What we collect, why, and how we protect it.

Orchestra Engine Inc.

We deliver software for monitoring and controlling GenAI interactions in professional settings, primarily for law firms and legal departments. We operate the Ovna platform at orchestraengine.com and its associated services (the "Platform").

We follow the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's privacy law for businesses collecting and handling Personal Information. If you're outside Canada with stricter local rules, you may have additional rights — seek independent legal advice before using the Platform.

By using the Platform, you acknowledge you have read and consent to the collection and use of Personal Information described here. If you do not consent, you must not use the Platform.

By category of user.

Visitors

When you visit our website: IP address, timestamp, pages visited, interactions with content, session duration, geolocation, browser/device info, and network activity.

Browser extension users

When you install our Chrome extension for real-time GenAI detection, in addition to the visitor data: browser type/version, extension configuration, AI platform access patterns (ChatGPT, Claude, Gemini), timestamps and frequency of AI interactions, user context selections (client, matter), and policy decision acknowledgments and overrides.

Registered users

When you register and configure services: name, email, employee/user ID, role and permission information (administrator, compliance officer, user), organizational assignments (client, matter, group), preferences and notification settings, and any feedback or comments you share.

Organization administrators

Admins configuring Ovna provide: policy documents and compliance requirements, client and matter information, AI tool allowlists and blocklists, user assignments, custom detection rules and risk thresholds, and audit and reporting configurations.

Monitored AI interactions — when your org enables audit mode

If your organization configures Ovna for audit purposes, we may also collect: prompts submitted to AI platforms, AI platform responses, risk scores and policy violation flags, detection metadata, user decisions (accept, override, cancel), and justification text for policy overrides. Your organization controls what interaction data is collected and retained — contact your administrator for specifics.

Nine purposes — and one refusal.

1. To provide and administer the Platform: real-time GenAI detection, policy enforcement, hierarchical policy resolution, user context management.
2. To create, maintain, and monitor user accounts and organizational hierarchies.
3. To provide technical support and communicate updates.
4. To enforce organizational policies and detect violations: privileged or confidential content, unauthorized AI tool usage, inadvertent disclosure.
5. To generate audit trails and compliance reports — tamper-resistant decision logging, regulatory reporting, attorney ethics compliance, bar association requirement fulfillment.
6. To share with third-party service providers supporting service delivery.
7. To undertake research and development to improve our products and services.
8. To fulfil the purposes described to you at the time of collection.
9. To comply with applicable law — fraud prevention, security investigations, risk assessments, regulatory compliance.

How we hold it.

Personal Information is stored on third-party servers located in Canada and the United States. When data is transferred to the U.S., it becomes subject to the U.S. CLOUD Act and other applicable laws.

Security measures

• Encryption — AES-256 at rest, TLS/SSL in transit.
• Authentication — JWT-based with role-based access control and MFA.
• Audit trails — tamper-resistant logging with cryptographic integrity verification.
• Network security — firewalls and intrusion detection.
• Access controls — principle of least privilege.
• Enterprise providers — Supabase, Redis Cloud, and other vetted services.

If we discover a security incident that compromises Personal Information, we will notify affected users and applicable regulatory authorities as required by law — and, for legal professionals, consistent with professional responsibility requirements.

Seven years after purpose ends.

We retain Personal Information while it is needed to fulfil the intended purpose, and for seven years following the cessation of that purpose. We may also retain longer where necessary for audit, legal compliance, attorney work-product preservation, litigation hold, or fraud prevention.

Our retention periods are designed to meet or exceed state bar association requirements and federal rules of civil procedure. Contact your administrator for organization-specific configurations.

Who we share with, and what for.

Data storage & infrastructure

Supabase — primary database and authentication. Redis Cloud — caching and session management. Docker — application containerization.

AI & processing

Google Gemini AI — document policy extraction and analysis. Docling — document OCR and text extraction.

Analytics & monitoring

Sentry — error tracking and performance monitoring. PostHog — analytics and user behavior insights.

We may also share Personal Information with cloud and security partners, support and service-delivery vendors, research collaborators, professional advisors (accountants, consultants, lawyers), and compliance partners — always for the purposes described here.

Six rights, plainly stated.

1. Confirm the collection and use of your Personal Information.
2. Access your Personal Information.
3. Correct Personal Information that is inaccurate or incomplete.
4. Withdraw consent to our use — including unsubscribing from communications.
5. Non-discrimination — we will not profile, categorize, or retaliate against you for exercising any of these rights.
6. File a complaint with the Office of the Privacy Commissioner of Canada or your provincial privacy authority.

To exercise these rights, write to team@orchestraengine.com. We respond within 30 days of receipt, and may verify your identity before fulfilling requests. If we need more time, we'll tell you why.

Additional considerations for our primary users.

Attorney-client privilege

Ovna monitors content to detect potential privilege violations. However, transmission of privileged information through AI platforms may constitute waiver of privilege regardless of our monitoring. Consult appropriate legal counsel.

Professional responsibility

Attorneys using Ovna remain independently responsible for compliance with applicable rules of professional conduct — confidentiality, competence, and supervision of non-lawyer assistants.

Bar association requirements

Jurisdictions vary in their requirements for AI tools and technology competence. Ovna provides audit trails and compliance reporting; users should independently verify compliance with local rules.

Two short notes.

Children's privacy. Our services are not meant for people under 16. We do not knowingly collect Personal Information from children under 16. Parents and guardians: please monitor your children's internet usage.

Changes to this Policy. When we make material changes, we'll post the updated policy with a summary of what changed, send email notice (if you've provided an address), post a notice on the Platform, and — for significant changes affecting legal professional users — provide additional notice through appropriate channels. Updates take effect 30 days after posting unless otherwise specified.

Ontario, Canada.

This Policy is governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein. Disputes are subject to the exclusive jurisdiction of the courts of Ontario — provided that nothing herein prevents us from seeking injunctive relief in any jurisdiction to protect our intellectual property or confidential information.

Reach our privacy officer.

For questions about this Policy, requests to exercise your rights, complaints about how we handle Personal Information, or to ask about data collected by your organization's Ovna deployment (administrator first):

Email: team@orchestraengine.com

To protect your privacy, we will verify your identity before providing access to your Personal Information or responding to your privacy requests.