Privacy Policy | ORCA Opti AI

1. Who we are

In this Privacy Policy, "ORCA Opti", "we", "us" and "our" mean ORCA Opti Software Ltd, an Australian company with its principal place of business in Queensland, Australia. We operate the ORCA Opti marketing websites and the ORCA Opti governance, risk and compliance platform.

This policy explains what personal information we collect, how we use it, who we share it with, how we keep it safe, and the choices and rights you have. It applies to visitors to our websites, prospects, customers, users of our platform, investors, resellers, suppliers and job applicants.

2. The laws we follow

ORCA Opti complies with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where we collect information from people in other jurisdictions, we also work to the relevant local standard, including the GDPR, the UK GDPR, India's DPDPA 2023, Mexico's LFPDPPP and applicable United States state privacy laws. We aim to apply the strictest reasonable standard globally rather than vary the protection by country.

3. The information we collect

We only collect personal information that we reasonably need for one or more of our business functions. The types of information we collect include:

Contact details you give us through forms, emails or events, such as your name, business email, phone number, company name, role and country.
Account and product data from your use of the ORCA Opti platform, including sign-in identifiers, role assignments, organisation membership, settings, audit logs and content you choose to upload or generate inside the product.
Commercial information such as proposals, quotes, contracts, invoices and payment records connected with our sales, reseller and partner relationships.
Marketing engagement data such as the pages you view, the emails you open, the events you register for and the resources you download, where you have consented to this being collected.
Technical and device data such as IP address, browser type, operating system, referring page and approximate location, collected through cookies and similar technologies. How and when this happens is set out in our Cookie Policy.
Recruitment information if you apply to work with us, including your CV, cover letter, references and right-to-work status.

We do not knowingly collect sensitive information (for example, health, racial or political information) through our marketing websites. Where sensitive information is needed inside the platform for a customer use case, we collect and handle it under the APPs and the relevant customer agreement.

4. How we collect it

We collect personal information directly from you wherever practical, for example when you fill in a form, request a demonstration, sign up for the platform, contact us, attend an event or apply for a role. We also collect information automatically through cookies and analytics tools, and we may receive information from third parties such as resellers, partners, referral sources and publicly available business directories.

5. How we use it

We use personal information to:

provide, operate, secure and improve our websites and platform;
respond to enquiries, demonstrations, support requests and complaints;
onboard, bill and support customers, resellers and partners;
send service communications such as security notices and product updates;
send marketing communications about ORCA Opti where you have consented or where we are otherwise permitted to do so, with an unsubscribe option in every commercial message;
understand site usage in aggregate so we can improve the experience;
meet our legal, regulatory, audit and contractual obligations, including record-keeping requirements;
protect our rights, our customers and our staff from misuse or fraud.

6. The lawful basis for processing

Under the Australian Privacy Principles we rely on collection notices and consent. For visitors covered by the GDPR or similar regimes, our lawful bases are typically the performance of a contract with you, our legitimate interests in running and growing the business in a measured way, your consent (for marketing cookies and direct marketing) and compliance with legal obligations. You can withdraw consent at any time without affecting earlier processing.

7. Who we share it with

We do not sell personal information. We share it only with parties that help us run the business, and only to the extent each party needs:

Cloud and platform providers who host our product and websites (including Microsoft Azure for the platform).
Customer relationship and marketing tools such as HubSpot, which we use to manage prospect and customer communications.
Analytics and tag management tools such as Google Analytics 4 and Google Tag Manager, governed by your cookie choices.
Connected platforms such as Microsoft, Google and Meta (Facebook and Instagram), where you choose to connect them inside the platform. Data is exchanged with that provider under your authorisation and solely to deliver the connected feature, and the provider's own terms and privacy policy govern their handling of it. See section 14 below.
Resellers and channel partners where you have engaged with us through them, or where they have referred you with consent.
Professional advisers such as accountants, lawyers and auditors, under confidentiality.
Regulators and law enforcement where we are legally required to disclose information.
A successor entity in the event of a sale, merger or restructure of the business, subject to equivalent privacy protections.

8. Where your information is stored

The ORCA Opti platform is engineered to keep customer tenant data in Australia by default. Some of the operational tools we use to run the business (for example, our CRM, analytics and advertising platforms) are operated by providers that may store or process limited personal information overseas, including in the United States and the European Union. Where we transfer personal information outside Australia, we take reasonable steps to ensure the recipient handles it in a way that is consistent with the Australian Privacy Principles.

9. How long we keep it

We keep personal information only for as long as we need it for the purpose we collected it, or for as long as we are required to keep it by law. When we no longer need it, we either delete it or de-identify it.

10. Security

We use a combination of organisational, technical and physical controls to protect personal information against loss, misuse, unauthorised access, modification and disclosure. These include role-based access, encryption in transit and at rest where appropriate, multi-factor authentication for staff accessing sensitive systems, audit logging, and regular security reviews. No method of transmission over the internet is perfectly secure, so we cannot guarantee absolute security, but we work continuously to reduce risk.

11. Your rights and choices

You have the right to:

ask us what personal information we hold about you;
ask us to correct information that is inaccurate, incomplete or out of date;
ask us to delete information we no longer have a lawful reason to keep;
opt out of direct marketing at any time, including through the unsubscribe link in any commercial email;
change your cookie choices at any time using the "Cookie Preferences" link in the footer of every page;
make a privacy complaint to us, and have us investigate and respond.

To exercise any of these rights, please reach us through our contact page. We will respond within a reasonable period, usually within 30 days. If you are not satisfied with how we have handled your information or your complaint, you can contact the Office of the Australian Information Commissioner at www.oaic.gov.au.

12. Children

Our websites and platform are not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, please contact us so that we can take appropriate steps.

13. Cookies and tracking

We use cookies and similar technologies on our websites. Full details, including the categories of cookies we use and how you can control them, are set out in our Cookie Policy.

14. Connected integrations and platform data

Inside the ORCA Opti platform you can connect third-party accounts so that ORCA Opti can work with your tools on your behalf. Where you do, we exchange only the data needed to deliver the feature you have authorised, under your authorisation, and each provider's own terms and privacy policy continue to govern how they handle that data.

Microsoft 365 — for sign-in and, where authorised, organisational directory and document information.
Google (Workspace Directory, Drive and Gmail) — where authorised, to read directory information and to work with the specific files and messages you choose.
Meta (Facebook and Instagram) — where you connect a Facebook Page and its linked Instagram Business account, to publish the posts you approve and to read the minimal Page and engagement information needed to confirm a post was published. We do not read your private messages and do not collect your Facebook friends or contacts.

Our use of information received from Meta's platforms (Facebook and Instagram) complies with the Meta Platform Terms and Developer Policies. In particular, we use Meta data solely to provide the features you authorise; we do not sell it; we do not use it for advertising; we do not use it to train generalised artificial intelligence or machine-learning models; and we do not allow staff to read it unless we have your explicit consent for specific data, it is necessary for security purposes, we are required to by law, or the data has been aggregated and anonymised. Connection tokens are stored encrypted and revoked when you disconnect the integration. Our use of information received from Google APIs likewise adheres to the Google API Services User Data Policy, including its Limited Use requirements.

15. Deleting your data

You can have your data deleted in any of the following ways:

Disconnect an integration. Disconnecting Microsoft, Google or Meta (Facebook/Instagram) from Settings → Integrations inside the platform immediately revokes ORCA Opti's access and deletes the associated access tokens. Data derived from that integration is then deleted or de-identified.
Request deletion directly. Email hello@orcaopti.ai and we will delete your personal information within 30 days, except where we are required to retain it by law. We may need to verify your identity before actioning your request.
Close your account. On account closure, your data is deleted or de-identified once we no longer need it, as described in section 9 above.

Deleting your Facebook and Instagram data. If you connect a Facebook Page or a linked Instagram Business account, we store a limited set of data to operate that connection on your behalf: the access tokens that let us publish to the Page and Instagram account you authorised, the identifiers of those accounts, your chosen default publishing destination, and a record of the consent you gave. This data is held in Australia. You can have all of it deleted at any time, in any of the following ways:

Remove ORCA from your Facebook account. In your Facebook settings, under Settings & privacy → Settings → Apps and Websites, remove ORCA. Facebook notifies us automatically, and we delete the stored Facebook and Instagram connection data described above and revoke the associated consent.
Request deletion through Facebook's data deletion process. When you request deletion of your data for the ORCA app, Facebook sends us a verified request. We action it, then give you a confirmation code and a link where you can check its status: portal.orcaopti.ai/settings/data-deletion/status?code=<your code>. The status page shows whether the deletion is still in progress or complete.
Contact us directly. You can also ask us to delete this data by emailing hello@orcaopti.ai. We confirm once it is done.

We action these requests promptly, and in any case within 30 days. Deletion removes the data ORCA holds to run the connection; it does not remove posts or other content you have already published to your own Facebook or Instagram accounts — that content lives with Meta and remains under your control in those accounts.

16. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, in technology, or in the law. The "last updated" date at the top of the page shows when the current version came into effect. We will tell you about material changes through the website or, where appropriate, by direct notice.

17. Governing law and jurisdiction

This Privacy Policy is governed by the laws of Queensland, Australia, and the Commonwealth of Australia where applicable. You and ORCA Opti Software Ltd submit to the exclusive jurisdiction of the courts of Queensland in connection with any matter arising from or relating to this policy.

18. How to contact us

If you have any questions about this Privacy Policy, would like to exercise a right under it, or want to make a complaint, please get in touch through our contact page.