Privacy Policy

Please read this Privacy Policy carefully before using our Services.

1. Introduction

Automation Technology Services, LLC, doing business as Orchai ("Orchai," "we," "us," or "our"), operates a marketing platform that plans, executes, measures, and optimizes marketing programs for business clients. This Privacy Policy explains how we collect, use, store, disclose, and protect personal information when you visit our website (launchorchai.com), use our platform, or engage with our sales, support, and marketing activities (collectively, the "Services").

By accessing or using our Services, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree, please do not use our Services.

Orchai handles personal information in two distinct capacities. The distinction determines whose privacy notice applies to you and who is accountable for your rights.

1.1 Orchai as controller

For personal information about visitors to our website, prospective clients, client personnel who use the platform, event and webinar attendees, applicants, and support contacts, Orchai determines the purposes and means of processing. Orchai is the controller, or the "business" under applicable United States state privacy laws, and this Privacy Policy governs.

1.2 Orchai as processor

For personal information about consumers that Orchai handles while delivering marketing programs on behalf of a client, including prospect and customer records a client provides, leads generated through campaigns Orchai operates for a client, and audience data used to target a client's advertising, the client determines the purposes and means of processing. Orchai is the processor, or the "service provider," acting on the client's instructions. In that capacity:

The client's privacy notice governs the relationship with the consumer, not this one.
Orchai's obligations are set out in the Data Processing Addendum at launchorchai.com/legal/dpa.
Requests to access, correct, or delete that information should be directed to the client that collected it. If you contact us and we can identify the responsible client, we will forward your request and confirm that we have done so. If we cannot identify the client from the information you provide, we will tell you.

1.3 If you interacted with a client's marketing

If you received an email, text message, or advertisement from a business that uses Orchai and you want your information removed, contact that business directly. You may also write to privacy@launchorchai.com and we will route the request. We do not have authority to delete a client's records without the client's instruction.

2. Information We Collect

2.1 Information You Provide

Contact and business information: Name, business email address, phone number, company name, job title, website, and industry, provided when you submit a form, request an audit or a call, subscribe to updates, or attend an event.
Account information: Name, business email address, role, and authentication credentials for platform users.
Communications: The content of emails, support tickets, call notes, and messages you send us, and any information you volunteer in them.
Billing information: Billing contact, billing address, and bank account details for payment by ACH. Where card payment is offered, it is handled by our payment processor and card numbers are not stored by Orchai.
Recruiting information: Resume, work history, and related information, where you apply for a role.

2.2 Information Generated Automatically

Website usage data: IP address, approximate location derived from IP address, browser and device type, referring URL, pages viewed, session duration, and interactions with forms and content.
Advertising and attribution data: Campaign, source, and click identifiers appended to links, and identifiers set by the technologies described in Section 14.
Platform usage data: Login timestamps, session records, feature usage, configuration changes, workflow and automation activity, and API call metadata.
Security and audit logs: Records of access to production systems and administrative actions.

2.3 Information We Receive from Third Parties

We may receive personal information from sources other than you, including:

Business contact and firmographic data from commercial data providers and business databases, used to identify and qualify prospective clients.
Company-level identification of business visitors to our website, derived from IP address by third-party identification services.
Aggregate campaign performance and audience reporting from advertising and analytics platforms.
Referral information provided by referral partners about a prospective client.

2.4 Information We Do Not Collect

Orchai does not seek, and asks that you do not submit:

Government identification numbers, including Social Security numbers.
Payment card numbers or full financial account credentials outside our payment processor.
Biometric data or precise geolocation.
Protected health information as defined under HIPAA. Orchai's healthcare engagements are limited to marketing activities that do not involve protected health information, and Section 3.6 of our Data Processing Addendum prohibits clients from submitting it without a separately executed addendum.
Personal information about children, as described in Section 16.

3. How We Use Your Information

Where Orchai acts as controller, we use personal information to:

Provide the Services: Create and administer accounts, authenticate users, deliver platform functionality, and provide support.
Deliver contracted work: Perform onboarding, configuration, strategy, and reporting under an Order Form.
Bill and collect: Issue invoices, process payments, and maintain financial records.
Communicate: Send service, security, billing, and change notices, including the notices required under Sections 2.4 and 2.5 of our Platform Terms.
Market and sell: Identify prospective clients, respond to inquiries, send marketing communications where permitted, measure campaign performance, and improve our own advertising. You may opt out of marketing communications at any time using the unsubscribe link or by writing to privacy@launchorchai.com.
Operate and improve the platform: Diagnose issues, monitor performance, analyze aggregate usage, and develop new functionality.
Improve our automated systems: Calibrate and improve the automated and statistical systems underlying the platform, as described in Section 3.2.
Protect the Services: Detect and prevent unauthorized access, fraud, abuse, and security incidents, and enforce our Acceptable Use Policy.
Comply with law: Meet legal, regulatory, tax, and record-keeping obligations, and respond to lawful requests.

3.1 Automated Decision-Making

Our platform makes automated decisions about advertising delivery, including which audiences to target, how to allocate budget, and what creative to serve. Those decisions are made on behalf of our clients, are directed at audience segments rather than at identified individuals in our own systems, and do not produce legal or similarly significant effects on individuals as those terms are used in applicable privacy law. Orchai does not use automated decision-making to determine eligibility for credit, housing, insurance, employment, or education, and our Acceptable Use Policy prohibits clients from doing so.

3.2 Improvement of Automated Systems

Orchai uses anonymized, de-identified, and aggregated data derived from platform activity, including campaign performance metrics, creative effectiveness signals, and system interaction data, to calibrate and improve the models underlying the platform. Orchai does not use personal information, or client data that has not been anonymized and de-identified, to train models made available to other clients without that client's prior written consent. This commitment is contractual and appears in Section 8.5 of our Platform Terms.

4. Legal Basis for Processing

Where the GDPR or UK GDPR applies, we process personal information on the following legal grounds:

Performance of a contract: To provide the platform and services a client has subscribed to, and to administer accounts and billing.
Legitimate interest: To secure the Services, prevent fraud and abuse, analyze aggregate usage, conduct business-to-business marketing, and improve our products, provided these interests do not override your rights and freedoms.
Legal obligation: To meet tax, accounting, and other legal requirements.
Consent: For optional analytics and advertising technologies where consent is required, and for electronic marketing communications where consent is required. You may withdraw consent at any time, which does not affect the lawfulness of prior processing.

Where Orchai acts as processor, the client is responsible for establishing the legal basis for processing.

We do not exchange personal information for money. Section 6 explains how "sell" and "share" apply under United States state privacy laws, where those terms are broader.

5.1 Service Providers and Subprocessors

We engage third parties to help operate the Services, including cloud hosting and storage, model and automation providers, email and messaging delivery, customer relationship management, support ticketing, analytics, and payment processing. These providers process personal information only on our behalf and in accordance with our instructions. A current list of subprocessors is available at launchorchai.com/legal/subprocessors.

5.2 Advertising and Analytics Platforms

In operating our own marketing, and in operating campaigns on behalf of clients, we transmit data to analytics providers and to search, social, programmatic, and connected television advertising platforms. This may include hashed email addresses, device and cookie identifiers, and conversion events. Depending on the configuration, these transfers may constitute sharing for cross-context behavioral advertising, or a sale, under United States state privacy laws. See Section 6.

5.3 Audience and Identity Providers

We may use audience and identity resolution providers to build, enrich, and match audience segments for advertising delivery. Where we do so on behalf of a client, the client instructs that processing and the client's privacy notice governs.

5.4 Our Clients

Where you submit information through a campaign, form, landing page, or messaging program that Orchai operates on behalf of a client, that information is provided to the client, which is the party you are dealing with.

5.5 Professional Advisors

Legal, accounting, insurance, and audit advisors, under duties of confidentiality.

5.6 Legal and Regulatory Disclosures

We may disclose personal information where required by law, regulation, subpoena, court order, or governmental request, or where reasonably necessary to investigate fraud or abuse, enforce our agreements, or protect the rights, property, or safety of Orchai, our clients, or others.

5.7 Business Transfers

In connection with a merger, acquisition, financing, reorganization, or sale of assets, personal information may be disclosed to counterparties and their advisors under confidentiality obligations, and may be transferred as part of the transaction. We will post notice of any resulting change in control of personal information and any choices you may have.

6.1 Orchai does not exchange personal information for money.

6.2 Under the CCPA as amended by the CPRA, and under comparable laws in other states, "sale" and "share" cover certain disclosures made for advertising purposes without monetary payment. Because we use analytics and advertising technologies on our website and transmit conversion and audience data to advertising platforms, we treat those activities as sharing for cross-context behavioral advertising, and in some configurations as a sale, and we provide the opt-out described in Section 6.3. The categories involved are online and device identifiers, internet and network activity information, and business contact information.

6.3 Your opt-out. You may opt out of sharing for cross-context behavioral advertising by using the "Do Not Sell or Share My Personal Information" link in our website footer, by adjusting your choices in our cookie preference tool, or by writing to privacy@launchorchai.com. We honor Global Privacy Control signals as described in Section 13.

6.4 Sensitive personal information. Orchai does not use or disclose sensitive personal information for purposes beyond those permitted without a right to limit under applicable law.

6.5 Where Orchai acts as processor. When handling personal information on behalf of a client, Orchai does not sell or share it, does not retain, use, or disclose it for any purpose other than performing the services, does not use it outside the direct business relationship with the client, and does not combine it with personal information from other sources except as permitted by law. These restrictions are contractual and appear in Section 4 of our Data Processing Addendum.

7. Data Storage and Security

We implement appropriate technical and organizational measures to protect personal information, described in detail in our Security Overview at launchorchai.com/legal/security. These include:

Encryption in transit using TLS 1.2 or higher, and at rest using AES-256 or an equivalent standard
Cryptographic hashing of authentication credentials, which are never stored in readable form
Role-based access on a least-privilege basis, with periodic review
Multi-factor authentication for administrative access
Logging and auditing of production and administrative access
Vulnerability monitoring and risk-prioritized patching
Security and data-protection diligence on vendors and subprocessors
A documented incident response program

Personal information is stored on infrastructure located in the United States.

No method of transmission over the internet or electronic storage is completely secure. While we use commercially acceptable means to protect personal information, we cannot guarantee absolute security. We encourage you to use strong, unique credentials and to enable available account protections.

Report a suspected vulnerability or security issue to security@launchorchai.com.

8. Data Retention

We retain personal information only as long as necessary to fulfill the purposes for which it was collected, or as required by law.

| Data Type | Retention Period | Disposal Method |

| --- | --- | --- |

| Prospect and lead records | 24 months after last engagement | Deletion from active systems |

| Client account and user records | Duration of the subscription, plus the 30-day export window in Section 7.5 of the Platform Terms | Deletion following the export window |

| Client data processed on a client's behalf | Per Section 11 of the Data Processing Addendum | Return or secure deletion at the client's election |

| Support and communication records | 24 months | Deletion from active systems |

| Platform access and audit logs | 12 months | Automatic expiration via log rotation |

| Website analytics data | 14 months | Automatic expiration at the provider |

| Billing and financial records | 7 years | Retained for tax and legal purposes, then deleted |

| Recruiting records | 12 months after a hiring decision, unless you ask us to keep them longer | Deletion |

| Backup archives | 30 days | Automatic expiration per provider retention policy |

All retention periods serve a defined business or legal purpose. Anonymized and aggregated data that can no longer be associated with an individual may be retained indefinitely, as described in Section 3.2.

9. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal information:

Right to access: Request the categories and specific pieces of personal information we hold about you.
Right to correction: Request that we correct inaccurate or incomplete personal information.
Right to deletion: Request deletion of your personal information, subject to legal retention requirements.
Right to portability: Request a copy of your personal information in a structured, machine-readable format.
Right to opt out: Opt out of sale, sharing for cross-context behavioral advertising, targeted advertising, profiling in furtherance of decisions with legal or similarly significant effects, and marketing communications.
Right to limit: Limit the use of sensitive personal information, where applicable.
Right to restrict or object: Restrict or object to processing in certain circumstances.
Right to withdraw consent: Withdraw consent at any time without affecting the lawfulness of prior processing.
Right to non-discrimination: We will not discriminate against you for exercising your privacy rights.

9.1 How to make a request. Email privacy@launchorchai.com with the subject line "Privacy Rights Request," or write to the postal address in Section 19. We will verify your identity using information already in our records before acting, and will respond within 45 days, extending by an additional 45 days where permitted and where we notify you of the extension.

9.2 Authorized agents. You may designate an authorized agent to submit requests on your behalf, with written authorization signed by you. We may also contact you to confirm the authorization.

9.3 Appeals. If we decline your request, you may appeal by emailing privacy@launchorchai.com with the subject line "Privacy Rights Appeal." We will respond in writing within the period required by applicable law and, if we deny the appeal, will tell you how to contact your state attorney general.

9.4 Requests concerning a client's data. See Section 1.2. We will route the request to the responsible client rather than act on it ourselves.

10. California Residents (CCPA/CPRA)

If you are a California resident, you have the rights described in Section 9 under the California Consumer Privacy Act as amended by the California Privacy Rights Act. In addition:

We do not sell your personal information for money.
We do share personal information for cross-context behavioral advertising, as described in Section 6, and you may opt out as described in Section 6.3.
We do not use or disclose sensitive personal information for purposes beyond those permitted under the CCPA.
You may designate an authorized agent to submit requests on your behalf with written authorization.
We do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age.

Categories of personal information collected, purposes of collection, and categories of recipients are described in Sections 2, 3, and 5.

11. Other U.S. State Privacy Laws

Residents of states with comprehensive privacy laws, including Virginia, Colorado, Connecticut, Utah, Oregon, Texas, Montana, Indiana, Iowa, Tennessee, Delaware, New Hampshire, New Jersey, Nebraska, Kentucky, Maryland, Minnesota, Rhode Island, and others as enacted, have rights substantially similar to those described in Section 9. We honor verified requests from residents of all United States states with applicable privacy legislation.

To appeal a decision regarding your privacy rights request, contact us at privacy@launchorchai.com with the subject line "Privacy Rights Appeal."

Orchai is organized in North Carolina and maintains its principal place of business there.

12. European Economic Area, United Kingdom, and Switzerland

Our Services are directed to businesses in the United States. If you are located in the EEA, the UK, or Switzerland and use our Services, you have rights under the General Data Protection Regulation and equivalent local laws, including those described in Section 9. Additionally:

Data controller: Automation Technology Services, LLC is the data controller for the personal information described in this Privacy Policy, except where it acts as processor under Section 1.2.
Legal bases: See Section 4.
International transfers: Your data is stored and processed in the United States. Where required, we rely on Standard Contractual Clauses or the UK International Data Transfer Addendum, available on request from privacy@launchorchai.com, and on data processing agreements with our service providers.
Right to lodge a complaint: You may lodge a complaint with your local data protection supervisory authority. We ask that you contact us first so we can try to resolve the matter.

13. Do Not Track and Global Privacy Control

Browsers transmit Do Not Track signals inconsistently and there is no common standard for responding to them, so we do not respond to Do Not Track signals. We do honor Global Privacy Control signals as a valid opt-out from sharing for cross-context behavioral advertising, for the browser and device on which the signal is received.

14. Website Analytics and Cookies

This section applies to our marketing website at launchorchai.com. We do not use advertising technologies inside the authenticated platform environment.

Our website uses cookies and similar technologies that are strictly necessary for site operation, session management, and security. These cannot be disabled.

Our website also uses optional analytics and advertising technologies, including analytics providers, tags operated by search, social, and programmatic advertising platforms, and business visitor identification services. These support aggregate traffic measurement, campaign attribution, and advertising delivery and measurement.

Optional technologies load only after consent where consent is required, including for visitors located in the European Economic Area and the United Kingdom. You can manage your choices at any time through our cookie preference tool and through your browser settings.

15. Text Messaging

Where Orchai operates a text messaging program on behalf of a client, the client is responsible for obtaining the consent required under the Telephone Consumer Protection Act and applicable state law, and the client's privacy notice and messaging terms govern that program. Mobile phone numbers and consent records collected through a messaging program are not disclosed to third parties for their own marketing purposes, and consent to receive messages is never sold or shared. You may opt out of any program by replying STOP to a message. The registered sender for a given program is identified in that program's disclosures.

16. Children's Privacy

Our Services are directed to businesses and are not intended for individuals under the age of 18. We do not knowingly collect personal information from anyone under the age of 16. If we learn we have collected such information, we will delete it promptly. Contact us at privacy@launchorchai.com if you believe we may have collected information from a child.

17. Third-Party Services

Our Services contain links to and integrations with third-party services not operated by Orchai, including advertising platforms, content management systems, customer relationship management systems, and analytics tools. Your interactions with third-party services are governed by their own privacy policies. We encourage you to review those policies before providing personal information.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make changes, we will revise the "Last updated" date above and post the updated version. Where a change materially affects how we handle personal information, we will provide additional notice, which may include email to account contacts or notice within the platform. Prior versions are available at launchorchai.com/privacy/archive.

Changes to the contractual commitments in our Platform Terms and Data Processing Addendum are governed by Sections 2.4 and 2.5 of the Platform Terms, not by this section.

19. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy, please contact us:

Automation Technology Services, LLC (dba Orchai) 233 Lanyard Lane Belmont, NC 28012

Privacy inquiries and rights requests: privacy@launchorchai.com Security matters: security@launchorchai.com General legal: legal@launchorchai.com

For data subject rights requests, email privacy@launchorchai.com with the subject line "Privacy Rights Request." We will respond within 45 days.

EEA, UK, and Swiss residents may also lodge a complaint with their local data protection supervisory authority.

Related documents

Platform Terms: launchorchai.com/legal/platform-terms
Data Processing Addendum: launchorchai.com/legal/dpa
Acceptable Use Policy: launchorchai.com/legal/acceptable-use
Security Overview: launchorchai.com/legal/security
Subprocessor List: launchorchai.com/legal/subprocessors

_Orchai Privacy Policy. Last updated August 18, 2026._