The data controller responsible for your personal data is:
You may contact us at any time regarding your personal data at the email address above.
| Data | Source | Purpose | Legal basis |
|---|---|---|---|
| Email address, name, profile picture | Google Sign-In (OAuth 2.0) | Account creation and authentication | Contract performance (Art. 6.1.b GDPR) |
| IP address | Automatically from your browser | Rate limiting and abuse prevention | Legitimate interest (Art. 6.1.f GDPR) |
| Content you create (posts, client names, brand voice) | Entered by you | Providing the Orkly service | Contract performance (Art. 6.1.b GDPR) |
| Usage data (generated posts, styles used) | Automatically generated | Service analytics and improvement | Legitimate interest (Art. 6.1.f GDPR) |
| Feedback text | Voluntarily submitted by you | Product improvement | Consent (Art. 6.1.a GDPR) |
We do not collect sensitive personal data (health, financial, political or religious information). We do not sell your data to third parties.
Orkly integrates with the following third-party services to operate. Each has its own privacy policy:
| Data type | Retention period |
|---|---|
| Account data (email, name) | Until you delete your account |
| Generated content history | Until you delete your account or the specific records |
| IP-based rate limit records | Automatically deleted after 30 days |
| Feedback submissions | Up to 12 months, then anonymised |
Some of the third-party services listed above (OpenAI, Supabase, Google) may transfer and process your data outside the European Economic Area (EEA). Where this occurs, appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring your data is protected to the same standard as within the EU.
As a data subject under GDPR, you have the following rights:
To exercise any of these rights, contact us at jorgecdev444@gmail.com. We will respond within 30 days.
You also have the right to lodge a complaint with the Spanish Data Protection Authority (Agencia Española de Protección de Datos — AEPD) at www.aepd.es.
Orkly uses browser localStorage to store your theme preference (light/dark mode) and authentication session token. No third-party tracking cookies are set by Orkly itself.
Third-party services integrated in the platform (Google, Cloudflare) may set their own cookies subject to their respective privacy policies.
We take reasonable technical and organisational measures to protect your personal data, including:
No method of transmission or storage is 100% secure. In the event of a data breach that poses a risk to your rights, we will notify affected users and the AEPD within 72 hours as required by GDPR.
Orkly is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us at jorgecdev444@gmail.com and we will delete it promptly.
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For significant changes, we will notify registered users by email. Your continued use of Orkly after changes are posted constitutes your acceptance of the updated policy.
For any questions, requests or complaints regarding your personal data or this Privacy Policy, please contact: