Privacy Policy

Last updated: October 28, 2026

This policy explains what personal information Orvanta collects when you use orvantahq.io and app.orvantahq.io (the “Service”), why, where it is stored and how long it is kept. Questions: orvanta.contact@gmail.com.

What we collect

• Your account: your name and e-mail address. If you sign up with a password, we store only a scrambled (hashed) version of it. If you sign in with Google, Google gives us your name and e-mail address; we never see your Google password.
• Your workspaces: the people you invite (name, e-mail, role), your agents' names and missions, your guardrails, your approval decisions and the activity log.
• What your agents send: their activity (actions, results, errors, costs) and, when you choose to send them, the texts an agent received and produced. These texts can contain personal information about your own customers; you decide what is sent.
• Connections you set up: your n8n address and API key (to read your workflows), and the chat webhook address where we post your alerts.
• The website form: the name, e-mail, company and message you send us when you ask for help.
• Technical data: IP addresses and request details in our server logs, used for security and to limit abuse.

Cookies

We use one cookie, to keep you signed in, and a short-lived one during Google sign-in. No advertising cookies, no tracking, no analytics tools.

How we use it

Only to run the Service for you: show your agents' activity, apply your guardrails, send your alerts, keep the Service secure, and talk to you about your account. We do not sell or rent personal information, we do not use it for advertising, and we do not use it to train AI models.

Who processes it for us

• Google Cloud hosts the Service and its backups, in the United States (Iowa).
• Anthropic (Claude) re-reads agents' texts when the AI review or the AI check is on. Only the texts being checked, the agent's mission and its instructions are sent. Under its commercial terms, Anthropic does not train its models on this data.
• Google handles “Continue with Google” sign-in, if you use it.
• Cloudflare provides our domain name service.
• Tools you connect yourself (n8n, Zapier, Slack, Microsoft Teams, Google Chat, Discord) receive what you ask us to send them.

How long we keep it

• Detailed agent activity: 90 days, then deleted automatically.
• Alerts, decisions and the activity log: as long as your workspace exists.
• Daily backups: 30 days.
• When you ask us to delete your account, we delete it and your workspaces' data within 30 days; copies in backups disappear as backups expire.

Security

The Service is only reachable over https. Passwords are hashed, sign-in attempts are limited, and every request is checked against your workspace, so one customer can never see another's data.

Your rights

You can ask us at any time to access, correct, export or delete your personal information, or object to how we use it, by writing to orvanta.contact@gmail.com. We answer within 30 days. If you are in the European Union or the United Kingdom, your data is transferred to the United States to provide the Service, and you can also complain to your data protection authority. If you are in California, we do not sell or share your personal information.

If your customers' personal information is in texts your agents send us, you decide what is sent and we process it on your behalf; ask us if you need a data processing agreement.

Changes

If we change this policy in a way that matters, we will tell you by e-mail or in the app before it applies.