Privacy Policy

1. Controller

Waleed AboHashima is the controller for personal data processed through OrderDiff. I am an individual based in Egypt, and you can reach me at waleedsabry.abohashima@gmail.com.

My principal place of business is Cairo, Egypt.

Where you upload documents containing other people’s personal data, you are the controller for that content and I process it on your behalf.

2. What I collect

I collect only what the Service needs to function:

• Account data — your name, email address, and a securely hashed password.
• Organization data — the organizations you create or join, and your role in them.
• Order check data — the findings produced by a comparison, the file names of the documents compared, and who ran it. I do not keep the uploaded files.
• Billing data — your subscription status and plan. Card details are handled by Paddle and never reach my servers.
• Technical data — IP address and request metadata, used for security, rate limiting and diagnosing faults.
• Contact messages — anything you send me through the contact form.

3. Documents you upload

Files uploaded to the free analyzer are read in memory for the duration of the request and are not written to disk or database.

When you run a check inside an organization I store the resulting findings — item codes, quantities, prices, dates and the differences between them — together with the file names. The source spreadsheets themselves are not retained.

Deleting a check removes its findings permanently.

4. Why I process it, and on what basis

Performance of a contract — to create your account, run comparisons, and provide the Service you signed up for.

Legitimate interests — to keep the Service secure, prevent abuse, understand aggregate usage, and support users. I balance these against your rights.

Legal obligation — to keep accounting and tax records of transactions.

Consent — for optional marketing email, where I ask for it. You can withdraw consent at any time.

5. Who else processes your data

I use a small number of processors, each bound by contract to protect your data and use it only on my instructions:

• My hosting and application platform, which runs the Service.
• Neon, which hosts the PostgreSQL database.
• Paddle, my merchant of record, which handles payments, subscriptions, invoicing and sales tax.

6. Where I am, and which law applies

I am based in Egypt, so Egypt’s Personal Data Protection Law (Law No. 151 of 2020) applies to me as controller.

If you are in the European Economic Area or the United Kingdom, the GDPR and UK GDPR apply to this processing as well, because I offer the Service to people there. The rights described below are the ones those laws give you, and I extend them to every customer regardless of where they live.

Egypt is not the subject of a European Commission or UK adequacy decision. You send your data to me directly rather than through an exporter in your own country, and where I pass it to a processor that processor is bound by contract to protect it — including, where it applies, the European Commission’s Standard Contractual Clauses.

My processors operate in several countries. You can ask me where any category of data is held and what safeguards cover it.

7. How long I keep it

Account and organization data is kept while your account is open, and deleted within a reasonable period after you close it.

Order checks are kept until you delete them or close the organization.

Billing records are kept as long as tax and accounting law requires.

Technical logs and rate-limit records are short-lived and rotate automatically.

8. Your rights

Subject to local law, you can ask me to give you a copy of your personal data, correct it, delete it, restrict or object to how I use it, or provide it in a portable format. You can also withdraw consent where processing relies on it.

To exercise any of these, email waleedsabry.abohashima@gmail.com. I will respond within the period the law allows.

If you are in the EEA or UK and think I have handled your data improperly, you can complain to your local supervisory authority. I would appreciate the chance to resolve it first.

9. Cookies

I use strictly necessary cookies only: a signed session cookie to keep you logged in, and the security cookies my authentication layer sets.

I do not use advertising cookies or third-party tracking on the application.

10. Security

Data is encrypted in transit. Passwords are hashed. Access to a customer’s data is restricted to the organizations that user belongs to, enforced on the server for every request.

No system is perfectly secure. If a breach affects your personal data I will notify you and the relevant authority as the law requires.

11. Changes

I may update this policy. The version and effective date at the top of this page identify the current revision, and I will give notice of material changes before they take effect.

12. Contact

Privacy questions: waleedsabry.abohashima@gmail.com.