Legal

Privacy Policy

Last updated: June 2026

Plain-language summary. We collect what we need to run follow-up on your behalf — your account details, the customer and job data you connect, and how you use the product. We use trusted providers (Stripe, Supabase, AI model providers) to operate the service. We don't sell your data. You can request access or deletion any time at booking@orchestrator.so.

Contents

1. What we collect 2. Connected tools and credentials 3. How we use your data 4. Third parties and subprocessors 5. AI processing 6. Data retention 7. Your rights 8. Security 9. Contact

1. What we collect

When you use Orchestrator, we collect the following categories of information:

Account information — your name, email address, business name, and subscription details
Connected-tool data — the customer records, estimates, jobs, messages, and other business data you connect or import so Orchestrator can prepare and run follow-up
Content you create — the instructions, approvals, edits, and messages you provide while using the product
Usage data — how you interact with the product, which features you use, and session activity
Payment information — processed by Stripe; we receive billing status and the last four digits of your card, but never store full card numbers
Device and technical information — operating system, browser type, and IP address, used for security and analytics

We collect only what's necessary to run follow-up for your business. We don't sell your data, and we don't use your connected business data to build advertising profiles.

2. Connected tools and credentials

To work your follow-up, Orchestrator connects to tools you use — such as email, text/SMS providers, and your customer or job records. When you connect a tool, you may provide credentials or authorize access (for example, an API key or an OAuth connection).

Credentials are stored using encryption in transit and at rest. They are used only for the connected work you authorize, are not sold, and are not intentionally exposed in product responses or logged in plaintext.

Access to a credential is scoped to the connected tool that needs it
You can revoke, update, or delete any connection at any time from your settings or by contacting us
Revoking a connection removes Orchestrator's ability to act in that tool going forward

3. How we use your data

We use your data to:

Identify which jobs and estimates need follow-up and draft the follow-up messages
Send approved messages on your behalf through your connected channels
Provide the human-in-the-loop approval workflow so nothing sends without your sign-off where that workflow applies
Operate, maintain, secure, and improve the service
Process your subscription and communicate billing and account information
Send product updates, summaries, and support responses

We do not sell your business data, and we do not use it to build third-party advertising profiles.

4. Third parties and subprocessors

We rely on a small set of service providers to operate Orchestrator. Each processes data only as needed to provide its service to us:

Stripe — payment processing and subscription billing
Supabase — database, storage, and authentication infrastructure
AI model providers (such as Anthropic and OpenAI) — to draft and process follow-up content, under the data controls available in each provider account
Email and messaging providers — to deliver transactional email and the messages you send through connected channels
Analytics providers — to understand product usage and improve the service

We do not sell, rent, or share your personal data with advertisers or data brokers.

5. AI processing

Orchestrator uses third-party AI models to read your connected business context and draft follow-up. Relevant data is sent to these providers to generate drafts and recommendations.

We send only the context needed to perform the requested work
We rely on the data-handling commitments offered in our provider accounts, which for our enterprise/API usage generally exclude your content from training the providers' models
AI output can contain errors — you review and approve consequential messages before they send where that workflow applies

6. Data retention

We retain your account and business data for as long as your subscription is active, and for a limited period afterward to support reactivation, billing, legal, and support needs.

Connected business data — retained while your account is active, then deleted on request where deletion is not otherwise legally required to be kept
Credentials and connections — removed when you revoke them, and on account closure
Payment records — retained as required by financial and tax regulations
Usage and security logs — retained for security, debugging, and service operations, then removed under our retention process

7. Your rights

Depending on where you live, you may have the right to:

Access the personal data we hold about you
Correct inaccurate information
Delete your account and associated data, subject to legal retention requirements
Export your data where export is technically available
Withdraw consent for processing we conduct based on consent
Object to processing for marketing purposes

To exercise any of these rights, contact us at the address below. We will respond within a reasonable period and within the time required by applicable law.

8. Security

We take security seriously — especially because Orchestrator handles credentials and acts inside connected tools on your behalf.

Data is encrypted in transit using TLS
Stored data, including credentials, is protected using encryption and access controls
Access to credentials and connected tools is scoped and logged
We notify affected customers of security incidents as required by law and our incident process

No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

9. Contact

Questions about this policy or your data, or to make a privacy request:

booking@orchestrator.so
We respond to privacy inquiries as promptly as we can.

Note: This Privacy Policy is provided as a good-faith starting point and is not legal advice. It should be reviewed by a qualified attorney before scaling, and updated to reflect your final list of subprocessors and any state- or country-specific requirements that apply to your customers.