Last updated: 27 August 2026
This policy explains how Stuart Stafford, trading as OrderMatch, collects and uses your data when you use our website and service at ordermatch.co.uk. We are the data controller for the purposes of UK GDPR.
OrderMatch is operated by Stuart Stafford, trading as OrderMatch, based in England. Questions about this policy or your data go to office@ordermatch.co.uk.
When you sign up, we collect your business name, your name, email address, and password (stored as a bcrypt hash — we never see or store your actual password).
You supply your own Anthropic API key so that checks run under your own account, at your own cost. It is encrypted at rest and only ever decrypted in memory for the duration of a single check — we do not use it for anything other than running the check you asked for.
The PDF documents you upload or email in are processed to extract structured data (line items, prices, dates, reference numbers) via the Anthropic API, using your own API key, so that they can be compared against each other. The extracted structured comparison result is stored against your account; the source PDFs themselves are retained only until 30 days after you mark the corresponding check as "actioned" (see Section 6).
If you forward documents to your dedicated OrderMatch inbox address, the inbound email — including attachments — is processed by Mailgun (our email provider) and forwarded to our system to extract and pair documents. We only process PDF attachments; other content is not retained beyond what's needed to route the message.
If you use the in-app feedback tool or the public contact form, we store what you submit (description, optional file attachment, or your name/email/message) so we can respond and investigate.
We use a single session cookie to keep you logged in. It is strictly necessary for the service to function — no advertising, tracking, or analytics cookies are used.
We do not sell your data. The following providers process data on our behalf:
No provider is permitted to use your data for any purpose other than providing the service to you.
Under UK GDPR you have the right to:
To exercise any of these rights, email office@ordermatch.co.uk. We aim to respond within 30 days.
If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO).
We use HTTPS everywhere with HSTS enabled, bcrypt password hashing, Fernet encryption for stored API keys, and tenant-isolated data access so no business can see another's documents or checks. No method of transmission over the internet is completely secure, but we take reasonable, proportionate steps to protect your information.
We may update this policy from time to time. The date at the top of this page shows when it was last updated.
For any questions about this policy or to exercise your data rights, contact office@ordermatch.co.uk.