Security and your data
Where your data is held
Your saved records and documents are stored in your account's region: the European Union or North America.
It is encrypted in transit and at rest, with access controlled and logged.
Some things are held outside your region, such as a meeting while it runs, search, and parts of Astra and Rooms. Our privacy policy lists each one.
Who processes it
These providers process your data for us: Cloudflare (hosting, storage and search), TypeSafe AI (search ranking), Amazon Web Services (AI, web search and email), Deepgram (speech-to-text), Anthropic (AI models) and Stripe (payments).
They are named in our privacy policy, and a change to the list is published as a new version of it.
How one customer's data is kept apart from another's
Every customer's data is kept separate.
What leaves the platform, and when
When you record, audio streams straight from your browser to our speech-to-text provider.
Astra's AI models run on AWS: in the UK and Europe for an EU account, and in the US for a US account.
When Astra, or an AI app you connect, searches your documents, the search and short passages from the closest matches go to TypeSafe AI in the United States, to put the best results first.
When Astra looks something up on the web, it sends its search to AWS's web search service, in Ireland for an EU account and in the US for a US account. A search can include the names of the companies and people you ask about.
We share personal data only with those providers, with your own business, and with authorities where the law requires it.
Your content belongs to your business. We don't sell it or show it to other customers.
How AI is used on your content, and by whom
Astra, Orvaly's AI, transcribes meetings, writes the summaries and records, answers questions from your vault, and drafts documents when asked.
We don't use your content to train AI models, and nor do the providers that run Astra's models. Our privacy policy explains what a web search holds.
AI output can be wrong. Check anything important before you rely on it or send it on.
What you can ask for, and how
You can delete a document you own at any time. It leaves your workspace, search and AI answers straight away, and you can restore it for 30 days. A colleague's document is deleted once they approve.
When your business's account closes, we delete its data, except where the law requires us to keep it.
You can ask us to show you the personal data we hold about you, to correct it, to erase it apart from what we are required or allowed to keep, or to send you a copy in a portable format.
Write to privacy@orvaly.com. We respond within one month.
Who to write to
For a question or a request about your data: privacy@orvaly.com.
You can also complain to the Information Commissioner's Office.
Orvaly Ltd is registered as a data controller with the Information Commissioner's Office, reference ZC141714.