Privacy Policy

1. Who We Are

Red Orca builds AI software: Dolphin (AI voice sales agent), Oyster (security AI assistant) and Shark (organizational memory assistant). We are committed to protecting your personal data and complying with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

Data controller: Red Orca — Contact: info@redorca.tech

2. What This Policy Covers

This policy applies to redorca.tech, the Oyster assistant at redorca.tech/oyster, and the Dolphin platform. Where a product handles data differently, the difference is stated explicitly rather than averaged away.

3. What Data We Collect

Across the site and all products:

• Account information (email address) when you register
• Authentication data (password hashes, session tokens) — handled by our identity provider, never stored by us in plain text
• Device and browser information, and your IP address, for security and abuse prevention

Oyster specifically:

• The messages you send and the answers you receive, if you are signed in
• Files, images, videos and notes you upload, and the text extracted from them
• Your IP address, to count the free daily allowance for visitors without an account
• Whether you have accepted the current user agreement, when, and which version

Dolphin specifically:

• Call transcripts and recordings you create using the platform
• Lead and campaign data you upload
• Payment information (handled by Stripe — we never see or store your card details)

4. Why We Collect It (Legal Basis)

• Contract performance (Art. 6(1)(b)) — to provide the service you signed up for, including storing your Oyster chat history and, for the free tier, using conversations to improve the model as described in §6
• Legitimate interest (Art. 6(1)(f)) — keeping the service available and preventing abuse (rate limits, daily allowances, security logging)
• Consent (Art. 6(1)(a)) — marketing emails and optional analytics cookies. You can withdraw at any time, and withdrawing does not affect your access to the service
• Legal obligation (Art. 6(1)(c)) — billing records and fraud prevention

5. Cookies & Local Storage

• Essential — login session and preferences. Always active; the service cannot work without them.
• Analytics — only set with your explicit consent.
• Oyster local storage — if you use Oyster without an account, your chat history is kept in your own browser and never sent to us. Clearing your browser data deletes it permanently; we hold no copy and cannot restore it.

6. Oyster: Your Conversations & AI Training

This section is the one most people want, so it is written plainly.

Without an account

Your conversations are not stored on our servers and are never used for training. They live in your own browser. We record only your IP address against a daily message counter, so the free allowance can be enforced. You are not asked to agree to anything.

With an account

Your conversations are stored so you can return to them, and may be used to evaluate and train Oyster's AI models. Accepting this is a condition of using the free tier — it is not an optional extra, and Oyster will not let you chat until you have accepted the current agreement. Because acceptance is required in exchange for a free service, we rely on contract (Art. 6(1)(b)) as the legal basis, not consent; we deliberately do not describe it as consent, because consent that is a condition of service would not be freely given under Art. 7(4).

Before any conversation is used for training it is automatically scanned, and any exchange that appears to contain a credential, key or other secret is discarded in full rather than redacted. No automated scan is perfect, so please do not paste real secrets, personal data about other people, or client-confidential material into Oyster.

Withdrawing

You can withdraw at any time from Settings inside Oyster. Your conversations are then excluded from every dataset built afterwards. Because acceptance is what grants access to the free tier, withdrawing also ends your chat access until you accept again; your stored history is not deleted by withdrawing, and you can delete it yourself or ask us to. A model that has already been trained cannot be untrained — withdrawal removes you from future training, not from a model that already exists.

If the agreement changes

Every acceptance is recorded against a version. If we change the agreement materially we publish a new version, previously recorded acceptances stop counting, and you are asked again before you can continue. We cannot retroactively widen what you agreed to.

Where the AI runs

Oyster's language model runs on infrastructure we operate ourselves, inside the EU. Your messages are not sent to a third-party AI provider, and no third party receives them for their own model training.

7. Dolphin: AI Calls & Recordings

Dolphin makes automated AI voice calls. When you use it to call prospects:

• You are responsible for obtaining any consent required from call recipients under applicable law (GDPR, TCPA, and local telemarketing rules)
• Call recordings and transcripts are stored securely and are accessible only by your account
• You can delete call data at any time from your dashboard
• We do not use Dolphin call recordings, transcripts or lead data to train AI models. The training described in §6 applies to Oyster chat conversations only

8. Shark

Shark comes in three forms: a preview that runs in your browser, a hosted workspace that every Red Orca account includes, and paid deployments arranged directly with us.

The browser preview

The Shark preview on /sharkruns entirely in your own browser. The demo workspace, any document you upload and every change you make are stored in your browser's local database (IndexedDB) on your device.

• We never receive your uploaded files. PDFs and Word documents are parsed by JavaScript on your machine like any other file; no request carrying file contents is made
• Because nothing is stored on our servers, no other visitor can reach your preview data — there is nothing shared to reach
• The one exception is Ask Shark: when you ask a question, your question and the few short passages your browser selected as relevant are sent to our language-model provider to phrase an answer. Nothing is retained by us, and no file is transmitted
• Clearing your browser storage, or using the “Reset preview” button, deletes everything permanently. We cannot recover it, because we never had it

Your hosted workspace

Every Red Orca account includes a Shark workspace at /shark-app. It is created the first time you open it, belongs to your account's own organisation, and runs on our servers in the European Union.

• What we store — the documents and files you upload, what Shark extracts from them (decisions, commitments, risks and facts, each with the sentence it came from), the meetings and other records you create there, your Ask Shark conversations, and an activity log of what was done in the workspace
• Who can see it — the members of your organisation, according to their roles; nobody in any other organisation. Your Ask Shark conversations are private to you: not even your organisation's admins can open them
• AI processing — while hosted AI is allowed for your organisation (the default), Shark's AI features — Ask Shark, extraction, drafting and briefings — send the text they work on to our language-model provider: your questions, the passages and records looked up to answer them, and up to 16,000 characters of each document Shark processes. The provider may process it outside the European Economic Area (see §10). Your organisation's admins can switch hosted AI off under Controls, and those features then send nothing
• No training — we do not use your Shark workspace to train AI models. The training described in §6 applies to Oyster conversations only
• Connected tools — where a deployment connects mail, calendars, files or chat, the connection is read-only, limited to what you select, and its access tokens are stored encrypted
• Deleting — you can delete documents, meetings and Ask Shark conversations inside the app at any time. To have your whole workspace deleted, email us (see §12)

Paid deployments

Paid Shark deployments are separate and are covered by the agreement made with your organisation, not by this section.

9. Data Sharing & Processors

We do not sell your data. We share it only with the categories of processor we need to run the service:

• Authentication and account records — our identity provider (all products)
• Hosting and storage — the servers that run our websites, applications and Oyster's AI
• Telephony — the carrier that places and receives calls (Dolphin only)
• Speech and language model processing — used for Dolphin calls, Ask Shark in the browser preview, and the AI features of the Shark hosted workspace, as described in §8
• Email delivery — newsletter confirmation and weekly emails, described in §16
• Payment processing — Stripe; never sees your conversations

All processors operate under data processing agreements. Oyster's conversation data is never shared with our telephony, language-model or payment processors. If you need the specific providers behind these categories — for a vendor review or your own records — ask us and we will send the current list.

10. International Transfers

Oyster conversations, uploads and its AI model stay on infrastructure we operate ourselves inside the European Union. Some processors may process data outside the European Economic Area; where they do, transfers are covered by the European Commission's Standard Contractual Clauses or an equivalent safeguard.

11. Data Retention

• Account data — kept while your account is active
• Oyster conversations — kept until you delete them, or instantly when you delete your account from Settings
• Oyster anonymous chats — never stored by us at all; the per-IP daily counter resets every day
• Training datasets — built from conversations at the time of the build; a withdrawal excludes you from every later build
• Dolphin call transcripts and recordings — 12 months by default, deletable by you at any time
• Shark hosted workspace — kept until you delete it: items you delete in the app are removed, and the whole workspace is deleted when you ask us
• All personal data is deleted within 30 days of account deletion

12. Your Rights (GDPR)

Under GDPR, you have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate data
• Erasure — request deletion of your data (“right to be forgotten”)
• Portability — receive your data in a machine-readable format
• Restriction — ask us to limit how we process your data while a dispute is resolved
• Object — object to processing based on legitimate interest
• Withdraw consent — at any time, for anything we do on the basis of consent (marketing, analytics cookies)
• Complain — to your local data protection authority

To exercise any right, email info@redorca.tech. We respond within 30 days.

Deleting your Oyster account is immediate and self-service— open Settings inside Oyster and choose “Delete my account”. That erases your account, every conversation and message, everything you uploaded, and your agreement record, which also removes you from all future training. You do not need to email us or wait 30 days.

13. Security

Data is encrypted in transit (TLS). Access to the server holding Oyster conversations is restricted to key-based administrator login. Oyster's chat history is scoped per account: signing in shows you your conversations and nobody else's. In the event of a data breach we will notify affected users and the relevant authority within 72 hours, as GDPR requires.

14. Children

Red Orca products are not directed at children and are not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

15. Changes to This Policy

We update this policy when what we do changes. The date at the top always reflects the current version. For changes that affect how your Oyster conversations are used, you will be asked to accept the new agreement in the app before continuing — a quiet edit to this page is never how we would make that kind of change.

16. The Red Orca Newsletter

Subscribing to the Red Orca newsletter (from the blog) collects only your email address, where you signed up (e.g. the blog index or an article), and the time you gave consent. We do not collect your name or any other personal data for this.

Signup uses double opt-in: submitting the form does not subscribe you. You must click the confirmation link we email you first — no newsletter is ever sent to an address that hasn't confirmed. The legal basis is your consent (Art. 6(1)(a); see §4), given at confirmation, not at form submission.

Every newsletter email contains a working, one-click unsubscribe link that requires no login and takes effect immediately — no further newsletter is sent to that address afterward. You can also ask us to remove you by emailing info@redorca.tech.

Your email address is retained for as long as you're subscribed, and afterward only as a record that you unsubscribed (so we don't accidentally re-email you) and as proof of the consent you gave, unless you ask us to delete it entirely. We do not use tracking pixels in newsletter emails, and newsletter delivery is handled by our email delivery processor (see §9) — your email address is shared with them only to deliver the message, not for their own marketing.

17. Contact & Complaints

For privacy questions or to exercise your rights, contact info@redorca.tech. If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority (for example the ICO in the UK, or the BfDI in Germany).