Privacy Policy

This policy explains how Palmthree LLC (“Orako,” “we”) handles personal data when you use orako.io and the Orako service. For account and billing data we act as the data controller. For the content your organization runs through Orako (questions, answers, and knowledge-base entries) we act as a processor on behalf of your organization, which decides why and how that content is used.

What we collect

Account data: name, email address, organization details, and role. Provider identifiers: if you or your admin link a messaging account, we store the identifier needed for delivery (a Slack member ID, a Microsoft account ID, or a Discord user ID). We use these identifiers only to deliver questions, never to read your messages, channels, or presence. Customer content: the questions your agents ask, the answers your team provides, and the searchable history built from them. Billing data: plan, seats, and payment status; payment card details are handled by our payment processor and never touch our servers. Usage and log data: technical logs (IP address, browser, timestamps) needed to run and secure the service. We do not use advertising trackers.

How we use it

To provide the service: route questions to the right people, deliver answers back to your agents, and build your organization’s searchable history. To operate the business: billing, support, transactional email (such as invitations and notifications), and security. To improve the service using aggregate, de-identified usage patterns. We do not sell personal data and we do not use your content to train machine-learning models.

Legal bases (EEA/UK)

Where the GDPR applies, we process account and billing data to perform our contract with you; security logs and product analytics under our legitimate interest in running a safe, reliable service; and anything based on consent (such as optional emails) only with your consent, which you can withdraw at any time.

Who we share it with

Service providers that help us run Orako (cloud hosting and database infrastructure, transactional email delivery, and payment processing), each bound by contract to process data only on our instructions. The current list of subprocessors is available on request. When your organization connects a messaging provider (Slack, Microsoft Teams, Discord), question and answer content transits through that provider under its own terms; connecting one is your organization’s choice. We may disclose data if required by law, and in a merger or acquisition we will notify you before your data becomes subject to a different policy.

International transfers

We are a U.S. company and process data in the United States and the European Union. Where personal data of EEA/UK residents is transferred internationally, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses. Enterprise customers can run Orako self-hosted so content never leaves their infrastructure.

Retention

Account data is kept for as long as your account exists. Customer content is kept for as long as your organization uses the service; after termination, we provide an export on request within 30 days and then delete it from production systems, with backups expiring on a rolling basis. Logs are kept for a limited period appropriate to security and debugging.

Security

Content is encrypted in transit and at rest. Access to production data is restricted and logged. Secrets you give us (such as bot tokens) are stored encrypted and are never echoed back once saved. No system is perfectly secure; if a breach affects your data, we will notify you without undue delay.

Your rights

Depending on where you live, you may have the right to access, correct, export, delete, or restrict the processing of your personal data, and to object to certain processing. EEA/UK residents may also lodge a complaint with their supervisory authority; California residents have equivalent rights under the CCPA, and we do not “sell” or “share” personal information as defined there. To exercise a right, email us; if the data belongs to your organization’s workspace, we may redirect the request to your admin, since your organization controls that content.

Data processing agreement

A DPA covering GDPR processor obligations is available on request for customers that need one. Contact us at the address below.

Children

Orako is a business tool and not directed at children under 16; we do not knowingly collect their data.

Changes and contact

If we materially change this policy, we will notify you by email or in the dashboard before the change takes effect. Questions or requests: privacy@orako.io.