Privacy Policy

Last updated: September 9, 2026

Orfa AI ("Orfa AI," "we," "us," or "our") builds smbOS, an AI-powered operating system for businesses, along with related products and services for customer and sales growth, operations and service excellence, and data and financial intelligence.

This Privacy Policy explains how we collect, use, disclose, retain, and protect information when you visit orfa.ai, use our products and services, submit information to us, or otherwise interact with us.

Where Orfa AI processes information on behalf of a business customer, additional terms in the applicable customer agreement or Data Processing Agreement ("DPA") may apply.

1. Information We Collect

We collect information necessary to provide, operate, secure, and improve our Services.

1.1 Information You Provide

Depending on how you interact with Orfa AI, this may include:

• Account information, such as your name, email address, company, role, and account credentials.
• Business and contact information, such as business name, address, telephone number, and contact details.
• Billing information, such as billing address, subscription information, transaction history, and payment-related information. Payment credentials may be processed directly by third-party payment providers rather than stored by Orfa AI.
• Customer Data, including documents, files, records, messages, business information, and other content that you upload, submit, or connect to our Services.
• Information from connected services, where you authorize Orfa AI to connect to a third-party application, system, database, document store, communication platform, or other service.
• Communications, including information submitted through contact forms, demo requests, support requests, emails, or other interactions with us.

1.2 Information Collected Automatically

When you use our website or Services, we may automatically collect:

• IP address
• Browser and device type
• Operating system
• Referring and exit pages
• Usage and interaction information
• Authentication and security logs
• Performance and diagnostic information
• Information collected through cookies and similar technologies

1.3 Customer Data Processed on Behalf of Businesses

If you use Orfa AI to extract, organize, connect, analyze, or otherwise process your business information, we may process that information on your behalf. This may include documents, customer records, employee information, financial information, communications, CRM data, and information obtained from connected systems.

As between Orfa AI and the customer, the customer retains its rights in Customer Data. Where applicable, Orfa AI processes such data as a service provider or processor acting on the customer's instructions.

2. How We Use Information

We may use information to:

• Provide, operate, maintain, and secure our Services
• Authenticate users and administer accounts
• Process, extract, structure, organize, and analyze information you upload or connect
• Provide AI-powered features, including document extraction, search, summaries, answers, insights, and workflow automation
• Personalize and improve our products, and develop new features
• Provide customer support
• Communicate with you about your account, products, updates, and service-related matters
• Process subscriptions, payments, and related transactions
• Detect, prevent, and investigate fraud, abuse, security incidents, and unauthorized activity
• Enforce our agreements and protect our rights and property
• Comply with applicable legal obligations

We may also create aggregated or de-identified information that does not reasonably identify an individual and use that information for legitimate business purposes, including analytics, research, and product improvement, subject to applicable law.

3. AI Processing

Some Orfa AI products use artificial intelligence and machine-learning models to provide features such as document extraction, question answering, information retrieval, summarization, analysis, and business insights.

When you use an AI-powered feature:

• Information you provide may be processed by AI systems to produce the requested functionality
• Orfa AI may use third-party AI or model providers to support certain features
• We take reasonable steps to limit information shared with third-party providers to what is necessary to provide the applicable feature
• Customer Data is not used to train models for other customers without the customer's permission

AI-generated results may contain errors or omissions. Users should review and verify AI-generated information before relying on it, particularly for financial, legal, compliance, employment, or other consequential decisions.

4. How We Share Information

We do not sell your personal information.

We may disclose information in the following circumstances:

Service Providers. We may share information with trusted service providers that help us operate the Services, including providers of cloud infrastructure and hosting; AI and machine-learning services; databases and storage; authentication and security; analytics; communications; customer support; and payment processing. These providers may process information only as necessary to provide services to Orfa AI and are subject to appropriate contractual, confidentiality, or data-protection obligations.

Customer-Authorized Integrations. If you connect a third-party service to Orfa AI, we may exchange information with that service as necessary to provide the integration you have authorized.

Legal and Safety Reasons. We may disclose information when reasonably necessary to comply with applicable law, regulation, legal process, or lawful governmental request; enforce our agreements; detect or investigate fraud, abuse, or security incidents; or protect the rights, property, safety, or security of Orfa AI, our customers, users, or others.

Business Transactions. If Orfa AI is involved in a merger, acquisition, financing, reorganization, sale of assets, or similar corporate transaction, information may be transferred as part of that transaction, subject to applicable law and appropriate protections.

5. Third-Party Service Providers and Subprocessors

Orfa AI may rely on third-party providers to deliver parts of the Services. These providers may include cloud infrastructure providers, AI/model providers, analytics providers, communications providers, payment processors, authentication providers, and other technology vendors.

Where required by applicable law or contract, Orfa AI will provide appropriate information regarding relevant subprocessors and their processing activities.

6. International Data Transfers

Orfa AI and its service providers may process or store information in countries other than the country in which you are located. Where applicable law requires safeguards for international transfers, we will use appropriate legal mechanisms and safeguards.

7. Data Retention

We retain information for as long as reasonably necessary to provide our Services, fulfill the purposes described in this Policy, comply with legal obligations, resolve disputes, enforce agreements, and protect our legitimate business interests.

For Customer Data processed on behalf of a business customer, retention and deletion are generally governed by the applicable customer agreement, DPA, or other contractual arrangement.

Following termination or deletion, Customer Data may remain temporarily in backup or disaster-recovery systems before being securely deleted in accordance with applicable retention and backup procedures.

Certain information may be retained longer where required by law or reasonably necessary for legitimate purposes such as fraud prevention, security, accounting, or dispute resolution.

8. Data Security

We use administrative, technical, and physical safeguards designed to protect information against unauthorized access, use, disclosure, alteration, or destruction.

However, no method of transmission, storage, or processing can be guaranteed to be completely secure. Accordingly, we cannot guarantee absolute security.

9. Your Privacy Rights and Choices

Depending on your location and applicable law, you may have rights concerning your personal information, including rights to:

• Access information we hold about you
• Request correction of inaccurate information
• Request deletion
• Request portability or export
• Object to or restrict certain processing
• Withdraw consent where processing is based on consent

The availability and scope of these rights depend on applicable law.

Where Orfa AI processes personal information on behalf of a business customer, we may be acting as a processor or service provider rather than the controller of that information. In those circumstances, requests concerning Customer Data should generally be directed to the relevant business customer.

For information that Orfa AI controls directly, you may contact us using the details below.

10. Cookies and Similar Technologies

We use cookies and similar technologies to operate and secure our website and Services; maintain sessions; remember preferences; understand how our website and products are used; and improve performance and functionality.

You can manage certain cookies through your browser settings or other controls we may provide. Disabling essential cookies may affect the availability or functionality of certain Services.

11. Children's Privacy

Our Services are designed for businesses and are not directed to children. We do not knowingly collect personal information from children in violation of applicable law.

12. Data Ownership

Orfa AI does not claim ownership of Customer Data merely because you upload, connect, or process it through our Services. The rights and responsibilities relating to Customer Data are governed by the applicable Terms of Service, customer agreement, DPA, or other applicable contract.

Orfa AI retains ownership of its own software, technology, platform architecture, trademarks, documentation, and other intellectual property.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the "Last updated" date. Where appropriate or required by applicable law, we will provide additional notice of material changes.

14. Contact Us

If you have questions about this Privacy Policy or how Orfa AI handles information, contact us at [email protected].

If you are contacting us regarding Customer Data processed on behalf of an Orfa AI customer, we may direct you to the relevant customer where appropriate.