Orchflow Privacy Policy

1. Who We Are

Orchflow is operated by Krishna, an individual based in Wellington, New Zealand. No business entity has been registered for Orchflow at this time.

Contact: krishna@orchflow.io

2. What Orchflow Does

Orchflow is a managed data preprocessing service for ML and data engineering teams: you submit a dataset and select preprocessing steps to apply, and we return the processed output. Orchflow is currently in pre-launch — the public site (orchflow.io) collects a waitlist signup only. The application (app.orchflow.io) is not yet publicly available.

3. Information We Collect

What we do NOT collect (currently)

• No accounts, passwords, or user profiles on the public site

• No payment information

• No datasets or files — the processing app isn't public yet

• No precise location data

Waitlist data (what we actually collect right now)

When you join the waitlist at orchflow.io, we collect your email address and your organisation name. This is used solely to notify you when Orchflow becomes available and to send you the confirmation email described below.

Confirmation email

After you join the waitlist, we automatically send a confirmation email to the address you provided. That email includes a link you can use to remove your email and organisation name from our records at any time, without needing to contact us.

Analytics data

We do not currently run any analytics on orchflow.io. If that changes, this section will be updated to name the tool and what it collects before it goes live.

Future state (once the app is live)

When app.orchflow.io becomes generally available, this policy will be updated to cover account data, submitted datasets, processed output, and session cookies. Nothing beyond the waitlist data above is collected today.

4. How We Use Information

• To notify you when Orchflow is available

• To send the waitlist confirmation email and honour removal requests

• We do not sell, rent, or share your email or organisation name with third parties for marketing purposes

• We do not use waitlist data for any purpose beyond the above

5. Cookies

Orchflow's landing page does not currently set any cookies. If session cookies are introduced when the app goes live, this section will be updated with a full cookie table before that happens.

6. Third-Party Processors

Hetzner's infrastructure is based in the EU. As a result, waitlist data may be processed on servers outside New Zealand as part of normal service operation (see Section 9, International Transfers).

7. Data Retention

• Waitlist entries (email, organisation name): retained until Orchflow launches and you’re notified, or until you remove yourself via the link in your confirmation email, or until you email us to request removal — whichever comes first.

• Server access logs: retained for 30 days for security and debugging.

• Waitlist entries have no fixed maximum retention beyond "until launch or removal" — they are deleted whenever you use the removal link, or when you’re notified of launch and the waitlist is retired.

8. Your Rights

Under the New Zealand Privacy Act 2020, you have the right to:

• Ask us to confirm what personal information we hold about you

• Access that information

• Ask us to correct it if it's wrong

• Ask us to delete it — you can do this yourself using the link in your waitlist confirmation email, or by emailing krishna@orchflow.io

We will respond to any request within a reasonable timeframe, and in any event within 20 working days as required under the Act.

If you are located outside New Zealand (e.g. EEA/UK), you may have additional rights under GDPR (access, rectification, erasure, restriction, portability, objection) or other local law. Given Orchflow currently targets the New Zealand market, we have not built out a full GDPR/CCPA compliance module.

9. International Transfers

Because our hosting provider (Hetzner) operates infrastructure in the EU, waitlist data may be transferred to and processed outside New Zealand. We take reasonable steps to ensure any such transfer is protected consistent with New Zealand Privacy Act 2020 requirements (Information Privacy Principle 12).

10. Children

Orchflow is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a child has submitted information to us, contact krishna@orchflow.io and we will delete it.

11. Security

• Data in transit to orchflow.io is protected via HTTPS/TLS.

• We do not store passwords or account credentials today, since no accounts exist yet on the public site.

• Once the app is live, session cookies will be configured with Secure, HttpOnly, and SameSite=Lax, and output download links will use signed, time-limited URLs rather than persistent credentials.

• If we become aware of a data breach affecting your personal information, we will notify affected individuals and, where required, the Office of the Privacy Commissioner, in line with the Privacy Act 2020's notifiable privacy breach requirements.

12. Changes

We may update this policy as Orchflow develops — particularly once the app becomes generally available and starts processing account data and datasets. Material changes will be posted here with a new "Last updated" date. If changes are significant, we’ll notify waitlist subscribers by email.

13. Contact

Email: krishna@orchflow.io

For any privacy request — access, correction, deletion — email us or use the removal link in your waitlist confirmation email. We aim to respond within 20 working days.