Data Map

Overview

This page documents how data flows through a configured Orca instance. It is intended to support your own data mapping obligations under UK GDPR and your internal information security processes.

The core principle of Orca's architecture is simple: your data flows between your device and your own service accounts. OMG Center Limited (the company that builds and configures Orca) is not part of that flow. We do not receive, process, store, or transmit your operational data at any point.

Data Sources (Input)

Orca connects to two categories of data source. Both are authorised and controlled entirely by you.

Workplace Productivity Suite

You authenticate Orca with your Microsoft 365 or Google Workspace account using OAuth. Orca reads the following data types from your account:

• Emails (recent inbox and sent items, used for communication style analysis and meeting context)
• Calendar events (upcoming meetings and attendee information)
• Contacts (names, roles, and organisational data)
• Files (only where you have explicitly connected a folder or document)

The OAuth token that grants this access is stored in your device's OS keychain. Neither OMG Center nor any third party has access to it.

Meeting Transcription Service

If you use a transcription service such as Fireflies.ai or Otter.ai, Orca can ingest meeting transcripts to generate post-meeting summaries and follow-up actions. The connection is made using an API key from your own account with that service.

Processing (Your Orca Instance)

Orca is a desktop application running on your device. Data processing happens in two ways:

Local Application Processing

The following operations are performed locally by the application on your device, without sending data anywhere:

• Fetching and caching calendar events and contact records
• Assembling meeting briefs from available data
• Inbox analysis and prioritisation logic
• Contact intelligence aggregation
• Reading and writing to your Supabase database

AI Analysis via the Anthropic Claude API

Certain features (meeting brief generation, email drafting, communication style analysis) send structured data to the Anthropic Claude API for AI processing. This uses your own Anthropic API key, which is stored in your OS keychain.

OMG Center has no access to your Anthropic API key and no visibility of what is sent to or received from the Claude API.

Storage

The table below shows where each category of data is stored and who controls it.

Outputs

Orca produces the following outputs. All outputs are written to systems you own and control.

• Meeting briefs. Generated before scheduled meetings and displayed in the Orca application. A copy is stored in your Supabase database for reference.
• Draft emails. Written to your email drafts folder via your authenticated Microsoft 365 or Google Workspace connection. Nothing is sent without your explicit action.
• Tasks. Where you have connected a task management platform (such as ClickUp), Orca can create tasks on your behalf using your API credentials.
• Contact intelligence. Enriched contact records are stored in your Supabase database and surfaced within the application when relevant.
• Post-meeting summaries. Generated from your transcription service data and stored in your Supabase database.

What OMG Center Sees

OMG Center Limited is the company that builds and configures Orca. We hold the following information about our clients for the purpose of managing the service relationship:

• Your name
• Your email address
• Your company name
• Your licence status (active, inactive, or expired) via Keygen

That is the complete list. We have no access to your emails, calendar, contacts, meeting transcripts, AI analysis results, Supabase database, or any other operational data that Orca works with. This is not a policy choice we could reverse, it is a structural consequence of how the system is architected. Your data lives in your systems and we have no credentials to access it.

Data Deletion

Because all your operational data lives within your own systems, you have complete and immediate control over deletion. There is no need to submit a request to OMG Center for your operational data, because we do not hold it.

To remove all data associated with your Orca instance:

1. Delete your Supabase project (or drop the Orca-related tables) to remove all stored contact records, meeting briefs, and analysis results.
2. Revoke Orca's OAuth access within your Microsoft 365 or Google Workspace account settings to remove its access to your email, calendar, and contacts.
3. Delete the API keys used by Orca from your Anthropic, transcription service, and task manager accounts.
4. Uninstall the Orca desktop application from your device. This removes the application and clears associated keychain entries.

To request deletion of the data OMG Center holds about you (name, email, company, licence record), contact chris@omgcenter.org. We will action this within 30 days, subject to any legal retention obligations.