# theORQL Privacy Policy — FINAL

## Plain-English Summary

- We collect account information (including verified email) and limited telemetry to run and secure theORQL.
- We store encrypted conversation history so you can access prior conversations; those conversations may include code snippets if you include them.
- Separately, we may process small snippets to compute embeddings and temporarily cache encrypted file contents to reduce latency; plaintext embedding snippets are not retained beyond the request lifecycle, and cached file contents are not permanently stored or used for training.
- We may share necessary data with service providers and AI/model providers to generate outputs, and you can contact us to exercise privacy rights.

**Effective Date:** January 28, 2026  
**Last Updated:** January 28, 2026  
**Not legal advice:** This document is provided for general informational purposes and is not legal advice. Have qualified counsel review it before publishing.

## 1) Who we are; scope

This Privacy Policy explains how theORQL Intelligence Inc. (“theORQL,” “we,” “us”) collects, uses, shares, and protects information when you use our Service (VS Code extension, Chrome/browser surface, websites, and backend APIs).

We do not currently provide organization/workspace administration features.

## 2) Definitions

- “Account Information” means identifiers like email, password hash, and verification status.
- “Conversation History” means stored records of your interactions with the Service (which may include Inputs and Outputs).
- “Inputs” means prompts, code snippets, file contents, error traces, and other content you submit.
- “Outputs” means responses returned by the Service.
- “Personal Information” / “Personal Data” means information that identifies or can reasonably be linked to an individual.
- “Telemetry” means limited technical and usage information about performance and feature use.

## 3) Information we collect

### A) Information you provide

- Account Information: email, password hash, verified-email status, and optional profile information if you provide it.
- Inputs and Outputs: content you submit to obtain outputs and the outputs returned to you.
- Conversation History: encrypted stored conversations you create/use; conversations may include code snippets if you include them.
- Support communications: messages you send to us (including attachments you provide).

### B) Information collected automatically (light telemetry)

- Device/app data: device type, OS, browser type/version, Extension/app versions.
- Telemetry: basic feature usage, performance, and diagnostic signals.
- Logs: IP address, timestamps, request metadata, and security-relevant events.

### C) Payments (if applicable)

- Subscription status and billing records.
- Payment details are handled primarily by our payment processor; we generally do not store full payment card numbers.

## 4) How we use information

We use information to:

- Provide and operate the Service (including processing Inputs and generating Outputs).
- Store and display encrypted Conversation History.
- Maintain reliability and performance (including debugging and latency reduction).
- Secure the Service, prevent abuse, and enforce our Terms.
- Provide support and communicate with you.
- Comply with legal obligations and protect rights, safety, and integrity.

Training: We do not use cached file contents or plaintext embedding snippets as training data.

## 5) How we share information

We may share information with:

- Service providers: hosting, cloud infrastructure, monitoring/logging, customer support tools, email delivery, and payment processors.
- AI/model providers: when you use AI features, some Inputs/derived prompts may be sent to providers such as OpenAI, Anthropic, Google, open-source models via Google Vertex, and/or OpenRouter to generate Outputs.
- Legal and safety: when required to comply with law or to protect the Service and users.
- Business transfers: a buyer/successor in connection with a merger, acquisition, financing, or sale of assets.

We do not sell Personal Information in exchange for money.

## 6) Retention (including special handling)

We retain information only as long as necessary for the purposes described in this Policy, unless a longer period is required by law or needed for security, fraud prevention, or dispute resolution.

### A) Encrypted Conversation History (stored)

- We store encrypted Conversation History so you can access prior conversations.
- We retain Conversation History for as long as necessary to provide the Service and support user access, and we may retain limited records as needed for security, legal compliance, and dispute handling.

### B) Embeddings + temporary encrypted cache (ephemeral behaviors)

- Embedding snippets: we may send small snippets of a user’s codebase to our servers to compute embeddings; plaintext code used solely for embeddings ceases to exist after the life of the request.
- Encrypted caching: we temporarily cache file contents to reduce latency and network usage; cached files are encrypted using unique client-generated keys.
- Ephemeral keys: those encryption keys only exist on our servers for the duration of a request.
- No permanent storage and no training: cached file contents are temporary, never permanently stored, and never used as training data.

### C) Account data; logs/telemetry

- Account Information is retained for as long as your Account is active and as needed for legitimate business purposes and legal compliance.
- Logs/Telemetry are retained as long as necessary for reliability, security, and abuse prevention, and may be retained longer where required by law.

## 7) Security

We use reasonable safeguards designed to protect information, including encryption at rest and key management controls.

No system is perfectly secure. Please avoid submitting secrets in Inputs.

## 8) International transfers

We may process and store information in Canada, the United States, and other jurisdictions depending on our service providers and infrastructure. Where required, we use lawful mechanisms for cross-border transfers.

## 9) Cookies (website)

Our websites may use cookies or similar technologies. If we do, we will describe them in a Cookie Policy at \[COOKIE POLICY URL\] and provide consent controls where required.

## 10) Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of your Personal Information, and to object to or restrict certain processing where applicable.

To exercise rights, contact us at hello@theorql.com. We may need to verify your identity and may deny requests where permitted by law (for example, to protect security logs or comply with legal obligations).

## 11) Children

The Service is for users 18 and older, and we do not knowingly collect Personal Information from minors.

## 12) Changes

We may update this Privacy Policy from time to time. If changes are material, we will provide reasonable notice and update the “Last Updated” date.

## 13) Contact

theORQL Intelligence Inc.

Suite 800 - 999 W Broadway, Vancouver, BC, V5Z 1K5

Privacy/Support: hello@theorql.com

Legal: corp@theorql.com