Skip to content

Privacy Policy

Last updated: July 28, 2026

1. Introduction

Orch8.io ("we", "us", "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website at orch8.io and use our services. Please read this policy carefully.

2. Information We Collect

2.1 Information You Provide

  • Email address — when you sign up for early access or the waitlist
  • Contact information — when you reach out to us via email
  • Account and organization information — when you create or join an Orch8 Cloud account

2.2 Information Collected Automatically

  • Usage data — pages visited, time spent, referring URLs, browser type, device type, and IP address
  • Technical data — hosting and security providers may process request logs, device information, and IP addresses to deliver and protect the website and Cloud service

2.3 Information We Do Not Collect

We do not receive data processed by an Orch8 engine that you run entirely on your own infrastructure, unless you intentionally send it to us for support. This statement does not apply to Orch8 Cloud: the managed service necessarily stores account, configuration, deployment, usage, and engine data needed to provide the service.

3. How We Use Your Information

We use the information we collect to:

  • Communicate with you about early access, product updates, and announcements
  • Respond to your inquiries and provide support
  • Improve our website, products, and services
  • Operate, secure, meter, and improve the website and managed Cloud service
  • Comply with legal obligations

4. Legal Basis for Processing (LGPD / GDPR)

We process your personal data based on:

  • Consent — when you voluntarily provide your email for the waitlist
  • Legitimate interest — to improve our services and communicate relevant product updates
  • Legal obligation — when required by applicable law

5. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information. We may share your information only in the following circumstances:

  • Service providers — current infrastructure includes Supabase for account and application data, Vercel for the website, Fly.io for managed compute, and Stripe for paid-plan billing. Providers process data to perform services for us and may change as the product evolves.
  • Legal requirements — when required by law, court order, or governmental authority
  • Business transfers — in connection with a merger, acquisition, or sale of assets, your information may be transferred as part of the transaction

6. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required by law. Managed-plan product-data retention is also limited by the plan and operational backup lifecycle.

7. Your Rights

Under applicable data protection laws (including Brazil's LGPD and the EU's GDPR), you have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request deletion of your data
  • Withdraw consent at any time
  • Request data portability
  • Object to processing based on legitimate interest

To exercise any of these rights, contact us at hello@orch8.io. We will respond within the period required by applicable law.

8. Cookies

The website does not currently install Google Analytics. The website and Cloud service may use essential storage or cookies for sessions, security, and service operation. You can control cookies through your browser settings, but blocking essential session storage can prevent account features from working. It does not affect an independently self-hosted engine.

9. Security

We implement appropriate technical and organizational measures to protect your personal information. However, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including countries that may have different data protection standards. We ensure appropriate safeguards are in place for such transfers in compliance with applicable law.

11. Children's Privacy

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected personal data from a child, we will take steps to delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page with a new "Last updated" date. Your continued use of the Service constitutes acceptance of the updated policy.

13. Contact

For questions, concerns, or requests related to this Privacy Policy, contact us at hello@orch8.io.