Privacy notice

1. Who we are

orch is a content-research service operated from the United Kingdom. The operator’s contact details are shown above. This notice covers our public website, accounts, billing and the service. Contact us using the same details for privacy requests.

For account administration, billing, service security and our own public-reference catalogue, we determine the purposes of processing. A customer organisation normally determines the purposes of personal data it chooses to put in its workspace; we process that workspace data to provide the service on its instructions. Contact the workspace owner as well as us if your request concerns their records.

2. Information we use

Account data includes your name, email, profile image if provided, password hash, verification status, sessions and workspace membership. We use billing identifiers, subscription status, invoices and a credit ledger; Stripe handles payment-card details.

Workspace data includes saved video links, public creator profiles and metrics, transcripts, notes, tags, boards, canvas elements, comments, ideas, documents, chat prompts and outputs. Public video/profile information comes from TikTok and Instagram through scraping and transcription providers. Your team can also submit or edit content.

Operational data can include IP addresses, request and job identifiers, timestamps, errors, security events and administrative audit records. Contacting support gives us the details you choose to send. Please do not put passwords, payment-card numbers or unnecessary sensitive personal data in workspace content or support messages.

3. Why we use it

We use account and workspace information to deliver the service and administer our contract. We process business contacts, operational records and abuse signals in our legitimate interests in running, securing and improving orch, while considering the impact on individuals. Billing and related records may also be needed to meet tax or other legal obligations.

Optional public-site analytics relies on your consent. We do not require analytics consent to use orch. Required account details are needed to create and secure an account; without them we cannot provide it. We do not sell personal data or use workspace content for advertising.

4. Workspace access and AI

People with access to a workspace can see its shared content. Private conversations have separate ownership checks. Owners and authorised administrators manage membership and may request account or workspace support. Platform staff access is restricted to authorised support and operational purposes.

When you request AI or search features, relevant content is sent to the providers needed to answer the request. OpenRouter routes requests to the model selected under your workspace settings, from Google, Anthropic, OpenAI or xAI. Video-vision analysis uses Google Gemini; Chroma stores search representations and associated research text. Public-source transcripts and completed public-source video analyses may be reused across workspaces. Workspace-edited notes, titles, transcripts, private conversations and identities are excluded from that shared analysis cache.

AI conclusions and ranking scores support research; they may be incomplete or wrong. orch does not use them to make decisions about people with legal or similarly significant effects. Review outputs and source evidence before relying on them.

5. Service providers and transfers

Our service uses Stripe for billing, Resend for transactional email, Trigger.dev for background tasks, Apify for public video and profile observations, Supadata for transcripts, OpenRouter and its selected model provider for AI, and Chroma Cloud for search. Our application and PostgreSQL database are hosted on separately managed infrastructure; Vercel is not our application host. Where you opt in, Google Analytics measures public-site visits.

These providers may process data outside the UK. Applicable provider contracts, locations and transfer arrangements must be considered for the service you use. Contact us for the current processor list, processing agreement and information about relevant transfer safeguards. We do not claim that all data stays in the UK or that every provider has the same retention or model-training settings.

6. How long information stays

We retain account and workspace records while they are needed to provide the service, resolve requests, protect security or meet legal obligations. Closing a subscription does not itself delete your workspace. Request account or workspace deletion through support; we verify authority and identify shared records or legal retention requirements before completing it.

Billing records are retained for applicable accounting, tax and dispute requirements. Backup copies are subject to the host’s backup lifecycle and must not be restored into active use without respecting completed deletion requests. We can explain the applicable retention criteria for a specific request.

Public provider observations have separate freshness windows: creator metadata up to 24 hours, recent feeds 15 minutes, video previews generally 1–24 hours, and transcripts and reusable analysis 30 days. Scheduled cleanup removes old cache rows in bounded batches; these freshness windows do not promise that all copies disappear at exactly that time. Workspace copies follow the workspace lifecycle. Analytics consent expires after 180 days; analytics storage is described in the cookie policy.

7. Your choices and rights

Depending on the circumstances, you can request access, correction, erasure, restriction or a portable copy of your personal data. Email the address above with enough information to locate your account. We may need to verify identity or workspace authority. We normally respond within one month; if the law permits extra time for a complex request, we explain why.

You can object to processing based on legitimate interests, including any direct marketing, by contacting us. You can withdraw analytics consent through Cookie preferences at the bottom of our public pages. Withdrawal does not affect processing that was lawful before it.

You may complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint, or another competent supervisory authority. You do not have to contact us first. The service is intended for adults, not children under 18.

8. Marketing choices

We send orch newsletters, product updates, tips and offers only if you opt in. The signup checkbox is optional and starts unchecked. We record the choice, date, email address, source and version of the consent wording. We only send marketing to verified email addresses; being a customer or accepting our terms does not subscribe you. Resend delivers these messages for us.

You can opt out without signing in through an unsubscribe link in any marketing email, or change your preference in Account settings. You can opt in again in those settings. Unsubscribing does not stop necessary account, security or billing messages, or research digests you explicitly schedule. Manage scheduled digests in their routine settings. We keep your current preference and consent history while your account exists, to respect your choice and demonstrate consent; account deletion removes these account-linked records.

9. Changes

We update this notice when the service or our practices change. The date above identifies this version. We will provide additional notice where a material change or the law requires it.