Privacy Notice

For public-website, account, security, support, billing, and direct service-operation purposes that Orchords determines, Orchords Operations LLC, a Nevis limited liability company, is the responsible organization/controller unless a specific notice identifies another entity.

Where a customer or tenant submits data to a hosted service and directs how Orchords handles it, that customer may be the controller or data user and Orchords may act as its processor or service provider. The applicable order, agreement, instructions, and law govern that role split.

Orchords Ltd, an Anguilla business company, owns certain Orchords trademarks, software, and other intellectual property used by the service. Ownership of those assets does not by itself make that company the controller for the processing described here.

Privacy questions and requests: privacy@orchords.com. Legal notices: legal@orchords.com.

Required fields are marked in the relevant form. If you do not provide them, we may be unable to answer the request, create an account, or provide that feature.

• To provide a requested website feature, report, account, support response, or contracted service and to take steps requested before a contract.
• To authenticate users, preserve tenant boundaries, prevent abuse, investigate incidents, and protect Orchords, users, and the public.
• To keep necessary service, consent, opt-out, audit, billing, and accountability records.
• To communicate about a request or service. Marketing is handled separately and only where a valid legal ground and required choices exist.
• To comply with law, enforce agreements, establish or defend legal claims, and respond to lawful authority requests.
• To improve reliability and usability using appropriately minimized operational information.

Depending on the activity and applicable law, the legal ground is performance of a contract or requested pre-contract steps, consent, compliance with a legal obligation, or a legitimate interest that is assessed against your rights. You may withdraw consent at any time without affecting prior lawful processing.

Access is limited to people and providers that need the data for the purposes above. Recipient classes include:

• Authorized Orchords personnel and contractors subject to confidentiality and access controls.
• Cloudflare for content delivery, security, Workers execution, and configured data storage.
• The configured email-delivery service, which may be Resend, Cloudflare Email, Google Workspace, or Google Apps Script depending on the feature and environment.
• An email-validation service, such as ZeroBounce or Kickbox, only where that validation feature is enabled.
• OpenCorporates as a public company-registry source only when an authenticated lookup or protected scheduled ingestion is invoked and that integration is configured.
• Professional advisers, auditors, transaction counterparties, and public authorities where necessary and lawful.

We do not sell personal data or use it for third-party behavioural advertising. A report-access link can be viewed by anyone who receives it, so keep the link private and share it only with intended recipients.

The public site currently uses only storage needed for security and requested functionality. This may include Cloudflare challenge or Turnstile data and, after sign-in, an essential Orchords session identifier. We do not currently deploy advertising or non-essential analytics cookies on the public site. If that changes, we will update this notice and request a choice where applicable law requires one.

We keep personal data only as long as reasonably necessary for the relevant purpose, taking account of account status, security and audit needs, opt-out effectiveness, contractual and legal duties, limitation periods, and dispute preservation. We then delete or de-identify it where feasible.

An authenticated or previously issued compliance-report link expires 30 days after generation. Link expiry is not a claim that every underlying lead, consent, security, or accountability record is automatically deleted at that time; those records follow the retention criteria above. Opt-out records may be retained so the opt-out remains effective.

Orchords and its providers may process data in countries other than yours. Where applicable law requires a transfer mechanism or additional safeguards, we use the relevant contractual, organizational, or technical measure. Using the site is not treated as consent to an otherwise unlawful transfer.

We use proportionate technical and organizational measures designed to protect personal data, including access controls, tenant separation, security logging, transport encryption, and abuse controls where implemented. No online service can guarantee absolute security. Please report a vulnerability privately to security@orchords.com.

The public compliance screening evaluates a sector selection in the browser using rule-based mappings. The selection is not submitted by the form. The screening does not determine legal applicability, compliance, liability, or penalty exposure, and it is not used to make a decision that produces legal or similarly significant effects about an individual. See the AI Engine Transparency page for its current limitations.

Rights depend on where you are and the law that applies. They may include access, correction, deletion, restriction, portability, objection, withdrawal of consent, and a complaint to a competent data-protection authority. We may need to verify identity and may retain information where a lawful exception applies.

Send a request to privacy@orchords.com and describe the service and email or account involved. We will respond within the period required by applicable law.

We may update this notice when processing or legal requirements change. The effective date above identifies the current version. We will provide additional notice of a material change where applicable law requires it.