Privacy Policy

Orastra is operated by Ramya Shripathi, trading as Orastra, Shriram Spandhana, Off Wind Tunnel Road, Challaghatta, Bengaluru, Karnataka 560037, India. This policy explains what personal data we collect, why, who we share it with, and what rights you have.

Orastra handles two different kinds of personal data, and the distinction decides who is responsible for what. Data about YOU — the person who signs up — we decide the purposes for, so we are the controller. Data about YOUR CUSTOMERS — the people who call, message, or chat with your AI employee — we only handle on your instructions, so you are the controller and we are your processor.

If you have any question about this policy, or want to exercise a right described in section 8, contact hello@orastra.tech.

We collect only what the product needs to work. Concretely:

We do not collect special-category data (health, biometrics, religion, and similar) on purpose. If you put such information into your knowledge base or a customer does so in a conversation, it is processed as ordinary content — so please do not use the service for it unless you have your own lawful basis.

If you install our chat widget on your own site, it loads from our servers and behaves as follows, which you should reflect in your own privacy notice:

• It sets no cookies and no advertising identifiers on your visitors' devices.
• It stores the current conversation in the browser's session storage so a visitor who navigates between your pages does not lose the thread. That is cleared when they close the tab.
• Messages a visitor sends are transmitted to us and processed exactly like any other conversation on your account — you are the controller, we are your processor.
• It records the visitor's IP address transiently for rate limiting. It is not stored against the conversation.
• It only answers on the domains you explicitly allow.

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

Your AI employee is powered by Anthropic's Claude models. To answer a message, we send the model the conversation, the relevant parts of your knowledge base, and your business profile. We do not send your stored access tokens, your password, or other customers' data.

Anthropic processes this as our sub-processor under their commercial terms, which prohibit using submitted content to train their models.

Automated decisions your AI employee makes — booking an appointment, escalating to a person, sending a reply — are configurable by you, and every action class can be set to require your approval first. No decision producing legal or similarly significant effects is made about your customers without a human in the loop where you have configured one.

We share personal data only with the following categories of sub-processor, only as needed to run the service:

We may also disclose data where we are legally required to, or to establish or defend legal claims. If we are ever involved in a merger or acquisition, personal data may transfer as part of that transaction, and we will tell you before it does.

Some of these providers are located outside your country. Where personal data is transferred internationally, we rely on the transfer mechanisms those providers offer, such as Standard Contractual Clauses.

• Account and business profile data: for as long as your account is open.
• Conversations, customer records, appointments and knowledge: for as long as your account is open, or until you delete them — whichever comes first.
• Connected-account tokens: until you disconnect that service, at which point the stored credentials are cleared.
• Billing and accounting records: as long as tax law requires us to keep them, typically several years, even after your account closes.
• Error reports: retained by our monitoring provider on a rolling window, currently 90 days.

When you close your account we delete or irreversibly anonymise your data within 30 days, except where we are required to keep it. You can ask us to delete it sooner at hello@orastra.tech.

Security measures we actually operate, rather than aspirations:

• All traffic is served over HTTPS, with HSTS enforced in production.
• Access to your workspace's data is enforced by the database itself through row-level security, not only by application code.
• Connected-account credentials are stored encrypted and are never returned to the browser.
• Inbound webhooks from Twilio and Meta are cryptographically signature-verified, so third parties cannot impersonate your customers.
• The chat widget only answers on domains you have explicitly allowed.
• Error reports are scrubbed of credentials and personal data before transmission.
• Rate limiting is applied to authentication, chat and import endpoints.

No system is perfectly secure. If a breach affects your personal data and is likely to result in a risk to your rights, we will notify you and the relevant supervisory authority without undue delay, and in any case within 72 hours of becoming aware of it where the law requires.

Depending on where you live, you have some or all of the following rights over your personal data:

• Access — get a copy of what we hold about you.
• Rectification — correct anything inaccurate.
• Erasure — have it deleted, subject to records we must keep.
• Restriction and objection — limit or object to certain processing, including processing based on our legitimate interests.
• Portability — receive your data in a machine-readable format.
• Withdraw consent — where we relied on consent, at any time, without affecting prior processing.
• Complain — to your local data protection authority.

To exercise any of these, email hello@orastra.tech. We will respond within one month. We may ask you to verify your identity first — not to obstruct you, but because handing someone else's data to an impersonator would be the exact harm these rights exist to prevent.

If you are one of our customers' customers and want your data removed, contact that business directly: they control it and we act on their instructions. Tell us and we will point you to them.

Orastra is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact hello@orastra.tech and we will delete it.

We may update this policy as the product changes. The date at the top always reflects the current version. If a change materially affects your rights, we will tell you by email or in the app before it takes effect, rather than relying on you to notice.

Privacy questions and data-rights requests: hello@orastra.tech

Everything else: hello@orastra.tech

Postal: Ramya Shripathi, trading as Orastra, Shriram Spandhana, Off Wind Tunnel Road, Challaghatta, Bengaluru, Karnataka 560037, India