Privacy Policy

1. Scope and data controller

This Policy applies to Orion IA, including the website, the desktop app distributed through the Microsoft Store or a direct channel, APIs, license services, sync, backup, and integrations enabled by the user.

The data controller is Nacife, individual publisher of Orion IA, identified in the Microsoft Partner Center. For data protection matters, use [email protected].

When a third-party service independently determines how it processes data — for example, Microsoft Store, Stripe, or an AI provider contracted directly by the user — that third party may also act as an independent controller under its own terms.

2. What data we process

Data kept locally

Preferences, allowed folders and applications, tokens protected by the operating system's secure storage, audit logs, and local runtime data stay on the device by default. The experimental wake-word enrollment stores numeric acoustic characteristics; the raw audio used before detection is not retained by Orion. Local data is only sent when the requested function requires the cloud, sync, backup, or online processing.

3. Purposes and legal bases

We do not use personal data for behavioral advertising and do not sell personal data databases.

4. Artificial intelligence and automation

Orion may forward the content necessary for a request to configured AI providers, such as OpenAI, Anthropic, and Google. When local Ollama mode is used, processing happens on the device, unless the task also requires an online service.

AI responses may contain errors. The user should review results before making important decisions. Orion is not designed to make, without human intervention, legal, medical, financial, employment, or credit decisions that produce significant effects on a person.

Sensitive actions on the computer use allowlists and, depending on the action type, local confirmation. The user may deny the action, disconnect remote control, revoke permissions, or disable the microphone and integrations.

5. Who we may share data with

• AI providers: OpenAI, Anthropic, Google, or another provider chosen/configured by the user, solely to process the request.
• Payments and distribution: Stripe, Microsoft Store, and institutions necessary for checkout, licensing, and fraud prevention.
• Infrastructure: hosting, database, storage, delivery, monitoring, and security services that support Orion.
• Chosen integrations: Google, Telegram, Spotify, and email providers, when the user connects and uses these services.
• Authorities or protection of rights: when required by law, a valid order, the safety of people, or the defense of Orion and its users.
• Corporate transactions: in the event of a reorganization, acquisition, or transfer, maintaining applicable protections and providing notice where required.

We require processors to handle data according to our instructions, the contracted purpose, confidentiality, and compatible security measures.

6. International transfers

Some providers may process data outside Brazil. In these cases, we adopt mechanisms permitted under the LGPD (Brazil's General Data Protection Law) and assess applicable contracts and safeguards. The user should also review the policies of any external services they choose to connect.

7. Retention and deletion

We keep data only for as long as necessary for the stated purpose, the service's operation and security, compliance with legal obligations, or the regular exercise of rights. In general:

• account, license, and subscription data remain while the account or contractual relationship is active and, afterward, for the applicable legal period;
• cloud uploads and backups remain until deleted by the user, the feature is discontinued, or an operational retention and security routine applies;
• AI content may be processed transiently and may be subject to the retention terms of the provider used;
• technical and security logs are kept for the minimum period necessary for diagnostics, abuse prevention, and auditing;
• local data remains on the device until removed by the user or the operating system.

A deletion request does not extend to anonymized data or to records whose retention is required or permitted by law.

8. Security and local controls

We apply measures such as encrypted connections, access control, protected tokens, per-user segregation, audit logs, time limits for commands, and validation of paths and applications. No system is completely invulnerable; significant incidents will be handled and disclosed as required by law.

Orion does not bypass UAC, antivirus software, Smart App Control, or Windows administrative policies. The user remains responsible for reviewing permissions, keeping the system updated, and not submitting unnecessary secrets in prompts or files.

9. Data subject rights

Under the LGPD, the data subject may request, where applicable:

• confirmation of processing and access to the data;
• correction of incomplete, inaccurate, or outdated data;
• anonymization, blocking, or deletion of unnecessary data or data processed in violation of the law;
• information about sharing and the consequences of refusing consent;
• data portability, where regulated and technically applicable;
• withdrawal of consent and deletion of data processed on that basis, subject to legal exceptions;
• objection to unlawful processing and review of applicable automated decisions.

To protect the account, we may confirm identity before fulfilling a request. Exercising these rights is free of charge.

10. Children and teenagers

Orion is not directed at children and does not knowingly seek to collect children's data. Use by minors must occur with the participation and supervision of a parent or legal guardian, always in the best interest of the child or teenager. If we identify incompatible processing, we will take appropriate blocking or deletion measures.

11. Cookies and local storage

The institutional Privacy and Terms pages do not use advertising cookies. The website and the app may use cookies or storage strictly necessary for authentication, security, preferences, and session continuity. If optional analytics or marketing tools are adopted, this Policy and the consent controls will be updated before use.

12. Changes and contact

This Policy may be updated to reflect changes in the product, providers, or legislation. Material changes will be highlighted on the website or in the app, and the effective date will be updated.