Privacy Policy

This Privacy Policy explains how Orchestraight LLC ("Orchestraight," "we," "us"), a company registered in New York, United States at 169 Madison Ave, STE 11653, New York, NY 10016, collects, uses, and protects information when you use the Orchestraight platform, applications, APIs, and websites (the "Service"). It applies to visitors to our websites, users of the Service, and the organizations they belong to ("Customers").

Where a Customer organization uses the Service, the Customer owns its content and directs how it is processed; we act as a custodian and, for personal data in Customer Content, as a processor on the Customer's behalf. Our Data Processing Addendum governs that processing for Customers who require one.

1. Information We Collect

• Account information. Name, email address, organization name, and authentication data when you create an account or are invited to an organization. Authentication is handled by our identity provider; we do not store your passwords. If you sign in with Google, we receive basic profile information (name and email) from Google. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Customer Content. Files, documents, knowledge-base materials, prompts, and other content you or your organization submit to the Service, and the outputs the Service generates from it.
• Billing information. Subscription and payment details. Card payments are processed by our payment processor; we do not store full payment card numbers.
• Usage and device information. Product analytics such as pages viewed, features used, and approximate location derived from IP address, along with browser and device type, used to operate and improve the Service.
• Communications. Messages you send us, such as support requests.

2. How We Use Information

We use information to: provide, secure, and support the Service; process payments and manage subscriptions; generate AI outputs at your direction; communicate with you about the Service; monitor performance and prevent abuse; and comply with legal obligations.

We do not sell your personal information, and we do not use it for third-party advertising.

3. AI Processing — No Training on Your Content

Customer Content is processed by AI models solely to generate outputs for you, at your direction. We do not use Customer Content to train, fine-tune, or improve AI or machine learning models — ours or anyone else's — and our AI providers are engaged on terms that do not permit them to train their models on Customer Content submitted through the Service.

4. Where Your Data Lives

The Service runs on Cloudflare's global infrastructure:

• Each Customer organization's files and knowledge base are stored in that organization's own isolated storage instance — organizations do not share file storage.
• Structured application data is stored in our application database with per-organization access controls.
• All data is encrypted in transit (TLS) and at rest (AES-256) on SOC 2 certified infrastructure.

5. How We Share Information

We share information only with service providers (subprocessors) that help us operate the Service, under contracts that limit their use of the information to providing services to us:

• Cloudflare — Cloud infrastructure, application database, file storage, AI inference
• Stytch — Authentication and organization identity management
• Nylas — Connected-account OAuth and email, contacts, and calendar processing
• Stripe — Payment processing
• Resend — Transactional email delivery
• Anthropic — AI model inference for content generation
• OpenAI — AI model inference for content generation
• Tavily (AlphaAI Technologies Inc.) — Web search for AI-assisted research features
• PostHog — Product analytics

We may also disclose information if required by law, to protect the rights, safety, or security of Orchestraight, our users, or the public, or in connection with a merger, acquisition, or sale of assets — in which case the successor inherits our obligations under this Privacy Policy and our data ownership commitments.

6. Google Connected Data

When you connect a Google account and enable a Premium Connection capability, Orchestraight can access the Google data needed for that capability: Gmail messages, threads, drafts, labels, and attachments; saved Google Contacts; and Google calendars, events, and availability. Read access lets you search, view, and use this data in conversations and other requested features. If you separately authorize write access, Orchestraight can create, update, send, and delete Gmail drafts; send email; create and manage contacts and calendar events; and respond to invitations, only when you or an authorized user invokes the corresponding feature.

Nylas is our OAuth and Google integration processor. Nylas conducts Google authorization, connects to Google's APIs, and keeps Google's provider credentials and access and refresh tokens behind Nylas; Orchestraight does not store those Google credentials or tokens. Orchestraight stores connection metadata such as your connected email address, provider and account identifiers, granted permission names, connection status, and settings. The Premium Connections database does not store raw Gmail, Google Contacts, or Google Calendar response payloads. If you explicitly save a Gmail attachment to Orchestraight Files, the saved file becomes Customer Content subject to this policy.

Google connected data is shared only with Nylas and, when needed to carry out the feature you request, Cloudflare and our AI inference providers Anthropic and OpenAI. Their use is limited by contract to providing services to us. We may also disclose Google connected data in the limited legal, safety, security, or business-transfer circumstances described in Section 5. We do not sell Google user data, use it for advertising, or use it for unrelated secondary purposes.

We retain connection metadata and any Google-derived Customer Content saved in Orchestraight while your account is active. If your organization is deactivated, that data follows the retention and deletion terms in Section 7: it is retained for 30 days for reactivation or export and then permanently purged, except for minimal records we must keep where legally required.

Human access to connected Google data is limited to authorized personnel using least-privilege controls and logging, and only as needed to operate, secure, or support the Service or comply with legal obligations.

You can disconnect a Google account at any time in Settings > Premium Connections. This stops future access through that connection; when it is the last Orchestraight organization using the connection, Orchestraight asks Nylas to delete the grant. You can also revoke access from your Google Account's third-party connections settings. To delete saved Google-derived content, use the Service's deletion controls. To request further deletion or deactivate your organization, contact hello@orchestraight.com.

Our use and transfer to any other app of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.

7. Data Retention and Deletion

We retain your information while your account is active. If your organization is deactivated, its data is retained for 30 days — during which the organization can be reactivated or a full export requested — and is then permanently purged. We retain minimal records after purge only where legally required (e.g., billing and tax records).

8. Your Rights

You may access, correct, export, or delete your information:

• Export. You may request a full export of your organization's data at any time; we provide it in a commonly used, machine-readable format.
• Deletion. You may delete content within the Service, or deactivate your organization to trigger the retention and purge process above.
• Access and correction. You can review and update account information in the Service, or contact us for help.

Depending on where you live (e.g., the EEA, UK, or California), you may have additional rights under applicable law, such as the right to object to or restrict certain processing and the right to lodge a complaint with a supervisory authority. We honor these rights regardless of where you are located, to the extent practicable. If we process your personal data in Customer Content on behalf of a Customer organization, we may direct your request to that organization, which controls its content.

To exercise any right, contact hello@orchestraight.com. We will respond within the time required by applicable law and will not discriminate against you for exercising your rights.

9. International Transfers

We are a U.S. company and process data in the United States and on Cloudflare's global network. Where required, transfers of personal data from the EEA, UK, or Switzerland are protected by appropriate safeguards such as Standard Contractual Clauses, available through our Data Processing Addendum.

10. Security

We maintain administrative, technical, and organizational safeguards designed to protect your information, including encryption in transit and at rest, per-organization isolation and access controls, least-privilege internal access, and logging. No system is perfectly secure; if we become aware of a breach affecting your personal data, we will notify affected Customers without undue delay, consistent with applicable law and our DPA.

11. Cookies

Our websites and application use cookies and similar technologies for sign-in, session management, and product analytics. You can control cookies through your browser settings; disabling essential cookies may prevent parts of the Service from working.

12. Children

The Service is not directed to children under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will provide notice (e.g., by email or in-app) before the changes take effect. The "Last updated" date above reflects the current version.

14. Contact Us

Questions or requests regarding privacy: hello@orchestraight.com.

Orchestraight LLC

169 Madison Ave, STE 11653

New York, NY 10016, United States

hello@orchestraight.com