Privacy Policy

1. Who We Are

Protecting your private information is our priority. Orpanai Inc. ("Orpanai", "we", "us", or "our") provides a Voice AI Agent platform that enables businesses to deploy AI-powered agents to handle inbound and outbound phone calls across industries. By using the Orpanai platform, you consent to the data practices described in this statement.

This Privacy Policy explains how Orpanai collects, uses, discloses, retains, and protects personal information in compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, the Personal Health Information Protection Act (PHIPA) of Ontario.

Controller/Processor Role. For our website, self-serve sign-ups, and direct marketing, Orpanai acts as a data controller. For business accounts where Orpanai processes data on behalf of a tenant, Orpanai acts as a processor under applicable law. Where Orpanai acts as a processor, the Data Processing Agreement (DPA) governs and controls in the event of any conflict with this Privacy Policy.

2. Information We Collect

2.1 Personal Data

In order to better provide you with products and services offered, Orpanai may ask you to provide certain personally identifiable information that can be used to contact or identify you ("Personal Data"). These may include, but are not limited to:

• Email address.
• First name and last name.
• Phone number.
• Address, State, Province, ZIP/Postal code, City.
• Cookies and Usage Data.

We collect Personal Data that you provide directly (for example, when you sign up or contact us), as well as certain data collected automatically such as Usage Data, cookies, and device information. If you are a business client, this also includes the contact information of your designated account representative.

2.2 Account & Authentication Data

When you create an account or sign in, you may choose to authenticate using Google Sign-In, provided through Google Identity Platform (Firebase Authentication). If you do, Google shares a limited set of profile information with us — your name, email address, and a unique account identifier — so we can create and secure your Orpanai account. We do not receive or store your Google password. Your use of Google Sign-In is also subject to Google's Privacy Policy.

2.3 AI Voice & Communications Data

If you enable voice features or connect telephony through our platform, we may receive audio recordings, transcripts, call metadata, and interaction logs ("Communications Data") for the purpose of providing our Services and improving safety. Business clients (tenants) are responsible for obtaining all required notices and consents from their end users before providing such data to Orpanai. Orpanai may use Communications Data in aggregated and de-identified form to improve, train, and enhance its models and Services, provided such use does not identify the business client or end users.

2.4 Sensitive Personal Data

We do not seek to collect sensitive categories of data unless strictly necessary for the Services and expressly provided by you, and where required, with your explicit consent. Where our platform is used by healthcare providers, any health-related information shared during a call is handled in accordance with applicable privacy law, including PHIPA where applicable.

3. Use of Data

Orpanai uses the collected data to:

• fulfill the purpose for which you provide it;
• provide and maintain our Service;
• notify you about changes to our Service;
• provide customer support;
• gather analysis or valuable information so that we can improve our Service;
• monitor the usage of our Service;
• detect, prevent, and address technical issues;
• carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collection;
• provide you with notices about your account and/or subscription;
• provide you with news, special offers, and general information about other goods, services, and events which we offer that are similar to those you have already purchased or inquired about, unless you have opted not to receive such information;
• for any other purpose with your consent.

4. How We Share Your Information

We share information only as needed to operate the Service:

• With the business you called. Information you provide during a call is relayed to the tenant business so they can follow up with you.
• With Service Providers (see Section 5).
• For legal reasons. We may disclose information if required by law, court order, or regulatory authority, or to protect the rights, property, or safety of Orpanai, our tenants, or others.

We do not sell, rent, or trade your Personal Data to any third party.

5. Service Providers

We may employ third-party companies and individuals to facilitate our Service ("Service Providers"), provide the Service on our behalf, perform Service-related services, or assist us in analysing how our Service is used.

These third parties have access to your Personal Data only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose.

You can request an up-to-date list of third-party Service Providers by emailing us at [email protected].

Website analytics providers. To understand how visitors use our marketing website, we rely on the following analytics providers, which are loaded only after you grant cookie consent (see Section 10):

• Google Identity Platform / Firebase Authentication (Google LLC), used to authenticate users who sign in with Google and to manage account sessions. Privacy policy: policies.google.com/privacy.
• Google Analytics 4 (Google LLC), aggregated website usage analytics, configured with IP anonymization. Privacy policy: policies.google.com/privacy.
• PostHog (PostHog Inc., US cloud), product analytics and event tracking, configured in identified_only mode so anonymous visitors do not have user profiles created. Privacy policy: posthog.com/privacy.

6. Security

While recognizing the importance of securing your data, we understand that no method of transmission over the Internet or method of electronic storage is 100% secure. Nevertheless, we strive to use commercially acceptable means to protect your Personal Data, including encryption in transit and at rest, access controls, and audit logging, but we cannot guarantee its absolute security.

7. Data Retention

We retain Personal Data and Communications Data for as long as necessary to provide the Service and to comply with our legal and contractual obligations. Tenants may request deletion of their call records through the admin dashboard or by contacting us directly.

8. Your Rights

Under PIPEDA and PHIPA, you have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Request deletion of your personal information, subject to legal and contractual retention obligations.
• Withdraw consent to the collection or use of your personal information at any time, which may limit our ability to provide certain Services.

To exercise any of these rights, contact our Privacy Officer at [email protected]. We will respond within 30 days. We may need to verify your identity before processing your request.

9. Privacy Breach Notification

Should Orpanai become aware of a breach affecting personal information that poses a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada (OPC) as required under PIPEDA.

Where the breach involves personal health information held on behalf of a healthcare organization, Orpanai will promptly inform that organization (as the health information custodian) so they can take appropriate action. Under PHIPA, it is the custodian's responsibility to determine whether patients and the Information and Privacy Commissioner of Ontario must be notified.

Orpanai will keep a record of all breaches for a minimum of 24 months.

10. Cookies

Our websites may use cookies and similar technologies to remember your preferences and understand how visitors use our site. You may control cookie settings through your browser.

To opt out of Google Analytics across all websites, you may install the Google Analytics Opt-out Browser Add-on.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date above and notify tenants via email. Continued use of our platform after such changes constitutes acceptance of the updated policy.

12. Regulatory Authorities

If you have concerns we are unable to resolve, you have the right to contact:

Office of the Privacy Commissioner of Canada (PIPEDA)
Phone: 1-800-282-1376, Website: priv.gc.ca

Information and Privacy Commissioner of Ontario (PHIPA)
Phone: 1-800-387-0073, Website: ipc.on.ca

13. Contact Us

For any questions about this Privacy Policy or to reach our Privacy Officer:

Orpanai Inc.
Email: [email protected]
Phone: [INSERT PHONE]
Address: [INSERT ADDRESS]