Privacy · draft for operator review
This draft is not yet an operative privacy notice. The legal operator, contact address, lawful bases, retention periods and provider transfer details must be confirmed before publication.
Operator: [LEGAL PERSON OR COMPANY]. Privacy contact: [WORKING EMAIL ADDRESS]. Postal address and company number, if applicable: [CONFIRM]. Last reviewed: 4 October 2026.
This notice is intended to cover visits to orvessian.com, earlier pilot waitlist requests, and accounts in the open-sign-up synthetic test pilot. A separate partner agreement and data-processing terms would be needed before a partner submits real operational or personal data through the service. The public demo contains illustrative synthetic records.
A visitor may give an email address to request access. The website and its hosting providers also process technical request information, such as IP address, browser information, timestamps and security logs needed to deliver and protect the site. [CONFIRM whether any analytics or non-essential cookies are enabled in the deployed hosting configuration.]
For pilot sign-up, the identity service handles account details, email verification, authentication and multi-factor enrolment. Orvessian keeps the account and session information needed for workspace permissions and audit controls. The portal uses necessary session and security cookies.
An admitted user can submit selected structured governance records and related identifiers. The first supervised trial is limited to agreed synthetic or explicitly non-sensitive fields; source conversations, documents and media should remain in the partner’s systems. Messages sent to the support or privacy contact will contain whatever the sender includes.
Waitlist details are used to review access requests and send related account messages. Account and technical information is used to authenticate users, enforce permissions, secure the pilot and investigate faults. Submitted pilot records are used to provide the requested workspace and evidence functions. [CONFIRM the lawful basis for each purpose and document the assessment before publication.] We do not treat a waitlist request as consent to marketing email.
The current pilot uses WorkOS for identity and account email, a Sites/Cloudflare service for the public website, Contabo for the portal/API host, DigitalOcean for the managed database and Backblaze B2 for encrypted backups. GoDaddy provides domain registration and DNS. Each provider receives only the information required for its function. [CONFIRM the current provider list, processing locations, contracts and any international transfer safeguards.]
Access requires a verified account and authenticator-app MFA. Database backups are encrypted before upload to a separate provider. The B2 bucket hides backup objects after 14 days and removes hidden versions after at least one further day, subject to its daily lifecycle processing. This backup rule is not a general retention period for accounts, waitlist requests, logs or submitted records. [CONFIRM those periods, deletion and legal-hold procedures before publication.]
The sign-in journey uses cookies needed for authentication and security. [CHECK WorkOS and hosting cookies and confirm whether any analytics or other optional technology is active.] If non-essential cookies are added, provide a separate choice before using them where required.
Depending on applicable law, a person may ask for access, correction, deletion, restriction or portability of their information, and may object to some uses. They may also complain to the relevant data-protection authority. [CONFIRM the operator’s jurisdiction, the correct authority and the contact process.] Requests should go to [WORKING PRIVACY EMAIL]. We will update this notice when the service or our practices change.