Orchra Privacy Policy
This Privacy Policy explains how Orchra Technology ("Orchra", "we", "us", "our") collects and uses personal data through the Orchra marketing website at orchra.io (the "Site"). Orchra is a pre-launch enterprise software product. The only data we collect from you directly is through our early-access waitlist form.
We comply with the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations, and, for visitors in those regions, the EU and UK GDPR, the EU ePrivacy rules, and applicable US privacy and email rules.
1. Who is responsible for your data
The controller of your personal data is:
- Entity: Orchra Technology
- Commercial Registration (CR) No.: 012349504
- Registered address: Riyadh 13214, Kingdom of Saudi Arabia
- Privacy contact: privacy@orchra.io
Data Protection Officer (DPO). Orchra has not appointed a formal Data Protection Officer because the Company is pre-launch and currently operates below the PDPL thresholds requiring a formal appointment. Privacy queries are handled by our Privacy Contact at privacy@orchra.io. We will appoint a DPO if and when required by applicable law.
2. What personal data we collect
a) Data you give us through the waitlist form
- Email address (required)
- Company name (optional)
- Role / job title (optional)
- Team size (optional)
- Phone number and country code (optional)
The form also contains a hidden anti-spam field. If it is completed by an automated bot, the submission is rejected and discarded. This field is never stored and is not used to identify you.
b) Technical data collected automatically
- Server and content-delivery logs from our hosting provider, which may include your IP address, browser type, and the pages you request, kept for security and reliability.
c) Analytics
We use Plausible Analytics, a privacy-focused, cookieless analytics tool. It does not set cookies, does not collect personal data, and does not track you across sites. It gives us aggregate, anonymous usage statistics only.
We do not use advertising pixels, and our own code does not set any cookies.
d) How we collect your personal data
We collect personal data through the following channels:
- Direct submission — when you complete and submit the early-access waitlist form on the Site.
- Server and CDN logs — automatically when your browser requests pages from the Site, our hosting and content delivery provider records standard request metadata such as your IP address, browser type, referrer, and the pages you visit.
- Cookieless analytics — Plausible Analytics records aggregate, anonymous page views without identifying you.
- Direct communications — when you email us, reply to our outreach, or otherwise contact us, we receive whatever information you choose to include in that communication.
3. How and why we use your data
| Purpose | Personal data used |
|---|---|
| Contact you about Orchra early access and respond to your interest | Form data (email, company, role, team size, phone) |
| Protect the Site against spam, fraud, and abuse | Honeypot result, technical logs |
| Keep the Site secure and reliable | Technical logs |
| Understand aggregate Site usage | Anonymous analytics only |
We do not sell your personal data, and we do not share it for cross-context behavioral advertising.
4. Legal basis for processing
We rely on the following legal bases for processing your personal data:
- Consent — given when you submit the waitlist form to be contacted about Orchra early access. You may withdraw consent at any time (see §10).
- Legitimate interest — for responding to a business enquiry you initiated, protecting the Site against fraud and abuse, ensuring information security, and operating and growing our business in a proportionate way that respects your rights.
- Legal obligation — to comply with applicable law, regulatory requirements, or a lawful request from a competent authority.
Saudi PDPL. The bases above are applied in accordance with the Personal Data Protection Law and its Implementing Regulations.
EU / UK GDPR (visitors in those regions). The corresponding GDPR bases are: consent (Article 6(1)(a)), legitimate interests (Article 6(1)(f)), and legal obligation (Article 6(1)(c)).
United States. Where US state privacy laws apply, this Policy serves as our notice at collection. We do not sell or share personal data as those terms are defined under those laws.
5. Marketing communications
We will use your details only to contact you about Orchra early access. We will not send you general marketing emails. If that ever changes, we will ask for your explicit opt-in first and update this Policy.
6. Who we share your data with
We use a small number of service providers ("processors") who act on our instructions:
- Cloudflare, Inc. — content delivery and hosting for this marketing site (orchra.io). May process visitor IP addresses and basic request metadata for delivery, caching, and security.
- Application backend hosting in the Kingdom of Saudi Arabia — stores your waitlist submission on our application backend (app.orchra.io), located in the Kingdom of Saudi Arabia.
- Plausible Insights OÜ (Plausible Analytics) — aggregate, cookieless analytics. No personal data shared, no cross-site tracking.
We require each processor to protect your data and to use it only for the purposes we specify.
Beyond these processors, we may disclose your personal data only in the following circumstances:
- Where required by applicable law, a lawful request from a competent authority (such as SDAIA or a court of competent jurisdiction), or to implement another law;
- To protect the rights, property, or safety of Orchra, our users, or the public — including for fraud prevention and information security;
- To protect the life or health of an individual where this is in their vital interest;
- In connection with a corporate transaction — such as a merger, acquisition, financing, or sale of all or part of our business — in which case we will ensure the recipient is bound to equivalent privacy protections.
We do not sell, rent, or trade your personal data, and we do not disclose it for cross-context behavioural advertising.
7. Where your data is stored and international transfers
Your waitlist data is stored on our application backend located in the Kingdom of Saudi Arabia. We aim to keep waitlist data within the Kingdom.
The marketing site itself is served over Cloudflare's global content delivery network, which means request metadata (such as your IP address) may be processed by Cloudflare edge servers outside the Kingdom for delivery and security purposes. Where this constitutes a cross-border transfer under the PDPL, we rely on the transfer mechanisms permitted under the PDPL Transfer Regulations and, for EU or UK individuals, on an appropriate GDPR safeguard such as the Standard Contractual Clauses.
8. How long we keep your data
We keep waitlist data until the Orchra early-access program ends. After that point, we keep records for a further 24 months for follow-up and reference, after which they are deleted or anonymized. If you ask us to delete your data or you withdraw consent earlier, we will act on that request. Technical logs are kept for 90 days.
9. How we protect your data
We apply technical and organizational measures appropriate to the risk, including access controls, encryption in transit, and limiting access to staff who need it. No method of transmission or storage is completely secure, but we work to protect your data and to detect and respond to incidents.
In the event of a personal data breach, we will notify SDAIA within the timeframe required under the PDPL (within 72 hours) and notify affected individuals where required.
10. Your rights
Subject to the applicable law, you have the right to:
- Be informed about how your data is used
- Access your data and obtain a copy of it
- Have inaccurate data corrected or updated
- Request deletion of your data
- Withdraw consent at any time
- Object to or restrict certain processing (GDPR regions)
- Lodge a complaint with a supervisory authority
To exercise any right, contact us at privacy@orchra.io. We may need to verify your identity. We will respond within 30 days.
You may also complain to:
- Saudi Arabia: the Saudi Data and Artificial Intelligence Authority (SDAIA).
- EU: your local data protection authority.
- UK: the Information Commissioner's Office (ICO).
11. Cookies and analytics
Our own code does not set cookies. Plausible Analytics is cookieless and does not collect personal data. Because we do not place non-essential cookies or trackers, we do not display a cookie consent banner. If this changes, we will update this Policy and add the appropriate consent mechanism.
12. Children
The Site and Orchra are intended for business and professional use and are not directed at children. We do not knowingly collect personal data from minors. If you believe a minor has provided us data, contact us and we will delete it.
13. Links to other websites
The Site may contain links to third-party websites or services that we do not control. Those sites operate under their own privacy policies. We are not responsible for the content or privacy practices of any third-party site, and we encourage you to review their policies before providing personal data to them.
14. Changes to this Policy
We may update this Policy. The "Last updated" date shows the latest version. Material changes will be made clear on the Site.
15. Contact
Questions about this Policy or your data: privacy@orchra.io · Orchra Technology, Riyadh 13214, Kingdom of Saudi Arabia.