Privacy Policy

1. Who We Are

Red Orca builds AI software: Dolphin (AI voice sales agent), Oyster (security AI assistant) and Shark (organizational memory assistant). We are committed to protecting your personal data and complying with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

Data controller: Red Orca — Contact: techredorca@gmail.com

2. What This Policy Covers

This policy applies to redorca.tech, the Oyster assistant at redorca.tech/oyster, and the Dolphin platform. Where a product handles data differently, the difference is stated explicitly rather than averaged away.

3. What Data We Collect

Across the site and all products:

• Account information (email address) when you register
• Authentication data (password hashes, session tokens) — handled by Supabase, never stored by us in plain text
• Device and browser information, and your IP address, for security and abuse prevention

Oyster specifically:

• The messages you send and the answers you receive, if you are signed in
• Files, images, videos and notes you upload, and the text extracted from them
• Your IP address, to count the free daily allowance for visitors without an account
• Whether you have accepted the current user agreement, when, and which version

Dolphin specifically:

• Call transcripts and recordings you create using the platform
• Lead and campaign data you upload
• Payment information (handled by our payment provider — we never see or store card details)

4. Why We Collect It (Legal Basis)

• Contract performance (Art. 6(1)(b)) — to provide the service you signed up for, including storing your Oyster chat history and, for the free tier, using conversations to improve the model as described in §6
• Legitimate interest (Art. 6(1)(f)) — keeping the service available and preventing abuse (rate limits, daily allowances, security logging)
• Consent (Art. 6(1)(a)) — marketing emails and optional analytics cookies. You can withdraw at any time, and withdrawing does not affect your access to the service
• Legal obligation (Art. 6(1)(c)) — billing records and fraud prevention

5. Cookies & Local Storage

• Essential — login session and preferences. Always active; the service cannot work without them.
• Analytics — only set with your explicit consent.
• Oyster local storage — if you use Oyster without an account, your chat history is kept in your own browser and never sent to us. Clearing your browser data deletes it permanently; we hold no copy and cannot restore it.

6. Oyster: Your Conversations & AI Training

This section is the one most people want, so it is written plainly.

Without an account

Your conversations are not stored on our servers and are never used for training. They live in your own browser. We record only your IP address against a daily message counter, so the free allowance can be enforced. You are not asked to agree to anything.

With an account

Your conversations are stored so you can return to them, and may be used to evaluate and train Oyster's AI models. Accepting this is a condition of using the free tier — it is not an optional extra, and Oyster will not let you chat until you have accepted the current agreement. Because acceptance is required in exchange for a free service, we rely on contract (Art. 6(1)(b)) as the legal basis, not consent; we deliberately do not describe it as consent, because consent that is a condition of service would not be freely given under Art. 7(4).

Before any conversation is used for training it is automatically scanned, and any exchange that appears to contain a credential, key or other secret is discarded in full rather than redacted. No automated scan is perfect, so please do not paste real secrets, personal data about other people, or client-confidential material into Oyster.

Withdrawing

You can withdraw at any time from Settings inside Oyster. Your conversations are then excluded from every dataset built afterwards. Because acceptance is what grants access to the free tier, withdrawing also ends your chat access until you accept again; your stored history is not deleted by withdrawing, and you can delete it yourself or ask us to. A model that has already been trained cannot be untrained — withdrawal removes you from future training, not from a model that already exists.

If the agreement changes

Every acceptance is recorded against a version. If we change the agreement materially we publish a new version, previously recorded acceptances stop counting, and you are asked again before you can continue. We cannot retroactively widen what you agreed to.

Where the AI runs

Oyster's language model runs on our own server in Frankfurt, Germany. Your messages are not sent to OpenAI, Anthropic, Google or any other AI provider, and no third party receives them for their own model training.

7. Dolphin: AI Calls & Recordings

Dolphin makes automated AI voice calls. When you use it to call prospects:

• You are responsible for obtaining any consent required from call recipients under applicable law (GDPR, TCPA, and local telemarketing rules)
• Call recordings and transcripts are stored securely and are accessible only by your account
• You can delete call data at any time from your dashboard
• We do not use Dolphin call recordings, transcripts or lead data to train AI models. The training described in §6 applies to Oyster chat conversations only

8. Shark: The Browser Preview

The Shark preview on /sharkruns entirely in your own browser. The demo workspace, any document you upload and every change you make are stored in your browser's local database (IndexedDB) on your device.

• We never receive your uploaded files. PDFs and Word documents are parsed by JavaScript on your machine like any other file; no request carrying file contents is made
• Because nothing is stored on our servers, no other visitor can reach your preview data — there is nothing shared to reach
• The one exception is Ask Shark: when you ask a question, your question and the few short passages your browser selected as relevant are sent to Groq to phrase an answer. Nothing is retained by us, and no file is transmitted
• Clearing your browser storage, or using the “Reset preview” button, deletes everything permanently. We cannot recover it, because we never had it

Paid Shark deployments are separate and are covered by the agreement made with your organisation, not by this section.

9. Data Sharing & Processors

We do not sell your data. We share it only with the processors we need to run the service:

• Supabase — authentication and account records (all products)
• Hostinger — the virtual private server in Frankfurt, Germany that stores Oyster conversations, uploads and runs its AI model
• Vercel — website and application hosting
• Vapi — voice infrastructure (Dolphin only)
• Groq — language model processing (Dolphin, and Shark's Ask feature as described in §8)
• Resend — delivery of newsletter confirmation and weekly emails, described in §16
• Our payment provider — payment processing, named here once subscriptions go live (never sees your conversations)

All processors operate under data processing agreements. Oyster's conversation data is not shared with Vapi, Groq or our payment provider.

10. International Transfers

Oyster conversations, uploads and its AI model stay on our server in Frankfurt, Germany (EU). Some processors (Supabase, Vercel, Vapi, Groq and our payment provider) may process data outside the European Economic Area; where they do, transfers are covered by the European Commission's Standard Contractual Clauses or an equivalent safeguard.

11. Data Retention

• Account data — kept while your account is active
• Oyster conversations — kept until you delete them, or instantly when you delete your account from Settings
• Oyster anonymous chats — never stored by us at all; the per-IP daily counter resets every day
• Training datasets — built from conversations at the time of the build; a withdrawal excludes you from every later build
• Dolphin call transcripts and recordings — 12 months by default, deletable by you at any time
• All personal data is deleted within 30 days of account deletion

12. Your Rights (GDPR)

Under GDPR, you have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate data
• Erasure — request deletion of your data (“right to be forgotten”)
• Portability — receive your data in a machine-readable format
• Restriction — ask us to limit how we process your data while a dispute is resolved
• Object — object to processing based on legitimate interest
• Withdraw consent — at any time, for anything we do on the basis of consent (marketing, analytics cookies)
• Complain — to your local data protection authority

To exercise any right, email techredorca@gmail.com. We respond within 30 days.

Deleting your Oyster account is immediate and self-service— open Settings inside Oyster and choose “Delete my account”. That erases your account, every conversation and message, everything you uploaded, and your agreement record, which also removes you from all future training. You do not need to email us or wait 30 days.

13. Security

Data is encrypted in transit (TLS). Access to the server holding Oyster conversations is restricted to key-based administrator login. Oyster's chat history is scoped per account: signing in shows you your conversations and nobody else's. In the event of a data breach we will notify affected users and the relevant authority within 72 hours, as GDPR requires.

14. Children

Red Orca products are not directed at children and are not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

15. Changes to This Policy

We update this policy when what we do changes. The date at the top always reflects the current version. For changes that affect how your Oyster conversations are used, you will be asked to accept the new agreement in the app before continuing — a quiet edit to this page is never how we would make that kind of change.

16. The Red Orca Newsletter

Subscribing to the Red Orca newsletter (from the blog) collects only your email address, where you signed up (e.g. the blog index or an article), and the time you gave consent. We do not collect your name or any other personal data for this.

Signup uses double opt-in: submitting the form does not subscribe you. You must click the confirmation link we email you first — no newsletter is ever sent to an address that hasn't confirmed. The legal basis is your consent (Art. 6(1)(a); see §4), given at confirmation, not at form submission.

Every newsletter email contains a working, one-click unsubscribe link that requires no login and takes effect immediately — no further newsletter is sent to that address afterward. You can also ask us to remove you by emailing techredorca@gmail.com.

Your email address is retained for as long as you're subscribed, and afterward only as a record that you unsubscribed (so we don't accidentally re-email you) and as proof of the consent you gave, unless you ask us to delete it entirely. We do not use tracking pixels in newsletter emails, and newsletter delivery is handled by Resend (see §9) — your email address is shared with them only to deliver the message, not for their own marketing.

17. Contact & Complaints

For privacy questions or to exercise your rights, contact techredorca@gmail.com. If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority (for example the ICO in the UK, or the BfDI in Germany).