One‑paragraph summary—Orchestrator AI provides an AI‑native SaaS platform that connects, automates, and optimises go‑to‑market workflows for enterprise customers. To deliver these Services we must process limited business‑contact, usage‑telemetry, and integration data under strict security controls (AES‑256, TLS 1.2+), recognised frameworks (ISO 27001/27701, NIST 800‑53/61), and robust legal regimes (GDPR, CCPA/CPRA, COPPA). We never sell personal data, never train foundation models on customer content, and honour all statutory privacy rights, including EU‑style Data Subject Access Requests (DSARs) world‑wide.
This Policy covers visitors to https://useorchestration.ai, customers using our web app, desktop agent, mobile apps, SDKs, and public APIs, and anyone interacting with our sales or support teams. Orchestrator AI, Inc. is the Controller for personal data described here; when we host or process customer‑supplied content inside tenant environments we act as a Processor pursuant to our Data Processing Addendum.
We never intentionally collect government IDs, full card numbers, or biometrics; any accidental uploads must be scrubbed with our redaction tools, reflecting PCI DSS guidance that sensitive authentication data must not be stored after authorisation.
Customer content remains inside tenant-scoped containers and is never used to train shared foundation models. Slack applies the same rule to its global models, and broader industry commentary shows many vendors now let customers opt out of AI training
We place (i) strictly‑necessary cookies for login and load‑balancing, (ii) analytics cookies (13‑month TTL) to understand feature usage, and (iii) marketing cookies only with opt‑in consent for EU/EEA visitors via an IAB TCF 2.2‑compatible banner. Global Privacy Control (GPC) signals trigger an automatic opt‑out.
Our AI agents may score leads, prioritze tickets, or auto‑route workflow tasks. These decisions do not produce legal or similarly significant effects without human oversight (GDPR Art 22). Users may request algorithmic explanations or object to profiling.
We share personal data only with vetted Sub‑processors providing cloud hosting (AWS), support, analytics, or email delivery. A live, version‑controlled list can be obtained, and customers can subscribe to change notices.
We operate an ISO 27001‑aligned Information Security Management System (ISMS) extended by ISO 27701 privacy controls. ISO Technical controls include AES‑256 encryption at rest, TLS 1.2+ in transit, network segmentation, quarterly penetration tests, and continuous vulnerability scanning mapped to NIST SP 800‑53 Rev 5 control families.
Our Computer Security Incident Response Plan follows NIST SP 800‑61 guidelines, with 24 × 7 monitoring and defined RTO/RPO metrics. In the event of a personal‑data breach we will notify affected customers and competent regulators within 72 hours as mandated by GDPR Art 33.
Default retention rules appear in § 3; customers may configure shorter periods. Back‑up archives are encrypted and roll off after 30 days. Secure erasure is performed using NIST SP 800‑88 media sanitisation techniques.
Right to access, rectify, erase, restrict, port, or object; lodge complaints with a supervisory authority; and withdraw consent at any time. cy.ico.org.uk
Rights to know, delete, correct, and opt‑out of “sale”/“sharing” of personal information under CCPA/CPRA; identical mechanisms extend to Colorado, Virginia, Connecticut, and Utah statutes.
All users may manage preferences via Settings → Privacy, submit DSARs via our portal, or email privacy@orchestrator‑ai.com.
Our Services are not directed to children under 13. We comply with COPPA and do not knowingly collect their data; any inadvertent collection is deleted promptly.
Our Sites may include links or scripts from third‑party providers (e.g., Slack, Zendesk app integrations). Their processing is governed by their own privacy notices, and we recommend reviewing those policies.
Customers are responsible for (i) configuring lawful data integrations, (ii) obtaining all necessary consents, and (iii) complying with any sector‑specific regulations (e.g., HIPAA, GLBA) before ingesting data into Orchestrator AI.
Material changes will be posted here and, where appropriate, notified by email or in‑app 30 days before they take effect. Continued use after the effective date constitutes acceptance.
Data Protection Officer: go@useorchestration.ai