Skip to content
Orchyn
← Home

Legal

Privacy Policy

Last updated: July 8, 2026

1. Overview & GDPR Roles

This Privacy Policy explains how Orchyn ("we", "us", "our") collects, uses, processes, and protects your personal data when using our marketing dashboard and related services.

Under the General Data Protection Regulation (GDPR / RGPD), Orchyn acts in two capacities:

  • Data Controller: For account information, email registrations, and billing details provided during registration.
  • Data Processor: For campaign operational data, reviews mined from app store pages, and influencer fleet profiles configured inside your workspace.

2. Information We Collect

We process different categories of information depending on your usage:

  • Account Registration: Name, business email, workspace name, and profile photos.
  • Stripe Payment Data: Subscription billing information is collected directly by our third-party payment processor, **Stripe**. Stripe processes payment details (credit card number, expiration, CVV, billing address) in accordance with PCI-DSS compliance standards. Credit card details are encrypted and never pass through or reside on Orchyn's servers.
  • Review Data & App Store Mining: Reviews extracted from public App Store and Play Store listings to build brand playbooks. This data is collected solely from public sources.
  • Influencer Fleet Profiles: Social handles, credentials, contact details, and avatars for human or AI creators in your fleet. Sensitive vault passwords are encrypted client-side in your browser before database transmission.
  • OAuth & Connection Tokens: Revocable access tokens used to publish campaigns to platforms (TikTok, Instagram, YouTube, X).
  • Technical Logs: IP address, user agent, browser types, and timestamp metrics logged for security auditing and server performance.
  • Cookie-Gated Analytics: Aggregated, anonymous traffic analytics (Firebase Analytics) loaded only after you explicitly opt-in via our GDPR-compliant cookie consent banner.

3. Legal Bases for Processing under GDPR

Under Article 6 of the GDPR, we rely on the following legal bases to process your personal data:

  • Performance of Contract: To provision your account, process payments, and connect social APIs.
  • Consent: For non-essential analytics tracking, cookie triggers, or marketing referrals. You may withdraw consent at any time.
  • Legitimate Interests: To detect platform abuses, enforce API rate limits, audit login security, and optimize query matching.
  • Legal Obligation: For financial invoicing compliance and reporting tax details.

4. Data Retention Policy

We retain personal data for as long as your workspace account is active. You can delete individual posts, influencers, or products at any time. Accounts can be terminated self-serve via Settings → Account → Delete account. This permanently purges all workspace records, listing metadata, and media assets from the live database. Backup snapshots are rotated and completely purged within 30 days.

5. Your Rights Under GDPR (RGPD)

If you reside in the EEA, United Kingdom, or Switzerland, you possess the following rights regarding your personal data:

  • Right of Access (Article 15): Right to obtain copies of the personal data we maintain.
  • Right to Rectification (Article 16): Right to correct inaccurate personal data.
  • Right to Erasure (Article 17): Right to request data deletion ("right to be forgotten").
  • Right to Portability (Article 20): Right to receive your personal data in a structured, machine-readable format.
  • Right to Withdraw Consent (Article 7): Right to revoke cookies/analytics tracking consent via Settings or the consent banner.
  • Right to Lodge a Complaint (Article 77): Right to lodge a complaint with a European data protection authority (e.g., CNIL in France, DPC in Ireland).

To exercise these rights, please email privacy@orchyn.com.

6. International Data Transfers

Your personal data is stored in the database region configured for your Orchyn workspace. If data is transferred outside the EEA, we implement Standard Contractual Clauses (SCCs) to ensure equivalent protection standards.

7. Contact

For inquiries regarding our privacy compliance or data protection officer (DPO) details: privacy@orchyn.com.