Data Map

Overview

This page documents how data flows through a configured Orca instance. It is intended to support your own data mapping obligations under UK GDPR and your internal information security processes.

Orca runs on your device and connects directly to your own Microsoft 365 or Google Workspace account. Alongside it, OMG Center Limited (the company that builds and configures Orca) sets up and runs three parts of the service for you: a dedicated Orca project that stores your records, the Claude workspace key used for AI processing, and meeting transcription through Orca Meet. For those parts, OMG Center acts as your data processor under the Data Processing Agreement.

Data Sources (Input)

Orca draws on two categories of data source: your workplace productivity suite, which you authorise and control, and meetings recorded through Orca Meet.

Workplace Productivity Suite

You authenticate Orca with your Microsoft 365 or Google Workspace account using OAuth. Orca reads the following data types from your account:

• Emails (recent inbox and sent items, used for communication style analysis and meeting context)
• Calendar events (upcoming meetings and attendee information)
• Contacts (names, roles, and organisational data)
• Files (only where you have explicitly connected a folder or document)

The OAuth token that grants this access is stored in your device's OS keychain. Neither OMG Center nor any third party has access to it.

Meeting Transcription (Orca Meet)

Meeting transcription is included in the service. When Orca Meet joins a meeting, our meeting notetaker and transcription providers record it and produce a transcript, which is stored in your Orca project and used to generate post-meeting summaries and follow-up actions.

Processing (Your Orca Instance)

Orca is a desktop application running on your device. Data processing happens in three ways:

Local Application Processing

The following operations are performed locally by the application on your device:

• Fetching and caching calendar events and contact records
• Assembling meeting briefs from available data
• Inbox analysis and prioritisation logic
• Contact intelligence aggregation

Your Orca Project

Records that need to persist (contact records, meeting briefs, transcripts, analysis results and application state) are stored in your dedicated Orca project, a Supabase project set up and run by OMG Center for your organisation alone. OMG Center holds the administrative credentials so that it can maintain, update and support the project.

AI Analysis via the Anthropic Claude API

Certain features (meeting brief generation, email drafting, communication style analysis) send structured data to the Anthropic Claude API for AI processing. This uses a Claude workspace key that OMG Center provides and pays for. Usage is included in your licence within a fair-use ceiling, and you do not need an Anthropic account of your own.

Requests go from your device to Anthropic. They do not pass through OMG Center servers, and Anthropic acts as our sub-processor for them. OMG Center can see aggregate usage for your workspace key, which it uses to apply the fair-use ceiling.

Storage

The table below shows where each category of data is stored and who controls it.

Outputs

Orca produces the following outputs. Each is written to your own accounts or to your Orca project.

• Meeting briefs. Generated before scheduled meetings and displayed in the Orca application. A copy is stored in your Orca project for reference.
• Draft emails. Written to your email drafts folder via your authenticated Microsoft 365 or Google Workspace connection. Nothing is sent without your explicit action.
• Tasks. Where you have connected a task management platform (such as ClickUp), Orca can create tasks on your behalf using your API credentials.
• Contact intelligence. Enriched contact records are stored in your Orca project and surfaced within the application when relevant.
• Post-meeting summaries. Generated from Orca Meet transcripts and stored in your Orca project.

What OMG Center Sees

OMG Center Limited is the company that builds and configures Orca. As controller, we hold the following information about our clients for the purpose of managing the service relationship:

• Your name
• Your email address
• Your company name
• Your licence status (active, inactive, or expired) via Keygen
• Aggregate Claude usage for your workspace key

As your processor, we also run your Orca project and therefore have technical access to the records stored in it. We access them only to provide, support and maintain the service, on your instructions. We have no access to your Microsoft 365 or Google Workspace accounts themselves, and we never see your OAuth tokens.

Data Deletion

Your mailbox and calendar data stay under your own accounts. Data in your Orca project is deleted by OMG Center on your request, or when your licence ends.

To remove all data associated with your Orca instance:

1. Ask us to delete your Orca project, with or without an export first. This removes all stored contact records, meeting briefs, transcripts, and analysis results within 30 days, subject only to short-lived backups that expire on their own cycle.
2. Revoke Orca's OAuth access within your Microsoft 365 or Google Workspace account settings to remove its access to your email, calendar, and contacts.
3. Delete any API keys you created for Orca in your own accounts, such as a task manager. The Claude workspace key is ours, and stops working for your installation when the licence ends.
4. Uninstall the Orca desktop application from your device. This removes the application and clears associated keychain entries.

To request deletion of the data OMG Center holds about you (name, email, company, licence record), contact chris@simmance.ai. We will action this within 30 days, subject to any legal retention obligations.