Privacy Policy

1. Who controls your data

The controller is ORCH Data, a Brazilian company based in the state of Goias, Brazil. The controller is whoever decides why and how personal data is handled. On this website, that decision is ours alone.

2. What data is collected

Through the waiting list form we collect: your email; your name, when you choose to give it; the interest you declare, that is, what you want to automate; the language the site was in; a hash of your IP address; the version of the consent text you accepted; and the date and time of that acceptance.

The hash of the IP address is a scrambled mark, kept to contain abuse and automated submissions. It is not used to identify you or to build a profile.

We do not ask for a tax number, an identity document or a card, and we do not collect sensitive personal data as defined in article 5, item II, of the LGPD.

3. What the data is used for

For three things, and nothing beyond them: telling you when orch.space opens; understanding what kind of work people want to automate, which guides the order in which we build; and keeping proof that consent was given, as the law requires.

Your data is not sold, not rented and does not feed third party advertising.

4. The legal basis

The handling rests on your consent, under article 7, item I, of Brazilian Law 13709 of 2018, the LGPD. Consent is free, informed and specific to the purpose described above.

You can withdraw consent at any time, at no cost. Once it is withdrawn we delete your entry from the list and stop sending messages.

5. How long the data is kept

Waiting list data is kept until you ask for removal, or for up to 24 months counted from the last contact, whichever comes first.

The consent record, which includes the version of the accepted text, the date and the time, is kept for as long as needed to prove compliance with the law, even after your entry is deleted. That record is never used to send messages.

6. Who the data is shared with

With nobody beyond what is strictly needed to run the site and send the messages you asked for. Suppliers acting as processors, for example hosting and email delivery, handle data under contract and follow our instructions.

When such a supplier exists, it will be named on this page. There is no list selling and no sharing for advertising purposes.

7. International transfer

By default, none. Handling happens in Brazil. If that changes, this page will be updated before the change, naming the destination country and the safeguard applied, as set out in chapter V of the LGPD.

8. Cookies and tracking

This site uses no tracking cookie, no advertising network pixel and no third party analytics tool. It does not even store a language cookie, because the language is in the URL itself.

No resource is loaded from a third party server. Everything the browser downloads comes from this site own domain.

9. Your rights

Article 18 of the LGPD gives you: confirmation that handling exists; access to the data; correction of incomplete, inaccurate or outdated data; anonymisation, blocking or deletion of data that is unnecessary or handled outside the law; portability; deletion of data handled under consent; information about who we share with; information about the option not to consent and what happens if you refuse; and withdrawal of consent.

We answer data subject requests within 15 days of receipt, under article 19 of the LGPD. If a request cannot be met, we explain why in writing.

10. How to talk to us about data

Any request about personal data can be made in writing, and the answer comes in writing too, so that both sides keep a record.

11. Information security

We apply technical and administrative measures proportionate to the size of the operation: access restricted to who needs it, credentials kept in a vault, a record of changes and periodic review of permissions.

ORCH Data holds no SOC 2 and no ISO 27001 certification as of the date of this page. We would rather state that than suggest a guarantee we do not have. If and when a certification exists, it will be published here.

No system is immune to incidents. If a security incident with relevant risk to data subjects occurs, we will notify those affected and the Brazilian data protection authority, as required by article 48 of the LGPD.

12. Changes to this policy

This policy may change as the product advances. The update date sits at the top of the page. If a change materially affects how your data is handled, we will tell everyone on the waiting list by email before it takes effect.