Data Processing Agreement

1. Roles and Scope

For Orca, your organisation is the data controller and OMG Center Limited ("OMG Center", "we", "us") is the data processor under UK GDPR Article 28 for personal data that is:

• Stored in your dedicated Orca project, which we set up and run as part of the service
• Sent to Claude (Anthropic) for AI processing under the Claude workspace key we provide
• Recorded or transcribed through Orca Meet

Data that stays in your Microsoft 365 or Google Workspace tenancy remains under your own accounts and agreements with those providers. Orca reads and writes it on your device, using OAuth tokens issued to you.

This agreement forms part of the Client Licence Agreement and applies for as long as you hold an active Orca licence, and afterwards until your data has been returned or deleted under section 9.

2. What Is Processed

The categories of data follow from what Orca does for you:

• Data subjects: your licensed users, and the people they correspond and meet with (clients, prospects, colleagues and other contacts).
• Communications data: email and message content, calendar entries, and contact details, to the extent Orca stores them in your Orca project or sends them to Claude to produce a brief, draft, summary or decision.
• Meeting data: recordings, transcripts, summaries and actions from meetings Orca Meet joins or that you choose to record.
• Records: tasks, notes, contact records, meeting briefs, AI-generated outputs and application state stored in your Orca project.

Processing is limited to providing, supporting and maintaining the Orca service on your documented instructions, which are the configuration agreed with you and the actions you take in the application. We do not use your data for any other purpose, we do not sell it, and we do not use it to train AI models.

3. Architecture and Hosting

• Application: Orca is a Tauri desktop application that runs on your device. It is not a web app hosted on our servers.
• Authentication: You authenticate with your own Microsoft 365 or Google Workspace account using OAuth 2.0. Authentication tokens are stored in your operating system's keychain. OMG Center never sees your mailbox credentials or tokens.
• Orca project: Each client has a dedicated Supabase project, set up and run by OMG Center. We hold the administrative credentials for it so that we can maintain, update and support it.
• AI processing: Claude requests are made from your device to Anthropic's API using a Claude workspace key that OMG Center provides and pays for. Usage is included in your licence within a fair-use ceiling.
• Meeting transcription: Orca Meet uses our meeting notetaker and transcription providers to join meetings, record them and produce transcripts, which are stored in your Orca project.

4. Isolation Between Clients

Your Orca project is a separate Supabase project used only for your organisation. It is not shared with any other client, and no other client's application connects to it. Every record is tagged with the mailbox it belongs to, and Orca reads only your organisation's records.

5. Sub-processors

We use the following sub-processors to deliver Orca. We will give notice before adding or replacing a sub-processor that processes your personal data.

Regarding Anthropic specifically: Anthropic's commercial API terms confirm that data submitted via the API is not used to train their models. Data is processed to generate a response and is not retained by Anthropic beyond what their standard data handling practices require.

Microsoft and Google are not our sub-processors. Your mailbox and calendar data stays with them under your own agreements.

6. Security

Technical and organisational measures are set out in the Information Security document. In summary: a dedicated Supabase project per client with encryption at rest, encryption in transit for every connection, OAuth tokens held in your operating system's keychain, administrative access to your Orca project limited to OMG Center staff who need it to run the service, and a signed desktop application.

Anyone at OMG Center with access to your data is bound by a duty of confidentiality.

7. Breach Notification

If we become aware of a personal data breach affecting your data, we will notify your primary contact without undue delay, and in any event within 72 hours of becoming aware, with the information available at that time: the nature of the breach, the data and data subjects affected so far as known, and the measures taken or proposed. We will cooperate with your own notification obligations to the ICO and to data subjects.

8. Data Subject Rights and Assistance

Where a data subject request reaches us, we will refer it to you as controller and help you respond, including by locating, exporting or deleting records in your Orca project. We will also provide reasonable assistance with data protection impact assessments and with demonstrating compliance with this agreement.

9. Deletion and Return on Termination

When your licence ends:

• Your Orca project: At your choice, we will export your Orca project data to you in a structured format and then delete the project, or delete it without export, within 30 days. Deletion is subject only to short-lived backups, which expire on their own cycle.
• Your mailbox and calendar data: Remains under your Microsoft 365 or Google Workspace accounts. You may revoke the OAuth permissions granted to Orca via your account settings.
• AI processing: Your Orca installation stops using our Claude workspace key when the licence is deactivated.
• Licence deactivation: Your Orca licence key will be deactivated. The application will cease to function for licence-gated features.

10. What OMG Center Holds as Controller

Commercial relationship data

Separately from the data we process for you, OMG Center holds a limited set of data needed to manage the commercial relationship with each client.

OMG Center processes this commercial data as a data controller. It is subject to our Privacy Policy. It is never sold or shared with third parties except where legally required. Financial records are retained for 6 years from the end of the tax year; contact information is deleted promptly after the retention period expires, subject to any ongoing legal obligations.

11. Contact

For any questions about data handling in your Orca deployment, or about the commercial data OMG Center holds for your account:

• Email: chris@simmance.ai
• Company: OMG Center Limited, Company No. 14169551
• Registered in England and Wales

For data protection matters, you may also contact the Information Commissioner's Office (ICO) at ico.org.uk.