Privacy Policy

1. Scope of This Policy

This Privacy Policy applies to:

• Visitors to our website
• Users who create an ORVO account
• Administrators who configure ORVO
• Organizations that connect systems to ORVO
• Individuals whose information may appear in connected systems
• Users who contact us for support, sales, billing, or product questions

This Privacy Policy does not apply to third-party websites, services, platforms, or applications that ORVO does not control.

Third-party systems connected to ORVO may have their own privacy policies, security terms, data handling practices, and contractual obligations.

2. Information We Collect

We collect information in several ways: directly from you, automatically through use of ORVO, and from systems that your organization connects to ORVO.

The exact information collected depends on your configuration, integrations, subscription, permissions, and use of the platform.

3. Account and Profile Information

When you create an account, sign in, request access, start a trial, book a demo, or communicate with us, we may collect:

• Name
• Email address
• Phone number
• Job title
• Company name
• Company size
• Workspace or tenant name
• Billing contact information
• Support contact information
• Account role or permission level
• Login and authentication metadata
• Communication preferences
• Any other information you choose to provide

4. Authentication Information

ORVO may use third-party authentication providers, such as Auth0, Microsoft, Google, or other identity providers.

We do not intentionally collect or store your password for those third-party identity providers.

We may collect authentication-related metadata, such as:

• User ID
• Email address
• Identity provider
• Login time
• Session metadata
• Account status
• Role or permission assignment
• Tenant or workspace association

Authentication providers may process your information according to their own privacy policies and terms.

5. Organization and Workspace Information

When an organization uses ORVO, we may collect information about the organization and its ORVO workspace, including:

• Organization name
• Tenant ID
• Workspace ID
• Connected systems
• Integration status
• Admin users
• User roles
• Configuration settings
• Archive storage settings
• Billing settings
• Notification settings
• Client workspace relationships, including MSP or multi-tenant configurations
• Support and administrative records

6. Connected System Data

ORVO works by connecting to systems your organization authorizes. These may include identity platforms, Microsoft 365, device management systems, productivity tools, collaboration platforms, ticketing systems, project management systems, CRM systems, storage systems, contract records, and other business applications.

Depending on the integration and permissions granted, ORVO may collect and process data such as:

• User accounts
• Names and email addresses
• Job titles and departments
• Employee, contractor, vendor, service account, or system account classifications
• Group and role memberships
• License assignments
• License usage metadata
• Sign-in and activity metadata
• Device and asset records
• Device ownership or assignment
• Device lifecycle information
• Application usage metadata
• Collaboration metadata
• Meeting or calendar metadata
• File, storage, sharing, or archive metadata
• Ticket, task, project, or workflow metadata
• CRM or customer-related metadata
• Contract and subscription records
• Renewal dates, vendors, owners, costs, and attachments
• Admin configuration data
• Audit and security-related metadata
• Other data made available through connected APIs

ORVO’s goal is to help your organization interpret technology-related operational metadata. However, some connected system data may include personal information.

Your organization is responsible for ensuring it has the right to connect systems to ORVO and process information through ORVO.

7. Uploaded, Imported, and Manually Entered Data

You or your organization may upload, import, or enter information into ORVO.

This may include:

• Device inventory CSV files
• Asset records
• Contract records
• Renewal records
• Vendor records
• User lifecycle records
• Onboarding records
• Offboarding records
• Archive records
• Support tickets
• Notes, comments, and internal descriptions
• Documents or attachments related to renewals, contracts, assets, or workflows
• Other files or data submitted to the platform

You are responsible for ensuring you have the right to upload, import, or enter this information into ORVO.

8. ORVO-Generated Data

ORVO may generate information based on Customer Data and connected system metadata.

This may include:

• Recommendations
• Findings
• Alerts
• Action items
• Reports
• Dashboards
• Risk signals
• License optimization suggestions
• Offboarding or archive status
• Lifecycle workflow records
• Asset reports
• Renewal reminders
• Usage summaries
• Cost or waste estimates
• Organizational context
• Chat responses
• Diagnostic outputs
• Suggested next steps

ORVO-generated outputs are based on available data and may not always be complete, accurate, or current. Your organization is responsible for reviewing and validating outputs before relying on them.

9. Chat, Prompt, and AI-Assisted Feature Data

ORVO may include conversational, diagnostic, AI-assisted, search, summarization, classification, or recommendation features.

When you use these features, we may collect and process:

• Prompts
• Questions
• Chat history
• Retrieved context
• Generated answers
• Feedback on answers
• Related metadata
• Usage logs
• Model performance and error information

These features may process data from your ORVO workspace to answer questions, summarize information, identify patterns, and generate recommendations.

We do not sell prompts, outputs, or Customer Data.

Unless we expressly state otherwise or receive your authorization, we do not use Customer Data to train public foundation models.

We may use third-party AI service providers or infrastructure providers to process prompts, context, and outputs as needed to provide ORVO features.

10. Website, Device, and Usage Information

When you visit our website or use ORVO, we may automatically collect technical and usage information, including:

• IP address
• Browser type
• Device type
• Operating system
• Referring pages
• Pages viewed
• Time spent on pages
• Clicks and navigation activity
• Login events
• Feature usage
• Error logs
• Performance logs
• Security logs
• Session metadata
• Approximate location based on IP address

We use this information to operate, secure, improve, debug, and support ORVO.

11. Cookies and Similar Technologies

We may use cookies, local storage, session storage, pixels, analytics tools, and similar technologies to:

• Keep users signed in
• Remember preferences
• Understand website traffic
• Measure product usage
• Improve performance
• Secure accounts
• Diagnose issues
• Support marketing and sales efforts

You can control cookies through your browser settings. Blocking certain cookies may affect website or platform functionality.

12. Billing and Payment Information

If you purchase ORVO, start a paid subscription, or provide billing information, we may collect:

• Billing contact name
• Billing email
• Company name
• Billing address
• Subscription details
• Plan information
• Invoice records
• Payment status
• Tax-related information

Payments may be processed by third-party payment processors, such as Stripe or similar providers.

We do not intentionally store full credit card numbers on our own systems.

Payment processors handle payment information according to their own privacy policies and security practices.

13. Support, Sales, and Communications

If you contact us, book a demo, request support, send an email, fill out a form, join a call, or otherwise communicate with us, we may collect:

• Name
• Email address
• Company name
• Message content
• Support details
• Screenshots or files you provide
• Call notes
• Product feedback
• Sales and onboarding information
• Communication history

We use this information to respond to you, provide support, improve ORVO, manage customer relationships, and follow up where appropriate.

14. How We Use Information

We use information to provide, operate, maintain, secure, and improve ORVO.

This includes using information to:

• Create and manage accounts
• Authenticate users
• Configure workspaces
• Connect third-party systems
• Sync authorized data
• Display dashboards and reports
• Generate findings and recommendations
• Run lifecycle workflows
• Support onboarding, offboarding, and archive processes
• Manage device and asset inventory
• Track renewals, contracts, and subscriptions
• Power search, chat, and diagnostic features
• Provide support
• Send service messages
• Process billing
• Monitor usage and performance
• Detect bugs, abuse, or security issues
• Improve product functionality
• Develop new features
• Comply with legal obligations
• Enforce our agreements
• Protect ORVO, our customers, and third parties

15. How We Share Information

We do not sell personal information.

We may share information in the following circumstances:

Service Providers

We may share information with vendors and service providers who help us operate ORVO, including providers for:

• Cloud hosting
• Databases
• Authentication
• Payment processing
• Customer support
• Email delivery
• Analytics
• Monitoring and logging
• Security tooling
• AI-assisted processing
• Product operations

These providers may process information only as needed to provide services to us, subject to their agreements with us.

Connected Systems

When you connect ORVO to third-party systems, information may flow between ORVO and those systems as required to provide the integration.

For example, ORVO may read records from a connected system, display them in ORVO, generate recommendations from them, or submit authorized actions back to the connected system.

Within Your Organization

Information in your ORVO workspace may be visible to authorized users, administrators, owners, team members, or MSP users based on permissions and configuration.

Your organization controls who is granted access.

At Your Direction

We may share information when you direct us to do so, such as when you export data, connect an integration, invite a user, share a report, or submit a workflow.

Legal and Safety Reasons

We may disclose information when we believe it is reasonably necessary to:

• Comply with law, regulation, subpoena, court order, or legal process
• Enforce our agreements
• Protect the rights, safety, and property of ORVO, our customers, users, or others
• Detect, prevent, or respond to fraud, abuse, or security incidents
• Resolve disputes
• Respond to lawful requests from public authorities

Business Transfers

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction, information may be transferred as part of that transaction.

16. Data Retention

We retain information for as long as reasonably necessary to provide ORVO, comply with legal obligations, resolve disputes, enforce agreements, maintain security, and support legitimate business purposes.

Retention periods may vary based on:

• Subscription status
• Workspace configuration
• Type of data
• Connected integrations
• Legal obligations
• Security requirements
• Backup and disaster recovery practices
• Customer agreements
• Support needs

If your organization terminates ORVO, we will delete or de-identify Customer Data within a reasonable period unless we are required or permitted to retain it by law, contract, backup retention practices, security needs, or legitimate business purposes.

Backups may persist for a limited period before being deleted according to normal backup cycles.

17. Data Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information.

These may include, depending on the system and configuration:

• Cloud infrastructure controls
• Access controls
• Authentication controls
• Encryption in transit
• Encryption at rest where appropriate
• Logging and monitoring
• Least-privilege access practices
• Segregation of customer workspaces
• Security review of vendors
• Incident response processes
• Administrative access restrictions

No method of transmission or storage is perfectly secure.

You are responsible for securing your own accounts, devices, connected systems, administrative credentials, permissions, and user access.

If you believe your ORVO account or workspace has been compromised, contact us at hello@orvo.io.

18. Customer Responsibilities

Because ORVO processes information from systems your organization connects, your organization is responsible for:

• Ensuring it has authority to use ORVO
• Ensuring it has authority to connect third-party systems
• Providing any required employee, contractor, customer, or vendor notices
• Obtaining any required consents
• Configuring permissions appropriately
• Managing user access
• Reviewing outputs before acting on them
• Complying with workplace privacy laws
• Complying with employment, HR, security, contractual, and records obligations
• Avoiding upload of information that should not be processed in ORVO

Do not connect systems or upload data unless you are authorized to do so.

19. Sensitive Information

ORVO is designed for technology resource planning, operational metadata, identity visibility, asset management, renewal management, archive workflows, recommendations, and related administrative use cases.

ORVO is not intended to store highly sensitive personal information unless your organization has a lawful and authorized reason to process that information through ORVO.

You should not intentionally upload or connect unnecessary sensitive information, including:

• Social Security numbers
• Government identification numbers
• Payment card numbers
• Personal financial account numbers
• Personal health records
• Medical diagnosis information
• Biometric identifiers
• Children’s personal information
• Highly sensitive personal documents
• Special categories of personal information unless legally authorized

Some connected business systems may contain sensitive information. Your organization is responsible for limiting access, configuring permissions, and ensuring ORVO is used appropriately.

20. International Data Transfers

ORVO is based in the United States.

Information may be processed and stored in the United States and in other locations where we or our service providers operate.

If you access ORVO from outside the United States, you understand that your information may be transferred to and processed in countries that may have different privacy laws than your location.

Where required, we will use appropriate safeguards for international transfers.

21. Privacy Rights

Depending on your location, you may have rights regarding your personal information.

These may include the right to:

• Access personal information
• Correct inaccurate information
• Delete personal information
• Object to certain processing
• Restrict certain processing
• Request a copy of personal information
• Withdraw consent where processing is based on consent
• Opt out of certain uses where applicable
• Appeal certain privacy decisions where applicable

To submit a privacy request, contact us at hello@orvo.io.

If your information is processed through an organization’s ORVO workspace, we may direct your request to that organization because the organization controls the workspace and the connected data.

We may need to verify your identity before responding to a request.

22. California and Other State Privacy Notices

Depending on applicable law, residents of certain states may have additional rights.

ORVO does not sell personal information.

ORVO does not knowingly share personal information for cross-context behavioral advertising unless specifically disclosed through a separate notice or consent mechanism.

If applicable, you may contact us at hello@orvo.io to exercise rights available under your state’s privacy law.

Because ORVO is primarily a business-to-business platform, many records are processed on behalf of customer organizations rather than directly controlled by ORVO.

23. Children’s Privacy

ORVO is not intended for use by children.

We do not knowingly collect personal information from children under 13.

If you believe a child has provided personal information to ORVO, contact us at hello@orvo.io and we will take appropriate steps.

24. Marketing Communications

We may send marketing or product communications to users, prospects, or customers.

You can opt out of marketing emails by using the unsubscribe link in the email or contacting us.

Even if you opt out of marketing messages, we may still send service, security, legal, billing, or transactional messages related to your account or use of ORVO.

25. De-Identified and Aggregated Data

We may use aggregated, anonymized, or de-identified information to:

• Improve ORVO
• Monitor performance
• Understand product usage
• Develop benchmarks
• Build new features
• Evaluate recommendations and diagnostics
• Improve reliability and security
• Analyze market and product trends

We will not use aggregated or de-identified information in a way that identifies you, your organization, or any individual.

26. Third-Party Links and Services

ORVO may contain links to third-party websites, documentation, integrations, or services.

We are not responsible for the privacy practices, security practices, or content of third-party services.

Your use of third-party services is governed by their own terms and privacy policies.

27. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

If we make material changes, we may notify you by email, in-app notification, website notice, or another reasonable method.

The updated Privacy Policy will be effective when posted unless otherwise stated.

Your continued use of ORVO after an update means you acknowledge the updated Privacy Policy.

28. Contact Us

If you have questions about this Privacy Policy or want to submit a privacy request, contact us at:

ORVO / Explico, Inc.

Email: hello@orvo.io