Privacy Policy

1. Overview

This Privacy Policy explains what information DemandOrca ("we", "us", "our") collects when you use our demand-monitoring service, how we use it, and the choices you have. We are committed to handling your data transparently and in accordance with applicable data protection laws, including the EU General Data Protection Regulation (GDPR).

2. Information We Collect

We collect the following categories of information:

• Account data. When you register, we collect your name, email address, and a password (stored as a secure hash). This is required to provide and secure your account.
• Project data. The keywords you configure for each monitoring project, along with any saved opportunities and notes you create. This is the core content you entrust to the Service.
• Public Bluesky posts. To provide the Service, we collect and store public posts from Bluesky that match your project keywords. These posts are public information; we do not collect private or direct messages.
• Usage data. Basic technical data such as your IP address, browser type, and pages visited, used to operate and secure the Service.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service, including collecting, classifying, and clustering demand signals for your projects.
• Authenticate your account and keep the Service secure.
• Communicate with you about your account, the Service, and important updates.
• Improve the Service, including its classification and scoring accuracy.
• Comply with legal obligations.

We do not sell your personal data. We do not use your project keywords or saved opportunities to advertise to you or to third parties.

4. Cookies and Local Storage

We use cookies and similar technologies to keep you signed in and to remember your session. These are essential to the functioning of the Service. We do not use advertising or tracking cookies. You can disable cookies in your browser, but some parts of the Service may not function correctly without them.

5. Third-Party Services

We rely on a limited set of third-party services to operate DemandOrca:

• Bluesky. We read public posts from Bluesky's public APIs to collect demand signals. We do not access your Bluesky account unless you explicitly connect it.
• Hosting and infrastructure. Our servers and database are provided by a hosting provider, which processes data on our behalf under a data-processing agreement.
• Optional AI classification. When enabled, we may send anonymized post text to an AI provider to improve classification. This is used solely to provide the Service.

These providers process data only to the extent necessary to provide their services to us and are bound by confidentiality and data-protection obligations.

6. Data Retention

We retain your account and project data for as long as your account is active. Public posts we collect are retained to provide ongoing monitoring and historical analysis. When you delete your account, we delete or anonymize your account and project data within a reasonable period, except where we are required to retain it by law.

7. Your Rights (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have the following rights under the GDPR:

• Access. Request a copy of the personal data we hold about you.
• Rectification. Correct inaccurate or incomplete data.
• Erasure. Request deletion of your personal data.
• Restriction. Restrict how we process your data in certain circumstances.
• Portability. Receive your data in a structured, machine-readable format.
• Objection. Object to processing based on legitimate interests.
• Withdraw consent. Withdraw any consent you have given at any time.

To exercise any of these rights, contact us at hello@demandorca.com. We will respond within one month. You also have the right to lodge a complaint with your local data protection authority.

8. Data Security

We take reasonable technical and organizational measures to protect your data, including encryption in transit, secure password hashing, and access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Children's Privacy

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

10. International Transfers

Your data may be processed in countries other than your own. Where we transfer personal data outside the EEA, UK, or Switzerland, we rely on appropriate safeguards, such as standard contractual clauses, to ensure your data is protected to a comparable standard.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will revise the "Last updated" date at the top of this page and, where appropriate, notify you by email. Your continued use of the Service after changes take effect constitutes acceptance of the revised policy.

12. Contact

If you have questions about this Privacy Policy or how we handle your data, contact us at hello@demandorca.com.