryption in transit does not alter that, and we do not suggest otherwise.
• At rest. Stored material resides on infrastructure we obtain from providers, with the protections that infrastructure affords. We do not name an encryption standard on this page that you have no means of verifying. If your organisation requires a particular control to be described in writing, ask, and we will tell you what is the case rather than what reads well.
• Access. Access to the systems holding your information is limited to the persons operating Ordinal, and is exercised for the purposes in section 9.2.

11.2 We hold no security certification and we do not claim one. We have not completed an independent audit. If your organisation requires evidence of a particular control before it can use the Service, write to us and we will state honestly whether we have it.

11.3 No method of transmission over the internet, and no method of electronic storage, is completely secure. We therefore cannot and do not guarantee the security of information you transmit to or Process through the Service, and any transmission is at your own risk. This section does not limit any liability that cannot be limited under applicable law.

11.4 You are responsible for maintaining the confidentiality of your Account credentials, for the security of your own devices and networks, and for everything done through your Account. Notify us promptly at the address in section 19 if you believe your Account has been compromised.

11.5 Where we determine that a security incident affecting your information has occurred, we will notify you to the extent required by Applicable Data Protection Law, and we will tell you what we know at the time rather than waiting until the picture is complete.

The strongest protection available to you remains the switch. Local Work does not leave your device through the Service, and nothing in this section is required to make that so.

12Your responsibilities for content you Boost

12.1 You determine what is transferred to the Processing Systems. You represent that you have all rights, authority, consents and lawful bases necessary to transfer the Input Content and Command Text you Boost to Ordinal and to its Service Providers for Processing as described in this Policy, including in respect of any Personal Data relating to third parties that they contain.

12.2 Do not Boost material that is subject to specific legal or regulatory duties, including protected health information, government classified material, payment card data, and material subject to a confidentiality obligation that Processing by a third party would breach, unless we have agreed in writing that it may be Boosted. Do not place credentials, keys or other secrets in Command Text or in environment values that a Boosted Job will carry.

12.3 The Service is not a backup service and no representation is made about the durability of material held on the Processing Systems. Retain your own copies of anything you would not wish to lose. The limitation of liability in the Terms governs liability for loss of data.

12.4 Your obligations to indemnify Ordinal in respect of material you submit are set out in the Terms and are not repeated here.

13Your choices and requests

13.1 In the App

Boost is the control this Policy commits to in writing, because it is the control that is always present. With Boost disabled, Input Content and Command Text for that run are not transferred to the Processing Systems, subject to section 3.3. What else a given build offers changes during the Beta. Anything beyond the switch, including removal of a project's content from the Processing Systems, we will do on request under section 13.2.

13.2 Requests

Whatever Applicable Data Protection Law entitles you to, we will do the following on request, to the extent it is within our control:

• Access. Tell you what information we hold about you.
• Portability. Provide a copy of your Account Data and job history in a form you can read and Process. If you require a particular format, say so in the request.
• Correction. Correct Account Data that is inaccurate.
• Deletion. Delete a project's content from the Processing Systems, or close your Account and delete the data attached to it.
• Objection and restriction. Cease or restrict a particular Processing activity where you have a right to object to it or to have it restricted.

Requests go to the address in section 19. Email is the route we act on, and it works whether or not a given build offers an in-app control.

13.3 Verification and limits on requests

We may require information reasonably necessary to verify that a request comes from you or from a person authorised to act for you, particularly for deletion, and we may decline to act where we cannot verify it. We may decline, or charge a reasonable fee for, a request that is manifestly unfounded, repetitive or excessive, to the extent permitted by Applicable Data Protection Law. We may decline a request to the extent that acting on it would infringe the rights of another person, prejudice the security or integrity of the Service, or conflict with a legal obligation. Where we decline, we will tell you why. We do not publish a response deadline, because the Service is operated by a small number of persons and a deadline we might miss is worth less than an answer. We will reply, tell you when to expect the work to be done, and then do it, and in any event within any period required by Applicable Data Protection Law.

13.4 Limits on deletion

Deletion operates on what we hold and what we control. Copies may persist in operational backups and in caches until those backups and caches expire, are overwritten or are regenerated in the ordinary course, and we do not represent that deletion is instantaneous or exhaustive across every system at the moment it is requested. We may retain information after a deletion request to the extent permitted by section 8.3. If you require certainty that a particular item has been removed from everywhere it may be held, say so expressly in your request, and we will tell you what we removed and what, if anything, we could not. The way to keep material off the Processing Systems entirely is not to Boost it.

13.5 Communications

You may opt out of non-essential email at any time. We will continue to send administrative and service messages, including security notices and notices of material changes to this Policy, for as long as you hold an Account, because those messages are part of operating the Service.

14Complaints and supervisory authorities

14.1 If you consider that we have handled your information improperly, tell us first at the address in section 19 and we will try to put it right.

14.2 Depending on where you live, you may also have the right to lodge a complaint with a data protection or consumer protection authority, and, where Applicable Data Protection Law provides one, a right to appeal a decision we make on a request under section 13. Nothing in this Policy or in the Terms restricts that right, and we will cooperate with an authority properly seised of a complaint.

15Children

15.1 The Service is a professional and technical tool intended for adults. It is not directed at children, we do not market it to them, and Accounts are for persons who meet the eligibility requirements in the Terms.

15.2 We do not knowingly collect Personal Data from children. If you believe that a child has provided us with Personal Data, write to us at the address in section 19 and we will delete it.

16Third party services, links and communities

16.1 The Service may link to, interoperate with, or execute third party software, repositories, registries and services. Their operators Process information under their own policies. We are not responsible for their practices, and this Policy does not apply to them. Review their terms and policies before you rely on them.

16.2 Ordinal maintains community spaces, including a Discord server and a LinkedIn page. Anything you post in those spaces is visible to other participants and is handled under the rules and policies of the platform hosting it, not under this Policy. Do not send a request under section 13, Account credentials, or confidential material through those channels.

16.3 Where you authenticate through a third party identity provider, that provider's handling of your information is governed by its own policy.

17Changes to this Policy

17.1 We may amend this Policy at any time. When we do, we will post the amended Policy at this address and update the date at the top of the page. The amended Policy takes effect on posting unless it states otherwise.

17.2 Where an amendment materially affects how we Process User Content, we will give notice to Account holders by email to the address on the Account before it takes effect, because email is the channel we know we have for you. Where we hold no email address for you, we will give that notice by posting it in the App or prominently on the Website.

17.3 An amendment applies prospectively only. No amendment to this Policy applies to a claim or dispute that accrued, or that arose out of events that occurred, before the amendment took effect.

17.4 Your continued use of the Service after an amendment takes effect constitutes acceptance of the amended Policy. If you do not accept an amendment, cease using the Service and close your Account.

18Relationship to the Terms, and general provisions

18.1 Incorporation. This Policy forms part of the Terms and is incorporated into them by reference. Your use of the Service is governed by the Terms, including the provisions on disclaimer of warranties, limitation of liability, indemnification, dispute resolution and governing law. To the extent permitted by applicable law, those provisions apply to any claim relating to this Policy or to the Processing described in it.

18.2 Conflict. Where this Policy and the Terms address the Processing of Personal Data differently, this Policy governs in respect of Personal Data. In all other respects the Terms govern.

18.3 Mandatory law saved. Nothing in this Policy operates to exclude, restrict or modify any right or remedy that cannot lawfully be excluded, restricted or modified under Applicable Data Protection Law or other applicable mandatory law, including consumer protection law. Where a provision of this Policy would have that effect, it applies only to the extent that law permits.

18.4 Severability. If any provision of this Policy is held to be invalid or unenforceable, that provision applies to the maximum extent permitted and the remaining provisions remain in full force.

18.5 No waiver. A failure or delay in exercising a right under this Policy does not waive it.

18.6 No third party beneficiaries. This Policy does not confer rights on any person other than you and Ordinal, except as Applicable Data Protection Law provides.

18.7 Assignment. Ordinal may assign or transfer this Policy and the information it covers in connection with an event described in section 9.6, including to an entity later formed to operate the Service. You may not assign your rights under it.

18.8 Electronic communications. You consent to receive notices and other communications under this Policy electronically, including by email to the address on your Account and by posting to the Website, and you agree that such communications satisfy any legal requirement that they be in writing.

18.9 Language and interpretation. This Policy is drafted in English. Where a translation is provided for convenience and conflicts with the English version, the English version governs to the extent permitted by applicable law.

19Contact

19.1 Questions about this Policy, and any request under section 13, go to hello@ordinalcomputer.com. That address reaches the persons operating Ordinal and it is the route we act on. A notice or request sent to that address is effective on sending, your own record of having sent it is sufficient proof that it was sent, and we will acknowledge receipt. Ordinal is operated from New York City. There is no registered entity and no registered business address to print. If you require a postal address for a formal notice, ask on reasonable notice and we will provide one, and no request or notice is treated as ineffective because a postal address had not been provided.

19.2 Please mark a request under section 13 clearly, identify the Account or the project it concerns, and describe what you want done. A request sent through a community space under section 16.2 is not a request we act on.

Related: the Terms of Use set out the agreement between you and Ordinal, including the licence you are granted, acceptable use, disclaimers, limitation of liability, and how disputes are resolved.