Privacy Policy

This policy describes how OrchestrAI ("we", "us") collects, uses, and protects information when you use orchestrai.io, app.orchestrai.io, and the OrchestrAI service. The short version: we collect what we need to run the service, we encrypt your cloud connection secrets, we don't sell personal information, and you can ask us what we hold about you or ask us to delete it.

Information we collect

Account information. When you sign up, we receive your email address and basic profile details from your authentication provider (such as GitHub), along with plan and billing status.

Cloud connections. When you connect a cloud account, we store the connection configuration and credentials or roles you grant. These are used solely to operate your accounts on your instructions, are encrypted at rest, and are never used for any other purpose. Read-only access stays read-only until you approve more.

Service activity. We keep a record of the operations you run — prompts, approvals, run history, and the resource ledger — so the service can do its job and so you have an audit trail.

Contact form. If you write to us through the site, we store the name, email, company, and message you provide so we can respond.

Usage analytics. We use PostHog to understand how our sites and app are used: page views, product events, device and browser information, approximate location derived from IP address, and session replays of interactions with our own pages. Analytics never sees the contents of your cloud accounts.

Billing. Payments are handled by our payment processor. We do not store your card number.

How we use it

To provide and operate the service; to secure it and prevent abuse; to bill you; to respond when you contact us; to understand what's working and improve the product; and to meet legal obligations. We do not sell personal information, and we do not use the contents of your cloud accounts for anything other than operating them for you.

Who we share it with

Service providers who help us run OrchestrAI — hosting and infrastructure, analytics (PostHog), email delivery, and payment processing — each bound to use your information only to provide their service to us. We may also disclose information if the law requires it, or as part of a corporate transaction with notice to you.

Cookies

We use a small number of cookies: authentication for the app, and an analytics identifier shared across orchestrai.io subdomains so we can understand the path from our site into the product. You can block or clear cookies in your browser; the marketing site works without them.

Retention and security

We keep account and service records while your account is active and as needed afterward for legal and operational purposes, then delete or anonymize them. Connection secrets are encrypted at rest and removed when you disconnect an account or delete yours. Data is encrypted in transit. If you stop using OrchestrAI, the infrastructure in your cloud accounts is yours and stays untouched.

Your rights

You can ask us for a copy of the personal information we hold about you, ask us to correct or delete it, or object to how it's used. Depending on where you live (including the EU/EEA, UK, and California), you may have specific statutory rights; we honor requests regardless of geography. To exercise them, write to privacy@orchestrai.io or use the contact form.

Children

OrchestrAI is not directed to anyone under 16, and we don't knowingly collect their data.

Changes

If we change this policy, we'll update the date above; for material changes we'll notify account holders by email.

Contact

Questions about privacy: privacy@orchestrai.io.