Orkest Privacy Policy

1. Who is responsible

Angstroms Inc. is responsible for the personal data described in this Policy, unless we process data only on documented instructions from an organization using Orkest. In that case, the organization is responsible for that data, and we act as its service provider or processor.

Contact:
Angstroms Inc. (Orkest)
10 Garden Avenue
San Rafael, CA 94903
privacy@orkestai.com

2. Personal data we collect

Depending on how you use Orkest, we may collect:

• Account and organization data: name, email address, organization name, role, permissions, and authentication information.
• Workspace content: records and files you or an authorized user add to Orkest, including information about artists, collectors, employees, contractors, and other people.
• Arthie conversations: the messages you send to Arthie, the replies, and the records Arthie reads to answer you.
• Purchase data: when you buy Orkest credits, Stripe, our payment processor, collects your payment card details directly. We receive the transaction confirmation, the amount, the card brand and last four digits, the country of your billing address (and its state or province in the United States and Canada), of your card, and of your connection when you buy, whether you bought as a business, and the type, country, and verification status of any tax ID, not the number itself, and we keep your credit balance and usage history.
• Orkest Pay eligibility data: if you apply for Orkest Pay, your legal entity details, tax ID, bank account details, your representative's name and position, and supporting documents.
• Device, usage, and security data: IP address, browser and device characteristics, session and authentication events, fraud and abuse-prevention signals, pages or features used, and diagnostic and error logs.
• Support data: messages and other information you provide when you contact us.

3. Where data comes from

We receive personal data from you; from an organization, administrator, or teammate that manages a workspace; from an authorized user who adds a record concerning you; from a source you choose to connect; automatically from your browser, device, and use of Orkest; and from service providers that help us operate and secure the service.

If you send an enquiry through a page that a gallery shares through Orkest, we pass your name, email address, and message by email to that gallery so it can reply to you. We do this on the gallery's behalf and do not store your message in Orkest. The gallery handles your enquiry under its own privacy practices.

4. Why we use personal data

We use personal data to:

• create and administer accounts, organizations, roles, and invitations;
• provide, maintain, and support Orkest, Arthie, and credit purchases;
• review Orkest Pay eligibility applications;
• analyze how Orkest is used and improve it;
• secure accounts and systems and prevent fraud and abuse;
• communicate with you, respond to support, and handle privacy requests; and
• comply with legal, tax, and accounting duties and establish, exercise, or defend legal claims.

We do not make decisions about you that have legal or similarly significant effects solely by automated means.

For people in the European Economic Area, the United Kingdom, and Switzerland: we rely on performance of a contract to provide your account, Arthie, and credits you buy; on legal obligation for tax, accounting, and legal duties; on our legitimate interests to secure the service, prevent fraud, analyze use, and improve and promote Orkest; and on consent where we ask for it.

5. How we disclose personal data

We disclose personal data to service providers that process it on our behalf, including AI model providers, hosting, database and storage, email, analytics, error reporting, payments, bot protection, and internal support tools. The current list is at https://platform.orkestai.com/privacy/subprocessors. We also disclose personal data to recipients that authorized users choose through workspace permissions; to professional advisers; to authorities when the law requires it or when needed to protect rights, safety, or systems; and in connection with a merger, financing, acquisition, or sale of the business.

Stripe processes Orkest credit purchases for us. To take your payment, it receives your name, email address, billing address, payment card details, and any tax ID you enter, and it uses them to process the payment and prevent fraud. Stripe processes this data in the United States and other countries where it operates.

If you pay a gallery through an Orkest payment link or invoice, our Payment Privacy Notice explains how we, Stripe, and the gallery handle that payment.

Stripe, for credit purchases, and Cloudflare, for bot protection, also act as independent controllers for limited purposes described in their own privacy notices.

We do not sell personal data.

6. Arthie and AI-assisted features

Arthie's replies are generated by AI models from Anthropic. When you use Arthie, your message, the records Arthie needs to answer it, and the recent conversation history are sent to Anthropic. We also send conversation text to OpenAI to create embeddings used for search, which we store in our own database.

From Arthie conversations, including the public Arthie demo on our website, we use AI to derive short notes about the person we are talking with, such as their role, needs, questions, the tools they use, and budget or pricing signals. We use these notes to tailor Arthie's answers to you, to suggest a workspace type when you sign up, to tell other visitors, without names or contact details, what similar galleries or artists have described, and to understand interest in Orkest. We rely on our legitimate interest in improving and promoting Orkest. You can object at any time by writing to privacy@orkestai.com, and we will stop deriving and using notes about you.

7. Cookies, local storage, and device signals

Orkest uses session and authentication technologies and local storage that are needed to sign users in, keep a session, remember settings, and protect the service. We use browser and device characteristics, sometimes called device or browser fingerprinting, and Cloudflare Turnstile to detect fraud, prevent abuse, and tell people from automated bots, including on our public website and our sign-up and chat forms, under our legitimate interest in protecting the service.

We use analytics to produce statistics about pages and visits, and we record product usage events linked to your account to run and improve Orkest.

If you are in the European Economic Area, the United Kingdom, or Switzerland, we load analytics and browser error reports only after you accept them, and you can change your choice at any time in Cookie settings.

We do not use advertising cookies, and we do not knowingly permit third-party advertising companies to collect activity through Orkest over time and across unrelated websites. Orkest does not respond to browser Do Not Track signals because there is no uniform standard for interpreting them.

8. International processing

Orkest is operated from the United States, and personal data may be processed in the United States or another country where we or our service providers operate. For personal data transferred from the European Economic Area, the United Kingdom, or Switzerland, we rely on the European Commission's Standard Contractual Clauses, with the UK Addendum and Swiss amendments where they apply, and, where a provider is certified, on the EU-U.S. Data Privacy Framework and its UK and Swiss extensions. When an organization in those regions uses Orkest, the Standard Contractual Clauses in Section 3 of the Terms of Service cover its transfer to us. You may contact privacy@orkestai.com to ask for a copy of the relevant safeguard.

9. Retention

We keep personal data only for as long as needed for the purposes in this Policy, taking into account account status, your instructions, security needs, and legal, tax, accounting, and dispute duties. In general:

• account data, workspace content, Arthie conversations, and usage data are kept while the account is active and for a limited period after closure;
• Orkest Pay eligibility data is kept while Orkest Pay is active and as long as financial record-keeping law requires, and data from declined applications only as long as needed to document the decision;
• purchase and credit records are kept as tax and accounting law requires.

When data is no longer needed, we delete or de-identify it, subject to lawful exceptions.

10. Security

We use administrative, technical, and organizational safeguards designed to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure.

11. Your choices and rights

Depending on your location, you may have the right to access, correct, or delete your personal data, to restrict or object to certain processing, to receive certain data in a portable format, to withdraw consent where consent is the basis, and to complain to a data-protection authority. To make a request, email privacy@orkestai.com. We may ask for information needed to verify your identity. If an organization controls the relevant workspace data, we may direct the request to that organization.

If you are in Mexico, you have the rights of access, rectification, cancellation, and opposition (ARCO rights), and you may revoke your consent or ask us to limit the use or disclosure of your personal data. Email privacy@orkestai.com with your name, your account email, the right you are exercising, and the data concerned. We respond within the periods set by the Federal Law on the Protection of Personal Data Held by Private Parties. We use your personal data mainly to provide, secure, and support Orkest and to meet legal duties. Our secondary purposes are (a) sending product news and marketing messages, if we send them, and (b) deriving notes from Arthie conversations, as described in Section 6. You may refuse either at any time through the unsubscribe link or by writing to the same address, without affecting your use of Orkest. Our service providers process data on our behalf, so sharing data with them does not require your consent. Stripe processes your credit purchase payment for its own purposes as a transfer necessary to provide the service you asked for. We make no other transfers without your consent except where the law allows. We do not ask for sensitive personal data. If you apply for Orkest Pay, we ask for your express consent to process the financial and tax data in that form.

If you are a California resident: we do not sell personal data or share it for cross-context behavioral advertising.

12. Children

Orkest is intended for people who are at least 18 years old. We do not knowingly collect personal data from children. If you believe a child has provided personal data, contact us.

13. Changes to this Policy

We may update this Policy. We will publish the current version and its effective date and notify account holders of material changes.

14. Questions and data-processing terms

For privacy questions or rights requests, contact privacy@orkestai.com. When we process personal data on behalf of an organization using Orkest, our data processing terms are in Section 3 of the Terms of Service. Our current list of service providers is at https://platform.orkestai.com/privacy/subprocessors.