Privacy Policy

This Privacy Policy explains how Orion AI Solutions Inc., a Delaware corporation located at 2810 N Church St #607813, Wilmington, DE 19802 ("Orion," "we," "us," or "our"), handles personal information when we act for our own purposes. It also explains the different role Orion usually has when a business customer uses Orion to contact or manage its leads, prospects, customers, or policyholders.

1. Scope and roles

This Policy applies to Orion's websites, account administration, billing, support, security, product analytics, and Orion's own business communications.

When an agency, agent, or other customer submits or generates personal information about leads, prospects, customers, policyholders, or communication recipients ("Customer Personal Data"), that customer ordinarily decides why and how to use the data. The customer's privacy notice, not this Policy alone, should explain that relationship to the individual. Orion generally processes Customer Personal Data as the customer's processor or service provider under the Data Processing Addendum ("DPA").

Orion may act as an independent controller for limited activities such as account administration, billing, fraud prevention, security, legal compliance, and managing our direct relationship with users. Roles depend on the actual activity and applicable law.

2. Information we collect

Depending on how you interact with Orion, we may collect:

• identifiers and account details, including name, email address, telephone number, business, role, address, login and authentication information;
• commercial and billing information, including plan, transactions, usage, invoices, tax information, payment status, and limited payment-method details received from our processor;
• device, network, cookie, and usage information, including IP address, browser, device identifiers, pages, events, preferences, and diagnostic logs;
• communications and support information, including emails, support tickets, call or message metadata, and content you send to Orion;
• integration information, including account identifiers, permissions, tokens, settings, calendars, advertising data, or other data you direct an integrated service to provide;
• compliance and legal information, including consent evidence, registrations, licenses, suppression events, complaints, legal requests, acceptance records, and audit information;
• audio, transcripts, recordings, messages, prompts, outputs, and related metadata when you or a customer use communication or AI features;
• professional and business information, such as agency affiliations, producer information, job title, and customer configuration; and
• inferences or analytics derived from the information above for the purposes described below.

We may receive information directly from you, from the customer that provides your account, from your device, from integrations you connect, from communications providers, from payment and identity providers, from lead or advertising platforms at a customer's direction, and from public or lawful third-party sources.

3. How we use information

We use personal information as reasonably necessary to:

• provide, operate, personalize, maintain, and support the Services;
• create and secure accounts, authenticate users, manage permissions, and prevent abuse;
• process payments, usage, taxes, renewals, cancellations, credits, and disputes;
• route calls, messages, email, appointments, integrations, and customer-requested workflows;
• provide AI-assisted features requested or configured by customers;
• diagnose errors, measure performance, improve usability, and develop features;
• communicate about the Services, security, billing, support, and legal changes;
• market Orion where permitted and honor choices regarding marketing, cookies, and targeted advertising;
• investigate fraud, carrier complaints, unlawful communications, security incidents, and violations;
• establish, exercise, or defend legal claims and satisfy law, provider, audit, and recordkeeping duties; and
• complete a corporate transaction subject to appropriate safeguards.

Our legal basis depends on the activity and jurisdiction and may include performing a contract, legitimate interests, consent, and legal obligations.

4. Customer Personal Data

Customers are responsible for the lawfulness, accuracy, notices, consent, collection, and use of Customer Personal Data. Orion processes it on documented customer instructions, to provide and secure the Services, and as otherwise permitted by the DPA or required by law.

If you are a lead, prospect, customer, policyholder, or communication recipient of an Orion customer, direct privacy requests to that customer first. We will assist the customer as required by the DPA and applicable law. Orion does not decide whether a customer's marketing communication is appropriate for you.

5. How we disclose information

We may disclose personal information:

• to vendors and subprocessors that provide hosting, storage, databases, security, communications, AI, transcription, email, payments, analytics, support, authentication, and integrations;
• to a customer or account administrator that controls your workspace and permissions;
• to integrations and third parties at the direction of an authorized user;
• to carriers, registration bodies, anti-abuse services, regulators, courts, or authorities where required or reasonably necessary for security, compliance, legal process, or protection of rights;
• to professional advisers under confidentiality; and
• in connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, subject to applicable notice and protection requirements.

Our current Subprocessor List describes providers Orion may use to process Customer Personal Data.

6. Mobile and messaging information

When you opt in to receive messages directly from Orion, we use your mobile number and opt-in information to provide the program, service messages, security notices, and support you requested or authorized. Message frequency varies; message and data rates may apply. Reply STOP to opt out or HELP for help where supported.

Mobile opt-in data and consent will not be sold, rented, or shared with third parties for their own marketing or promotional purposes. We may disclose it to messaging providers and vendors only as necessary to operate the program, deliver messages, prevent abuse, or comply with law. Customer campaigns are governed by the customer's notice and instructions, not by an opt-in to Orion's own messaging program.

7. Cookies, analytics, and advertising choices

Orion's websites and applications may use necessary storage and, subject to available consent and opt-out controls, analytics, session-replay, measurement, or advertising technologies. These technologies may collect identifiers, device information, pages, interactions, and referring or campaign data.

Depending on state law, disclosure to advertising or analytics partners may be considered a "sale," "sharing," or targeted advertising even when no money changes hands. Where required, Orion will provide a mechanism to opt out and will process recognized browser-based opt-out preference signals. Necessary security, authentication, and service storage may continue.

8. Connected services

If you connect a third-party service, you direct Orion to exchange the data and permissions needed for the selected feature. The third party's policy also applies. You can use the controls provided by Orion or the third party to disconnect an integration.

We will describe provider-specific uses or restrictions where a provider requires them and after engineering verifies the actual data flow. We do not promise immediate token or provider-data deletion unless the complete disconnection and deletion path has been tested.

9. Data retention

We retain personal information for periods reasonably necessary for the purposes described in this Policy, including providing the Services, maintaining security and continuity, processing transactions, resolving disputes, enforcing agreements, and satisfying tax, communications, privacy, insurance, carrier, and other legal obligations.

Retention varies by data type, customer instruction, account status, provider, backup cycle, legal hold, and applicable law. We may delete, aggregate, or de-identify information when it is no longer required. De-identified information may be retained and used where we maintain it in de-identified form.

Customer consent and telemarketing records may be subject to five-year or longer recordkeeping duties. The customer remains responsible for its own recordkeeping; Orion does not promise to retain every record the customer must keep unless the Agreement expressly says so.

10. Security

Orion uses administrative, technical, and organizational safeguards designed to protect personal information based on the nature and risk of processing. No transmission, system, or storage method is completely secure. Customers and users are responsible for credentials, devices, permissions, configurations, and lawful use under their control.

11. Privacy rights

Depending on where you live and subject to legal exceptions, you may have rights to request access, correction, deletion, portability, restriction, or an appeal; to opt out of targeted advertising, sale, sharing, or certain profiling; or to withdraw consent for future processing.

Submit requests to privacy@orionaisolutions.ai or through Orion's designated privacy request form. We may verify your identity and authority using information appropriate to the request and may direct a Customer Personal Data request to the controlling customer. Authorized agents may submit requests where permitted, subject to verification. We will respond within the time required by applicable law and explain appeal options where required.

We will not unlawfully discriminate against you for exercising a privacy right.

12. Children

The Services are directed to businesses and adults and are not intended for children under thirteen. Customer accounts require users to be at least eighteen. If you believe a child provided personal information to Orion, contact privacy@orionaisolutions.ai.

13. International processing

Orion and its providers may process information in the United States and other countries. Where required, we use contractual or other lawful transfer mechanisms described in the DPA.

14. Changes

We may update this Policy and will identify the version and effective date. We will provide notice appropriate to material changes and request acknowledgment or acceptance where required. Prior versions will be archived.

15. Contact

Privacy questions and requests: privacy@orionaisolutions.ai.

Legal notices: legal@orionaisolutions.ai.

Mail: Orion AI Solutions Inc., 2810 N Church St #607813, Wilmington, DE 19802.

Delaware law governs Orion's contractual relationship as described in the Terms; privacy rights remain governed by applicable privacy law.