Privacy policy
Last updated: [date] · Applies to: the Orca web app at app.[domain], the Orca apps for Android and iOS.
1. Who is responsible
The controller of your personal data is [legal name of the controller], [address], [IČO if a trader], contact [privacy@domain]. Orca is a demonstration and template platform for building team apps; it is offered free of charge, without a paid plan.
2. What we collect and why
| Data | When | Why (legal basis) | Kept |
|---|---|---|---|
| Email address, display name, password (stored only as a salted hash) | You create an account | To provide your account (contract, Art. 6(1)(b) GDPR) | Until you delete the account, then 7 days for the grace period |
| Organizations, memberships, roles, invitations, teams, tasks, comments | You or your organization create them | To provide the service (contract) | Until deleted by you or your organization's owner; organizations 30 days after deletion |
| Sign-in sessions: device name, app version, IP address, time | You sign in | Security of your account (legitimate interest, Art. 6(1)(f)) | 30 days after the session ends |
| Push token of your device | You allow notifications | To deliver notifications (contract) | Until you sign out on that device or remove the app |
| Notifications shown in the app | Events in your organizations | To inform you (contract) | 90 days after you read them |
| Audit log of actions in an organization (who did what, never the content of personal fields) | Actions in an organization | Accountability and security for the organization (legitimate interest) | According to the organization's plan; your name is removed when you delete your account |
| Server logs (IP address, request id, time; never passwords or tokens) | Every request | Operating and securing the service (legitimate interest) | 14 days |
| Demo organizations: a hashed IP address and device marker | You press Try the demo | Preventing abuse of the demo (legitimate interest) | 30 days; the demo organization itself is deleted after 3 days |
| Request for access: name, email address, note, language | You send the form on the landing page | To answer your request (steps at your request before a contract, Art. 6(1)(b)) | 12 months, then deleted |
We do not sell data, show ads, use advertising identifiers or build profiles. We use no analytics cookies; the web app sets only the cookies it needs to keep you signed in and to protect forms.
3. Who processes data for us
Hosting [Hetzner Online GmbH, Germany] · DNS and network proxy [Cloudflare, Inc.] · email delivery [Sendinblue SAS (Brevo), France] · push notifications and app integrity checks [Google Ireland Ltd. / Google LLC — Firebase] · bot protection on sign-up [Cloudflare, Inc.] · app distribution [Apple, Google]. Transfers outside the EU rely on the EU–US Data Privacy Framework or standard contractual clauses. The current list is in processors.
4. Your rights
You can access, correct, export and delete your data — most of it directly in the app (Account → Export my data, Account → Delete account). You can object to processing based on legitimate interest, restrict processing, and complain to the Czech data protection authority (ÚOOÚ, www.uoou.cz). Write to [privacy@domain]; we answer within one month.
5. Deleting your account
Account → Delete account (re-enter your password). You can cancel within 7 days by signing in; after that your account is erased: your email and credentials are deleted, your name in organizations is replaced with "Deleted user", and organizations where you were the only member are deleted. Backups that still contain the data are overwritten within [7 days / 6 months].
6. Age
Orca is for people aged 18 and over (see the terms).
7. Security
Passwords are hashed; sessions use short-lived tokens; data of different organizations is separated in the database; access is limited to the people who operate the service. If a breach puts your data at risk, we tell the authority within 72 hours and you without undue delay.
8. Changes
We publish changes here with a new date; material changes are announced in the app.