Privacy Policy

Kolerr Lab ("we," "us," or "our") operates the Orchesity platform at orchesity.com ("Service" or "Platform"). This Privacy Policy describes how we handle personal information in connection with the Service.

By using Orchesity you consent to the practices described in this Policy. If you do not agree, you must discontinue use of the Platform.

We are committed to compliance with applicable data protection law, including the EU General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

We do not sell your personal information. We do not sell, rent, or trade personal information to third parties for their own marketing purposes.

We use the personal information we collect to:

• →Create and manage your user account and authenticate your identity
• →Provide, operate, maintain, and improve the Service
• →Process subscription payments and manage billing through Stripe
• →Transmit your generation prompts to OpenAI's API to produce Generated Output
• →Send transactional emails: account verification, password reset, payment receipts, and service notifications
• →Respond to your support requests and contact form messages
• →Monitor and analyze usage patterns to improve the Service and user experience
• →Detect, investigate, and prevent fraudulent transactions, abuse, and unauthorized access
• →Enforce our Terms of Service and Acceptable Use Policy
• →Comply with applicable legal obligations, including responding to valid legal process
• →Send product update communications where you have consented or where permitted by law

Aggregate analytics. We may use de-identified, aggregated data (e.g., "X% of users generate Django scaffolds") for product research and public communications. This data cannot reasonably be used to identify individuals.

For users in the European Economic Area (EEA) or United Kingdom, we process personal data under the following legal bases:

We do not sell, rent, or share your personal information except in the following circumstances:

• →Service providers / processors: We share data with trusted third-party service providers who assist us in operating the Service (detailed in Section 6). These processors are contractually bound to handle data only as instructed and in accordance with applicable law.
• →Legal process: We may disclose information if required to do so by law, court order, or government request, or if we believe disclosure is necessary to: (a) comply with a legal obligation; (b) protect the rights or safety of Kolerr Lab, our users, or the public; or (c) detect and prevent fraud.
• →Business transfers: In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or substantially all assets of Kolerr Lab, your information may be transferred as part of that transaction. We will notify you via email or a prominent notice on the Platform prior to any such transfer.
• →Your consent: We may share your information with third parties when you have explicitly consented to such sharing.
• →Aggregate / anonymized data: We may share aggregated or de-identified information that cannot reasonably identify you.

We currently use the following sub-processors:

We enter into Data Processing Agreements (DPAs) with sub-processors where required by GDPR. We review our sub-processors periodically and will update this list as processing arrangements change.

We retain personal data only as long as necessary for the purposes described in this Policy:

Following the deletion of your account, we will delete or anonymize your personal data within 30 days, except where we are required by law to retain certain records for longer periods (e.g., financial records).

We implement technical and organizational security measures designed to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• ✓Passwords are hashed using bcrypt with a cost factor of 12 or greater — we never store plaintext passwords
• ✓GitHub OAuth access tokens are encrypted at rest using Fernet symmetric encryption before database storage
• ✓All data in transit is encrypted using TLS 1.2 or higher
• ✓Database credentials and API keys are stored as environment variables, never in source code
• ✓Access to production infrastructure is restricted to authorized personnel only
• ✓JWT session tokens have a 7-day expiry and are invalidated on logout

No method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee absolute security. In the event of a data breach that poses a high risk to your rights, we will notify you without undue delay and in accordance with applicable law.

We use the following types of cookies and similar technologies:

We do not use third-party advertising cookies or cross-site tracking technologies. We do not share your browsing data with advertising networks.

Depending on your location and applicable law, you may have the following rights regarding your personal information:

To exercise any of these rights, please email us at legal@orchesity.com with the subject line "Privacy Rights Request" and your full name and account email. We will respond within 30 days (or within the timeframe required by applicable law).

Many rights can be exercised directly through your account: you can update your profile in Settings, view your generation history, and delete your account at any time from the Settings page.

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you specific rights regarding your personal information.

In the preceding 12 months, we have collected the following categories of personal information: Identifiers (name, email, IP address); Commercial information (subscription and transaction records); Internet activity (usage logs, pages visited); Inferences about preferences (framework usage patterns).

We do not sell or share your personal information with third parties for cross-context behavioral advertising within the meaning of the CCPA.

Your CCPA rights include:

• →Right to know what personal information is collected, used, shared, or sold
• →Right to delete personal information we hold about you
• →Right to correct inaccurate personal information
• →Right to opt out of sale or sharing of personal information (we do not sell or share)
• →Right to non-discrimination for exercising CCPA rights
• →Right to limit use and disclosure of sensitive personal information

To submit a CCPA request, contact us at legal@orchesity.com. We may need to verify your identity before processing your request.

For users in the European Economic Area (EEA) and the United Kingdom, Kolerr Lab acts as the data controller for personal data processed in connection with the Service.

You have the rights described in Section 10. In addition, you have the right to lodge a complaint with your local supervisory authority. A list of EEA supervisory authorities is available at edpb.europa.eu. UK residents may contact the ICO (ico.org.uk).

Where we process your data based on legitimate interests, you may object at any time by emailing legal@orchesity.com. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

Kolerr Lab is based in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States or other countries where our service providers operate, which may have different data protection laws than your country.

For transfers of personal data from the EEA or UK to the United States, we rely on the following transfer mechanisms as applicable:

• →Standard Contractual Clauses (SCCs) approved by the European Commission, incorporated into our Data Processing Agreements with sub-processors
• →The UK International Data Transfer Agreement (IDTA) for transfers from the UK
• →Where available, the EU-US Data Privacy Framework or the UK Extension thereof

The Service is not directed to individuals under the age of 18 ("children"). We do not knowingly collect personal information from children. If you believe that we have inadvertently collected personal information from a child under 18, please contact us immediately at legal@orchesity.com and we will take steps to delete that information promptly.

We may update this Privacy Policy from time to time. When we make material changes, we will:

• →Email registered users at the address on file at least 14 days before the effective date
• →Update the "Last updated" date at the top of this Policy
• →Display a banner in the application for logged-in users

Continued use of the Service after the effective date of a revised Policy constitutes acceptance of the updated terms.

For privacy-related inquiries, requests, or to exercise your rights, please contact us. We aim to respond to all requests within 30 days.

GDPR users: if you believe we have not adequately addressed your privacy concern, you have the right to lodge a complaint with your national data protection authority.