Legal

orchit Privacy Policy

Effective date: October 16, 2026

1. Who we are

orchit (“orchit,” “we,” “us,” or “our”) operates the orchit web application at https://orchit.ai, a workspace for projects, tasks, email, calendars, notes and AI assistants (the “Service”). This Privacy Policy explains what information we collect, how we use, store and share it, and the choices you have. If you have any question about this policy, contact us at sales@orchit.ai.

2. Scope

This policy applies to everyone who visits our website or uses the Service, including account holders, members of workspaces and organizations, and people who contact us. It does not cover third-party services you connect to orchit; their own privacy policies apply to them.

3. Information we collect

  • Account data: name, email address, password (stored only as a secure hash), profile photo, and the organization and workspaces you belong to.
  • Content you create: workspaces, boards, cards, forms, comments, notes, files and attachments you upload, and messages you send to the AI assistants.
  • Billing data: your plan and billing history. Card payments are processed by Stripe; we never see or store your full card number.
  • Connected accounts: data from services you choose to connect, such as Google, Microsoft Outlook, Notion or an email provider. Section 4 describes Google data in detail.
  • Technical data: IP address, browser and device type, log files, and timestamps, used to keep the Service secure and working.
  • Cookies and local storage: used to keep you signed in and to remember your preferences. Our website also uses Google Analytics to understand how visitors use it; it never receives data from the Google services you connect. We do not use advertising cookies.

4. Google user data

orchit only accesses Google data after you sign in with Google or choose to connect a Google service, and only for the purposes listed below. Each connection asks for your consent on Google's own consent screen, and you can disconnect it at any time. orchit only changes your Google data when you take an action in the app (for example, sending an email, editing an event or uploading a file) or confirm an action an assistant proposes; it never changes or deletes your data on its own.

4.1 What we access and why

  • Google Sign-In (openid, email, profile)
    Data accessed: Your name, email address and profile picture.
    How we use it: To create your account, sign you in, and show your name and picture inside the app.
  • Gmail (gmail.modify)
    Data accessed: Your email messages, their metadata (sender, recipients, subject, date, labels) and attachments.
    How we use it: To show your mailbox in the Mail tab and keep it in sync both ways: mail that arrives in Gmail appears in the app, and when you send, reply, forward, archive, mark as spam, star, mark as read or unread, or move a message to trash in the app, the same change is made in Gmail. If you ask the Email assistant to find, sum up or act on your mail, it reads the messages it needs to answer you. We cannot permanently delete your email.
  • Google Calendar (calendar.events)
    Data accessed: The events of your primary Google Calendar (title, time, location, attendees, description).
    How we use it: To keep the Calendar tab in sync with your Google Calendar both ways: events you add or change in Google Calendar appear in the app, and events you create, change or delete in the app, yourself or by asking the Calendar assistant, are made in Google Calendar.
  • Google Drive (Media page) (drive)
    Data accessed: Your Drive files and folders: names, types, sizes, dates and links, and a file's content when you open, download or upload it.
    How we use it: To show your Drive on the Media page and keep it up to date: files you add or change in Drive appear in the app, and files you upload, rename or move to trash in the app are changed in Drive.
  • Google Drive file picker (drive.file)
    Data accessed: Only the files you pick with Google's file picker: their names, content and metadata.
    How we use it: To add the files you pick to your knowledge base, so you can search them and ask the AI assistant about them, and to keep them up to date when they change in Drive.
  • Google Docs (Noteboard) (drive)
    Data accessed: Your Google Docs, including Docs shared with you: their titles and text.
    How we use it: To show your Docs as notes in the Noteboard tab and keep them in sync both ways: edits made in Google Docs appear in the app, and edits you make to a synced note in the app are saved back to the Google Doc. You can also save a note as a new Google Doc, and rename a synced Doc or move it to trash.

4.2 How we use Google user data

We use Google user data only to provide and improve the user-facing features described above, which you can see and control in the app.

When you ask one of orchit's AI assistants about your own content (for example, to find or sum up an email, to list your Drive files, or to answer from a file you added to your knowledge base), the content the assistant needs is sent to our AI model provider only to produce the answer you asked for. An assistant changes your Google data (sends an email, creates an event, renames a file) only after you confirm that action. Conversations in which an assistant read or acted on your email are never used to suggest Knowledge Hub entries.

We do not:

  • sell Google user data, or transfer it to data brokers or information resellers;
  • use or transfer Google user data for advertising, including personalized, retargeted or interest-based ads;
  • use Google user data to determine creditworthiness or for lending purposes;
  • use Google user data, or allow it to be used, to develop, improve or train generalized or non-personalized artificial intelligence or machine learning models;
  • allow humans to read Google user data, unless you give us explicit permission (for example, when you ask for support with a specific item), it is needed for security purposes such as investigating abuse, it is required by law, or the data has been aggregated and anonymized for internal operations.

4.3 Google API Services User Data Policy

orchit's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4.4 How we share Google user data

Google user data is shared only with the service providers that host and run orchit (listed in section 6), under contracts that let them use it only to provide their service to us. It may also be disclosed if the law requires it, or as part of a merger or acquisition, in which case we will ask for your consent first. Content you put into a shared workspace is visible to the members of that workspace, as you would expect.

If you choose to share one of your mailboxes with a module, that module's Email assistant can search and read the mailbox's messages when other members of the module ask it to. Only you can turn this on, for each mailbox, and you can turn it off at any time. Nobody else can send, move or change mail in your mailbox.

4.5 How we store and protect Google user data

Google access and refresh tokens are encrypted before they are stored. All data travels over encrypted HTTPS connections, and access to our production systems is limited to authorized personnel. We store only what a feature needs:

  • Gmail: your messages are not stored. They are fetched from Google when you open the Mail tab; only your folder list and message counts are kept in memory for a few minutes to keep the app fast.
  • Google Calendar: your events are not stored. They are read from Google each time the Calendar tab shows them.
  • Google Drive (Media page): a list of your Drive files (names, types, sizes, dates and links, not their content), so the Media page can show and search them.
  • Google Drive file picker: the text of the files you add to your knowledge base, stored and indexed so you can search them and ask the assistant about them.
  • Google Docs: the title and text of each synced Doc, stored as the matching note in your Noteboard.
  • Assistant chats: the assistant's replies, which can quote your email or files, are saved in your chat history with that assistant; recent messages are also cached for up to 24 hours to keep the chat fast.

4.6 Retention and deletion of Google user data

You can disconnect any Google service from its tab in orchit. When you do:

  • Gmail: we delete the tokens we stored and stop Gmail's change notifications for that mailbox.
  • Google Calendar: we delete the tokens we stored.
  • Google Drive (Media page): we delete the tokens and the stored list of your Drive files.
  • Google Drive file picker: we delete the tokens, and you can choose to also delete every document imported from Drive.
  • Google Docs: we delete the tokens. Notes already synced stay in your Noteboard as ordinary notes and are no longer synced; you can delete them at any time.
  • Deleting our tokens ends orchit's access through that connection. You can also remove all of orchit's access to your Google Account at once, at any time, at myaccount.google.com/permissions.
  • When you delete your orchit account, or ask us to at https://orchit.ai/request_delete or sales@orchit.ai, we delete your Google user data, including your chat history, within 30 days, except for what the law requires us to keep.

4.7 Responsible AI

orchit does not use Google APIs or Google user data to generate non-consensual intimate imagery or sexually explicit content. Using orchit to create such content is prohibited by our Terms of Service.

5. How we use information

We use the information we collect to:

  • provide, maintain and secure the Service;
  • sign you in and protect accounts against fraud and abuse;
  • run the features you use, including AI assistants that act on your request;
  • process payments and manage your subscription;
  • send you service messages such as verification codes, task assignments and security alerts;
  • respond to support requests;
  • comply with the law and enforce our Terms of Service.

6. Service providers

We share information only with providers that help us run the Service, and only as needed for them to do so:

  • Amazon Web Services: hosting and file storage.
  • OpenAI, Anthropic and Google (Gemini API): AI models that power the assistants, only for requests you make. Under our agreements with them, data sent through their APIs is not used to train their models.
  • Stripe: payment processing.
  • Email delivery providers: sending account and notification emails.

We do not sell your personal information to anyone.

7. Data retention

We keep your information for as long as your account is active. When you delete your account, we delete or anonymize your personal information within 30 days, except where we must keep it longer to meet legal, tax or accounting obligations, or to resolve disputes.

8. Your rights and choices

  • Access and update your profile information in your account settings.
  • Disconnect any connected service at any time.
  • Request a copy of your data, or its correction or deletion, by emailing sales@orchit.ai.
  • Delete your account at https://orchit.ai/request_delete.

Depending on where you live (for example under the GDPR in the EU/UK or the CCPA in California), you may have additional rights, including to object to or restrict processing and to complain to your local data protection authority. We will respond to requests within 30 days.

9. Security

We use industry-standard safeguards, including HTTPS encryption in transit, encrypted storage of third-party access tokens, hashed passwords and access controls. No system is completely secure, so please use a strong password and tell us right away if you suspect unauthorized access.

10. Children

The Service is not intended for children under 16, and we do not knowingly collect their personal information. If you believe a child has given us information, contact us and we will delete it.

11. International transfers

Your information may be processed in countries other than your own, including the United States. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses.

12. Changes to this policy

We may update this policy from time to time. We will change the effective date above and, for significant changes, notify you by email or in the app before they take effect.

13. Contact us

orchit — https://orchit.ai
Email: sales@orchit.ai