1. Introduction
Orlume ("Orlume," "we," "us," or "our") is an AI-powered platform designed to enable users to build, design, automate, and deploy digital products — including websites, applications, and AI-driven content — through natural language and intelligent tools.
We are committed to safeguarding your privacy and ensuring transparency in how your personal data is collected, used, stored, and shared.
This Privacy Policy ("Policy") applies to all users ("User," "you," or "your") who access our website, platform, and services (collectively, the "Services"). It forms part of, and must be read together with, our Terms & Conditions ("ToS"). In the event of conflict between this Policy and the ToS, the ToS shall prevail to the extent permitted by applicable law.
By using our Services, you acknowledge that you have read and understood this Policy.
2. Scope of This Policy
This Policy applies to:
- Users of the Orlume platform and tools
- Visitors to our website
- Customers using paid or free services
- Individuals interacting with our support, marketing, or communications
This Policy does not apply to:
- Third-party platforms integrated into Orlume
- External websites linked from our Services
3. Definitions
In this Policy, the following terms have the meanings set out below and are consistent with those used in our Terms & Conditions:
- Personal Data: Any information that identifies or can be used to identify an individual directly or indirectly, including name, email address, IP address, device identifiers, account credentials, usage behaviour, and any data linked to a specific user or account. The term "PII" (personally identifiable information) used in our ToS refers to the same category of data.
- Customer Data: All data (including code, prompts, text, images, or other content) uploaded to or processed by the Services at a Customer's direction, including Generated Output once delivered to the Customer.
- Usage Data: Telemetry, logs, performance data, and usage metrics generated by or in connection with use of the Services. Usage Data does not include Customer Data or Personal Data.
- Data Principal: The individual to whom Personal Data relates (you, the user).
- Data Fiduciary: Orlume, as the entity that determines the purpose and means of processing Personal Data, as defined under the Digital Personal Data Protection Act, 2023 ("DPDPA").
We do not intentionally collect sensitive personal data such as health data, biometric data, government IDs, or financial account details beyond billing. Users are strongly advised not to upload such data to the platform.
4. Information We Collect
4.1 Information You Provide
When using Orlume, you may provide:
- Account details (name, email address, password)
- Profile information
- Billing information (processed securely via third-party payment providers; Orlume does not store raw card data)
- Project data (prompts, generated content, code, and assets) ("Customer Data")
- Communication data (support tickets, feedback, and emails)
4.2 Information Collected Automatically
We automatically collect the following when you use our Services:
- IP address and approximate geographic location
- Device type, operating system, and browser details
- Pages visited, features used, and actions taken
- Session data and timestamps
- Error logs and performance metrics
4.3 AI Interaction Data and Model Training
Important: Please read this section carefully. It explains how your data may be used to train and improve Orlume's AI features.
When you use Orlume's AI features, we collect:
- Prompts you input
- Outputs generated in response to your prompts
- Interaction patterns and feedback signals
By default, Orlume may use your Customer Data (excluding Personal Data / PII) — including prompts and generated outputs — to train, improve, and evaluate our AI and machine-learning models, in accordance with the licence granted to us under Section 8.2 of our Terms & Conditions. This processing is performed on anonymised or de-identified data. We do not use raw or directly identifiable Personal Data (e.g. your name, email address, or contact details) to train shared AI models.
You may opt out of having your Customer Data used for AI model training at any time by:
- Contacting us at [email protected] with the subject line "AI Training Opt-Out"; or
- Upgrading to a Business or Enterprise plan, where opt-out is applied by default as part of the plan terms.
Opt-out requests will be actioned within 30 days. Opting out does not affect processing already completed prior to receipt of your request.
Usage Data (telemetry, logs, performance metrics) is also used to monitor, maintain, and improve the Services, including AI feature performance. Usage Data does not contain Personal Data.
4.4 Usage and Billing Data
We collect and process the following for billing, analytics, and service optimisation:
- API usage and Message Credit consumption
- Storage usage and feature interactions
- Subscription and billing activity
Orlume's metering and billing records are authoritative for the purposes of credit consumption, as set out in our Terms & Conditions.
4.5 Data from Third Parties
We may receive data from:
- Authentication providers (e.g. Google, GitHub)
- Payment providers (e.g. Stripe or equivalent)
- Integration services you connect to your Orlume account
5. How We Use Your Information
5.1 Service Delivery
- Provide AI tools and platform features
- Generate outputs and host projects
- Enable deployments and third-party integrations
5.2 Personalisation
We may use your usage patterns and interaction history to personalise your experience within the platform. Any use of Customer Data to improve AI response quality is subject to the model training rules described in Section 4.3, including your right to opt out.
5.3 Analytics and Service Improvement
- Analyse usage patterns to improve performance and reliability
- Develop new features and enhance existing ones
- Train and evaluate AI models (non-PII Customer Data only, subject to opt-out — see Section 4.3)
5.4 Security and Fraud Prevention
- Detect abuse, misuse, or unauthorised access
- Monitor system integrity and investigate security incidents
5.5 Communication
We will send you:
- Service communications: Account verification, billing confirmations, security alerts — these are necessary for the performance of our contract with you and cannot be opted out of while you hold an active account.
- Marketing and promotional communications: Only where you have given explicit, prior consent. You may withdraw consent at any time by clicking "unsubscribe" in any marketing email or by contacting [email protected].
5.6 Legal Compliance
- Meet regulatory and legal obligations applicable to Orlume
- Respond to lawful requests from government authorities or courts
6. Legal Basis for Processing (DPDPA 2023 and Applicable Law)
As a Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDPA"), Orlume processes your Personal Data only on the following lawful bases:
- Consent: Where you have given free, specific, informed, and unambiguous consent prior to processing. This applies to: marketing communications; use of non-essential cookies; and use of Customer Data (excluding PII) for AI model training (if you have not opted out and continue using the Services after being informed of this use in this Policy and the ToS).
- Performance of a contract: Processing necessary to provide the Services you have subscribed to, including account management, billing, and project hosting.
- Legal obligation: Processing required to comply with applicable Indian law, court orders, or regulatory requirements.
- Legitimate uses permitted under DPDPA: Processing for purposes that are necessary, proportionate, and reasonably expected given the context, where DPDPA permits such processing without explicit consent (e.g. fraud prevention, security monitoring, and aggregated analytics).
We do not rely on 'legitimate interests' as an independent legal basis in a manner inconsistent with DPDPA 2023. Where we rely on consent, you have the right to withdraw it at any time without affecting the lawfulness of prior processing.
8. Data Security
Orlume implements industry-standard administrative, technical, and organisational safeguards to protect Personal Data and Customer Data, including:
- Encryption in transit (HTTPS/TLS) and at rest
- Access controls and role-based permissions
- Multi-factor authentication for administrative access
- Continuous monitoring and anomaly detection
- Regular backups and disaster recovery procedures
No system is completely secure. While we strive to protect your data, we cannot guarantee absolute security against all threats.
8.1 Personal Data Breach Notification
In the event of a personal data breach that is likely to result in risk to your rights and interests, Orlume will:
- Notify the Data Protection Board of India as required under DPDPA 2023, within the prescribed timeframe;
- Notify affected Data Principals (users) of the breach, its likely impact, and the remedial steps taken, without undue delay and within 72 hours of becoming aware of the breach where reasonably practicable;
- Maintain a record of all breaches, including those not requiring notification.
Breach notifications will be sent to the email address associated with your account. You are responsible for keeping your contact details up to date.
9. Data Retention and Deletion
Orlume retains Personal Data and Customer Data for as long as necessary to provide the Services, fulfil the purposes described in this Policy, and comply with legal, regulatory, or audit obligations.
Typical retention periods are:
- Active account data: Retained for the duration of your subscription and for up to 30 days after account closure to allow for reactivation or dispute resolution.
- Project files and Customer Data: Available for download for 15 days following account termination or written deletion request. After this period, Customer Data will be deleted from primary storage.
- Backup copies: Anonymised data, Usage Data, and backup copies may be retained for up to 90 days following deletion from primary storage, or longer if required by applicable law. Backup data is not accessible to or usable by Orlume for any purpose other than disaster recovery during this period.
- Billing and transaction records: Retained for the period required under applicable Indian tax and accounting law (typically 7 years).
Important: Account deletion or termination may result in the permanent loss of all associated Customer Data. You must export or back up all project data before requesting deletion. Once deleted from primary storage, Customer Data cannot be recovered. Orlume is not responsible for data lost following account deletion or termination.
To request deletion of your data, please contact [email protected]. Requests will be acknowledged within 48 hours and actioned within 15 days.
11. Your Privacy Rights
As a Data Principal under DPDPA 2023, and subject to applicable law, you have the following rights:
- Right to access: You may request a summary of the Personal Data we hold about you and the processing activities associated with it.
- Right to correction: You may request correction of inaccurate or incomplete Personal Data.
- Right to erasure: You may request deletion of your Personal Data, subject to legal retention obligations.
- Right to data portability: You may request a copy of your Customer Data in a commonly used, machine-readable format.
- Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
- Right to grievance redressal: You have the right to file a complaint with our Grievance Officer (see Section 17) or with the Data Protection Board of India.
- Right of nomination: You may nominate a person to exercise your rights on your behalf in the event of your death or incapacity, as permitted under DPDPA 2023.
To exercise any of the above rights, please contact [email protected]. We will acknowledge your request within 48 hours and respond substantively within 30 days. If your request is complex or numerous, we may extend this period by a further 30 days with notice to you.
12. Children's Privacy
Orlume is not intended for users under the age of 18. We do not knowingly collect, process, or store Personal Data from minors. If we become aware that we have inadvertently collected data from a person under 18, we will delete it promptly. If you believe we have collected data from a minor, please contact [email protected] immediately.
13. Third-Party Integrations
Orlume may integrate with external services (e.g. GitHub, payment gateways, AI API providers — see Section 7.2). When you use these integrations, data may be shared with and processed by those third parties under their own privacy policies. We are not responsible for the data practices of third-party services. We encourage you to review the privacy policies of any third-party services you connect to your Orlume account.
14. International Data Transfers
Orlume is headquartered in India. Your data may be processed by Orlume or our third-party service providers in countries other than India, including countries where our AI model providers (Anthropic, OpenAI, Google) and cloud infrastructure providers operate.
Where we transfer Personal Data outside India, we ensure that appropriate safeguards are in place in accordance with DPDPA 2023 and any regulations issued by the Central Government specifying countries to which transfers are permitted. Safeguards may include:
- Contractual clauses requiring recipient organisations to maintain data protection standards equivalent to those required under DPDPA 2023
- Use of service providers who are themselves subject to data protection regimes assessed as adequate by the Government of India
By using our Services, you acknowledge that your data may be transferred to and processed in other countries. We will update this section as the Central Government issues further guidance on cross-border transfers under DPDPA 2023.
15. Communications
We will send you the following categories of communications:
- Service communications: Account verification, billing confirmations, security notifications, and other operational messages. These are necessary for the performance of our contract with you and cannot be opted out of while you maintain an active account.
- Marketing communications: Promotional content, product updates, and newsletters. We will only send these where you have given explicit, prior consent at the point of sign-up or through your account settings. You may withdraw consent at any time by clicking the 'Unsubscribe' link in any marketing email or by contacting [email protected]. Withdrawal of marketing consent does not affect service communications.
We do not treat mere use of the platform as consent to receive marketing communications.
16. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, the Services, or applicable law. When we make material changes, we will:
- Post the updated Policy on this page with a revised effective date;
- Send a notice to the email address associated with your account at least 14 days before the changes take effect; and
- Where required by applicable law, seek fresh consent for any new processing activities.
Continued use of the Services after the effective date of any changes constitutes acceptance of the revised Policy. If you do not agree to the updated terms, you should discontinue use and may cancel your subscription in accordance with our Terms & Conditions.
17. Grievance Officer
In accordance with the Information Technology Act, 2000 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, Orlume has designated a Grievance Officer to address complaints and concerns regarding data processing:
Grievance Officer
Name: [Designated Officer Name]
Designation: Grievance Officer, Orlume
Email: [email protected]
Address: Bhilai, Chhattisgarh, India
Complaints must be submitted in writing to the above email address. We will acknowledge receipt of your complaint within 24 hours and endeavour to resolve it within 15 days of receipt. If you are not satisfied with our resolution, you may escalate your complaint to the Data Protection Board of India (once constituted and operational under DPDPA 2023).
18. Contact Information
For any privacy-related queries that are not complaints (see Section 17 for complaints):
- General & Privacy: [email protected]
- Support: [email protected]
- Billing: [email protected]
- Address: Bhilai, Chhattisgarh, India
For data deletion requests, please email [email protected] with the subject line "Data Deletion Request" and include your registered email address.
19. Orlume Privacy Principles
We believe in:
- Security-first architecture and responsible data handling
- Responsible and transparent AI usage, with clear opt-out rights for model training
- No selling of Personal Data to third parties
- User control, transparency, and meaningful consent
- Compliance with DPDPA 2023 and applicable Indian data protection law
- Proportionate data collection — we collect only what is necessary for the stated purpose