Privacy Policy

Orchcast ("we", "our", "us") operates an AI-powered Software-as-a-Service (SaaS) platform for brand content generation. Our platform helps marketing teams generate, localize, approve, and publish content across channels from a single subscription-based workspace.

This Privacy Policy explains how we collect, use, and protect your information when you use our services. It applies to all users of the Orchcast platform, including workspace owners, administrators, and team members invited to a workspace.

By creating an account or using our services, you agree to the practices described in this policy.

• Account information:Your name, email address, and password when you register.
• Workspace & team data:Workspace names, team member details, and role assignments.
• Content you create:Text, images, videos, and voice samples you upload or generate inside the platform.
• Brand profile data:Brand voice samples, tone preferences, keywords, and style guidelines you provide. This data is used solely to personalize AI-generated content for your workspace; it is not shared outside our infrastructure except as described in the Third-Party Services section.
• Usage data:How you interact with the platform, including pages visited, features used, and actions taken.
• Billing information:Payment processing is handled by Stripe. We do not store your card number, CVV, or full payment details.

Orchcast, Inc. is headquartered in British Columbia, Canada. We collect and process personal information in accordance with the British Columbia Personal Information Protection Act (PIPA) and, where applicable, the federal Personal Information Protection and Electronic Documents Act (PIPEDA).

We rely on the following legal bases for processing personal information:

• Contractual necessity: processing required to provide the service you requested and to fulfill our obligations under our Terms of Service.
• Legitimate interests: operating, securing, and improving the platform, provided those interests are not overridden by your rights and freedoms.
• Legal obligation: compliance with applicable laws, tax and accounting rules, and regulatory requirements.
• Consent: where required by law, we obtain your explicit consent before collecting or using personal information for specific purposes (e.g., marketing emails, optional integrations).

You may withdraw consent at any time by contacting us or updating your preferences. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

When you connect your LinkedIn account to publish content, we collect the minimum data required to perform that action on your behalf. Our LinkedIn API integration is registered under the application name ChannelRelay. When authorising access from LinkedIn, you may see ChannelRelay listed as the application requesting permission. ChannelRelay is operated solely by Orchcast and is used exclusively to enable the LinkedIn publishing features within our platform.

• What we collect:Your LinkedIn profile ID, OAuth access token, and the LinkedIn Page details you authorise.
• How we use it:Solely to publish content to the LinkedIn pages you select. We do not read your private messages, connections, or other profile data.
• What we never do:We do not store your LinkedIn password. We do not share your LinkedIn data with any third party.
• Revoking access:You can disconnect your LinkedIn account at any time from Account Settings → Integrations. This immediately revokes our access token.

Our use of LinkedIn API data complies with the LinkedIn API Terms of Use. We only request the minimum permissions required to publish content.

• To provide, maintain, and improve the platform.
• To generate AI content using your brand profile and voice samples.
• To publish content to connected platforms (LinkedIn, WordPress) on your behalf.
• To send transactional emails related to your account, billing, and security.
• To provide customer support when you contact us.
• To analyse usage patterns and improve platform features (aggregated, never sold).

We integrate with the following third-party services to operate the platform. Each provider has its own privacy policy governing their data handling.

For a complete list of subprocessors, including location, data types, and privacy policies, see our Subprocessor List. For full data processing terms, see the Data Processing Addendum.

• All data is stored on encrypted servers using industry-standard AES-256 encryption at rest.
• Data in transit is protected with TLS 1.2 or higher.
• We use role-based access controls to limit who can access your data internally.
• We do not sell, rent, or trade your personal data to anyone.

• We maintain an incident response program designed to detect, escalate, and respond to potential personal-data breaches.
• If a breach presents a real risk of significant harm to individuals, we will notify affected users and the applicable privacy commissioner (e.g., the BC Office of the Information and Privacy Commissioner) without undue delay, and in accordance with PIPA and PIPEDA.
• Notifications will include a description of the breach, the types of information involved, steps we have taken or will take to mitigate harm, and steps users can take to protect themselves.
• We will also cooperate with regulatory authorities and provide updates as appropriate.
• If a breach does not meet the threshold for individual notification, we will document the incident and review our controls to prevent recurrence.

• Your data is retained for as long as your account remains active.
• If you delete your account, all associated data is permanently removed from active systems within 30 days. You can request an export before deletion from Account Settings (Account → Export my data).
• Billing records may be retained for up to 7 years as required by financial regulations.
• You may request early deletion by contacting us at the address below.

Under BC PIPA and PIPEDA, you have the right to:

• Access:Request a copy of the personal information we hold about you. We will provide it in a machine-readable format within 30 days.
• Correction:Request correction of any inaccurate or incomplete personal information we hold about you.
• Deletion:Request deletion of your account and personal data. You can delete your account at any time from Account Settings (Account → Delete my account). Remaining data is purged from active systems within 30 days, subject to legal retention limits.
• Portability:Request an export of your data in a JSON format using the Account Settings export feature.
• Withdraw consent:Withdraw consent for optional processing (e.g., marketing emails) at any time without affecting prior processing.

British Columbia residents (PIPA): You may contact us at the address below to exercise any of these rights. If you are not satisfied with our response, you may contact the BC Office of the Information and Privacy Commissioner.

Other jurisdictions (PIPEDA / GDPR / CCPA): Where applicable, you may also lodge a complaint with your local data protection authority. We do not sell personal information.

• Orchcast, Inc. is based in British Columbia, Canada. Our primary servers and operations are located in Canada.
• To deliver AI generation, video rendering, and payment processing, certain personal information is transferred to service providers in the United States and other jurisdictions (e.g., Anthropic and OpenAI in the US, HeyGen operations, Stripe infrastructure).
• When we transfer personal information outside Canada, we take reasonable steps to ensure it receives a comparable level of protection, including entering into data-processing agreements with providers that include appropriate transfer safeguards.
• By using the platform, you consent to these transfers where required by applicable law.

• Our platform is intended for use by businesses and professional marketing teams. We do not knowingly collect personal information from anyone under the age of 16.
• If you believe a minor has provided us with personal data, please contact us immediately at the email below and we will delete it promptly.

We use cookies strictly for the operation of the platform. For a detailed breakdown of the cookies we use, how we use them, and how you can control them, please see our Cookie Notice.

• Authentication cookies:To keep you logged in securely across sessions.
• Session cookies:To maintain your workspace context while using the platform.

We do not use advertising cookies, cross-site tracking cookies, or any third-party analytics cookies.

• We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements.
• For material changes, we will notify you by email (to the address on your account) and by displaying a notice in the platform at least 14 days before the change takes effect.
• Minor changes (e.g. clarifications, corrections) will be noted by updating the effective date at the top of this page.
• Continued use of the platform after a change takes effect constitutes your acceptance of the updated policy.

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us:

We aim to respond to all privacy-related inquiries within 5 business days.