Last updated: March 9, 2026
Orckai ("we", "us", or "our") operates the Orckai platform at orckai.app and the website at orckai.com. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform and website.
All data you upload to or create within Orckai remains your property. This includes knowledge base documents, workflow inputs and outputs, API requests and responses, AI prompts and generated outputs, and configuration settings.
Your data is never used to train AI models. We process your data solely to provide platform functionality. We do not use customer content to train, fine-tune, or improve foundation models.
Account Information: When you create an account, we collect your name, email address, organization name, and password (stored as a one-way hash — we cannot recover your original password).
Usage Data: We collect information about how you use the platform, including workflow executions, agent interactions, API calls, and feature usage. This data is used to improve the service and provide usage analytics.
Documents & Data You Upload: When you upload documents to Knowledge Bases or process files through workflows, that content is stored in your organization's isolated storage. We do not access, read, or use your uploaded content for any purpose other than providing the service to you.
Widget Visitor Data: When visitors interact with your embedded chat widgets, we may collect IP addresses, browser information, and any lead data (name, email, company) that visitors voluntarily provide. This data is scoped to your organization and accessible only to your team.
Technical Data: We collect IP addresses, browser type, device information, and access timestamps for security and audit logging purposes.
Payment Information: If you subscribe to a paid plan, payment processing is handled by our third-party payment processor. We do not store credit card numbers on our servers.
We use the information we collect to:
Orckai is built with multi-tenant data isolation. Each organization's data is fully isolated at the database level. Your documents, workflows, agents, knowledge bases, widgets, and all associated data are scoped to your organization and cannot be accessed by other tenants. This isolation extends to vector embeddings used for knowledge base retrieval — search results are always restricted to your organization's data.
Managed SaaS (orckai.app): When you use our managed cloud service, your data is stored on our infrastructure with full multi-tenant isolation. This privacy policy applies to our hosted service.
Self-Hosted: If you deploy Orckai on your own infrastructure, all data remains entirely on your servers. We have no access to your self-hosted instance, its data, or its usage.
When you use AI agents, workflows, or chat widgets, prompts and responses are sent to the LLM provider you configure (e.g., Anthropic, OpenAI). These requests are made using your own API keys. We do not store LLM conversation content beyond what is needed for execution history and debugging.
When sending data to AI providers, we follow these principles:
Please review the privacy policies of your chosen LLM providers for their data handling practices.
Documents uploaded to knowledge bases are processed through a security scanning pipeline before being stored and indexed. This includes:
Documents that fail security checks may be sanitized or rejected. This protects your AI assistants from serving compromised or manipulated content to end users.
We do not sell, rent, or trade your personal information. We may share information only in the following circumstances:
We retain your account data for as long as your account is active. Workflow execution logs are retained for 90 days by default. You can delete individual resources (documents, knowledge bases, workflows, widgets) at any time, and associated data is removed from active storage. You can request deletion of your entire account and all associated data by contacting us. Upon deletion, we remove your data within 30 days, except where retention is required by law.
We implement comprehensive security measures to protect your data:
We maintain audit logs of security-relevant events to support monitoring, compliance, and incident investigation. Logged events include:
Audit logs include request metadata such as IP addresses and request identifiers to assist in security analysis. Logs are scoped to your organization and accessible to organization administrators.
Depending on your jurisdiction, you may have the right to:
To exercise these rights, contact us at privacy@orckai.com.
Our platform stores authentication tokens in your browser's local storage for session management. We do not use third-party advertising or tracking cookies. Our website may use analytics cookies to understand traffic patterns. You can clear local storage and disable cookies in your browser settings.
While Orckai provides extensive platform protections, customers are responsible for:
The platform provides tools, audit logs, and usage dashboards to assist organizations in managing these responsibilities.
Orckai is not intended for use by individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will delete it promptly.
If you access Orckai from outside the country where our servers are located, your data may be transferred across borders. We ensure appropriate safeguards are in place for such transfers in compliance with applicable data protection laws.
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of the platform after changes constitutes acceptance of the updated policy.
If you have questions about this Privacy Policy or our data practices, contact us at: