Privacy Policy

Version 1.3, effective 2026-10-05.

1. What we collect

• Account data. Your name, email address, hashed password, account tier, your chosen timezone, display preferences (avatar, theme), and a brand logo if you upload one. New accounts also give us a WhatsApp phone number, verified with a one-time code sent over WhatsApp.
• Workflow definitions. The step configurations you build: step types, their parameters, any credentials you enter (encrypted at rest), schedules, and triggers.
• Data you upload. Files you put into Data Storage and the rows they contain. These are yours; we store them so your workflows can read them.
• Execution history. Records of workflow runs: which steps executed, how long they took, step output snapshots, error messages, and the small HTML reports we render for each run.
• Usage telemetry. Counts of API calls per minute/hour/day, used to enforce rate limits and show you your own usage chart. No third-party analytics and no tracking cookies.
• Billing metadata. If you subscribe, Stripe customer and subscription identifiers, plus the subscription's current status and period. Your card number never touches Orkidata servers. Stripe handles payment data directly.
• API keys and connected assistants. For each API key: its name, a one-way hash and the first 12 characters of the key (never the key itself), its access level, and when it was created and last used. For each AI assistant you connect: the assistant's name and the access you granted it.
• Teams and sharing. When you invite someone or share an item, the invitee's email and their role. People you share with see your name and email.
• Messaging records. For the email and WhatsApp features: who was messaged, delivery results, the consent attestation you confirmed (who and when), and opt-out records. See Sections 7 and 8.
• Tax invoicing data (Mexico). If you request a CFDI, the legal name, RFC, tax regime, and postal code you give our invoicing provider.
• Transactional and security logs. Standard infrastructure logs (IP address, request path, timestamp, response status), sign-in attempts, and records of administrative actions taken on your account, kept for security and debugging.

2. What we don't collect

• No third-party analytics (no Google Analytics, no Mixpanel, no Facebook pixel).
• No marketing cookies. Orkidata itself sets only a session cookie used to keep you logged in; the Calendly widget on our home page may set its own (see Section 13).
• No content of your data files beyond what is necessary to execute the workflow you configured.
• No mailbox access: we can send from your Gmail, but we can't read it.

3. How we use it

• Operating and securing the service (authenticating you, running your workflows, billing).
• Verifying new accounts (the WhatsApp code) and keeping bots off public forms.
• Sending the emails and WhatsApp messages your workflows are configured to send, and honoring opt-outs.
• Communicating with you about your account (confirmation emails, password resets, subscription notices, security alerts).
• Enforcing rate limits and detecting abuse.
• Helping you when you ask for support.
• Issuing tax invoices. In Mexico, CFDI invoices are reported to the tax authority (SAT) as the law requires.
• Complying with legal obligations when required by valid process.

We do not use your data to train machine-learning models and we do not sell it to any party.

4. Where it lives

All customer data is stored in Amazon Web Services us-east-1 (N. Virginia, USA), in MongoDB Atlas (account metadata, workflow definitions, execution history) and Amazon S3 (Data Storage files). Payment data is held by Stripe in the United States. Email sending is performed by Resend in the United States. WhatsApp messages pass through Zernio (Spain) and Meta's WhatsApp Business Platform. Mexican tax invoices are issued through Facturapi. DNS and CDN edge are operated by Cloudflare globally.

5. Sub-processors

Orkidata relies on the following sub-processors to operate the service. Each is listed with the category of data it receives. This list is authoritative as of the effective date above; material additions will be announced at least 30 days in advance by email.

6. Google user data (Sign-In, Drive, Gmail)

If you connect a Google account, Orkidata accesses Google user data only through the narrow OAuth scopes you grant, and only to do what you configured:

• Google Sign-In. We receive your Google account email and a stable account identifier to authenticate you. Nothing else is read from your Google account at sign-in.
• Google Drive (drive.file). We can read and write only the specific files and folders you explicitly pick through the Google picker — never your whole Drive. File contents are read to execute the workflow steps you configured and are not retained beyond what those steps produce.
• Gmail sending (gmail.send). We send email from your Gmail address only when a workflow step you configured runs (the Reminders step and the Send Email step's "via Gmail" mode). We do not read, index, or store your mailbox; this scope cannot access received mail.
• OAuth tokens. Refresh tokens are encrypted at rest and used solely to perform the actions above on your behalf. Disconnecting Google in your profile invalidates them; you can also revoke access at any time from your Google Account permissions page.

Orkidata's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used strictly to execute the workflows you explicitly configured. It is never sold or rented, never shared for advertising purposes, and never used to train machine-learning or artificial-intelligence models.

Microsoft user data (OneDrive)

If you connect a Microsoft account, Orkidata accesses your OneDrive only through the permissions you grant, and only to do what you configured:

• OneDrive, read (Files.Read). Microsoft does not offer a per-file permission, so this grant technically allows reading the files in your OneDrive. Orkidata lists a folder's contents only while you are browsing it in the import dialog, and reads the contents of only the files you choose to import or link. We do not scan, index, or copy the rest of your OneDrive. File contents are read to execute the workflow steps you configured and are not retained beyond what those steps produce.
• OneDrive, write (Files.ReadWrite). Requested only if you add a OneDrive destination, through a second consent screen. It is used solely to create the output files of workflow steps you configured, in the folder you chose; an existing file is replaced only when you set the step to do so. We never modify or delete any other file.
• Account identity. We receive your Microsoft account email and a stable account identifier to show which account is connected. Orkidata does not offer Microsoft sign-in, and nothing else is read from your Microsoft account.
• OAuth tokens. Refresh tokens are encrypted at rest and used solely to perform the actions above on your behalf. Disconnecting OneDrive in your profile deletes them from Orkidata; you can also remove the app's access at any time from your Microsoft account (personal accounts, or My Apps for work or school accounts).

Microsoft user data is used strictly to execute the workflows you explicitly configured. It is never sold or rented, never shared for advertising purposes, and never used to train machine-learning or artificial-intelligence models.

7. WhatsApp

• Your number. New accounts verify a WhatsApp number. The one-time code is stored only as a hash and expires after 10 minutes. The verified number is part of your account data.
• Messages your workflows send. Messages go out from Orkidata's shared WhatsApp Business number using Meta-approved templates. We pass the recipient's number and the template's contents to Zernio and Meta, and keep the delivery result and an audit record with each run.
• Replies. We read incoming replies only to detect opt-out keywords (STOP, BAJA, CANCELAR, ALTO, UNSUBSCRIBE, and START to resume) and do not store their content. To match a reply to the right sender we keep a link between the conversation and the workflow owner for 180 days after the last message we send to it.
• Opt-outs. Because the number is shared, an opt-out applies to messages from every Orkidata customer and is kept indefinitely, including after the account that sent the message is deleted.

8. Your recipients' data (controller and processor roles)

Some features process personal data about people who are not Orkidata users — the recipients you email or message on WhatsApp. This includes email addresses, phone numbers, and names entered in workflow steps, information recipients submit through the Reminders public intake form or QR code (such as names and appointment dates), the consent ledger (opt-ins, opt-outs, and unsubscribes), and the attestation audit logs referenced in the Terms of Service.

• For this recipient data, you (the Orkidata user) act as the Data Controller: you decide who is contacted, why, and on what consent basis.
• Orkidata acts strictly as a Data Processor, handling recipient data only under your direction to execute the workflows you configured, and never for our own purposes.
• One exception is processed on our own behalf: opt-out and suppression records are retained and enforced platform-wide so that a recipient's unsubscribe is always honored, even across workflow changes or deletions.
• Recipients who want their data corrected or deleted should contact the sender (the Orkidata user who messaged them); we support those requests through the controller. Recipients can opt out directly at any time via the unsubscribe link in every email, or by replying STOP on WhatsApp.

9. AI assistants and API access

When you connect an AI assistant (such as Claude or ChatGPT) or call the API with a key, the data your assistant or tool requests is sent to it. An assistant's provider processes that data under your agreement with them, not as our sub-processor. A key or assistant only reaches what its access allows, and nothing it requests is used to train models on our side. When a key is refused, we log the key's id and the route, never the key itself.

10. International transfers

Primary processing happens in the United States. If you access Orkidata from outside the US, your data will be transferred to and processed in the US under the sub-processors listed above. WhatsApp messaging data is also processed in the European Union (Zernio) and wherever Meta operates. Where required, transfers are covered by the sub-processor's own Standard Contractual Clauses or equivalent legal mechanisms.

11. Retention

• Account and workflow data: retained for as long as your account is active.
• Execution history: retained for the life of the account unless you delete specific runs or clear history.
• Data Storage files: kept until you delete them or your account is deleted.
• Files uploaded for a single run and generated export files: deleted automatically after 30 days. Temporary run data: after 1 day.
• WhatsApp verification codes: 10 minutes. The link between a WhatsApp conversation and its sender: 180 days after the last message we send to it.
• Opt-out and suppression records: kept indefinitely so that opt-outs are always honored.
• Infrastructure logs: retained for up to 90 days for security and debugging.
• Billing records: retained for the period required by applicable tax and accounting law (typically 7 years).

12. Your rights

Depending on your jurisdiction, you may have rights to access, correct, export, or delete your personal data, to object to or restrict its processing, and to withdraw consent you gave (in Mexico, the ARCO rights). To exercise any of these, or to ask a question about this policy, email privacy@orkidata.com. We will respond within 30 days, or sooner where the law requires. You can also complain to your data-protection authority.

You can request deletion of your account at any time by emailing the address above. Access ends immediately, and within 30 days your account metadata, workflow definitions, execution history, and uploaded files are erased. We keep only what we must or have committed to keep: billing records, opt-out and suppression records, and a minimal record that the account existed and was deleted. Backups older than 30 days may retain a copy until they are overwritten on the normal rotation schedule.

13. Cookies and browser storage

Orkidata uses one cookie: a secure, HTTP-only session cookie that keeps you logged in. The browser also stores display preferences on your device (your name and avatar for the top bar, theme, sidebar state, and dashboard selections) and a small sessionStorage hint so in-tab navigation feels instant. These stay in your browser and are never shared with any third party.

Our pages load fonts from Google Fonts, and some pages load scripts from the jsDelivr and Redoc content-delivery networks; those providers receive your IP address and browser details with the request. The public Reminders sign-up form uses Cloudflare Turnstile to keep bots out. Our home page loads Calendly's "Book a demo" widget for every visitor, so Calendly receives the same request details and may set its own cookies, whether or not you book a call. If you book one, the name, email, and meeting details you enter go to Calendly (Section 5).

14. Security

Passwords are stored using strong, industry-standard one-way hashing. Credentials you enter for database or API connectors are encrypted at rest with industry-standard authenticated encryption, and all traffic is encrypted in transit using TLS 1.2 or higher. API keys are stored only as one-way hashes and shown once, at creation. OAuth refresh tokens are encrypted at rest, and WhatsApp verification codes are stored only as hashes. Creating or revoking keys, changing passwords or sign-in methods, sending team invitations, sharing items or changing share permissions, and disconnecting connected accounts require signing in to the web app; an API key can't do them. Infrastructure secrets are held in a managed secrets store with least-privilege access, applied across all services. Security is a moving target; no system is perfectly safe, and you should follow good operational hygiene in what you upload.

15. Children

Orkidata is not intended for and is not directed at children under 18. If you believe a child has created an account, please email privacy@orkidata.com and we will delete it.

16. Changes to this policy

Material changes will be announced by email to the address on file and reflected here with an updated version number. New sub-processors are announced at least 30 days in advance (Section 5). Continued use of the service after the effective date of an update constitutes acceptance.

17. Contact

Privacy questions: privacy@orkidata.com.
General: hello@orkidata.com.