Who we are
Orchard is a product of AirOverflow ("AirOverflow", "we", "us"). This policy explains what personal data we collect when you visit tryorchard.dev, request access, or use the Orchard console at platform.tryorchard.dev, the API at app.tryorchard.dev, the docs, the SDKs, the CLI or the MCP server (together, the "Service"), and what we do with it.
For data about you as a visitor, prospect or account holder, AirOverflow is the controller. For data inside your devices and workloads (see Customer Content), you are the controller and we process it on your behalf.
If you run Orchard on your own infrastructure, the devices, snapshots and captures on those machines stay with you. We only receive what you choose to send us, such as account, license and support details.
What we collect
What you give us
- Access requests. Your name, work email, company (optional), what you plan to run, the number of devices, the devices, mode and deployment you're interested in, any notes you add, and the page you sent it from. We keep it in our CRM, Attio, and post a copy to our team's Slack and Discord so someone replies quickly.
- Account details. Name, email, organisation and team, role, and sign-in credentials. Passwords are stored as salted hashes; with single sign-on we receive the identity your provider shares.
- Billing details. Billing contact, company and tax details, and payment records. Card payments are handled by our payment processor; we don't store full card numbers.
- Messages. What you send us by email, support ticket or feedback, and our replies.
Customer Content
Everything you put into or produce with your devices: apps and binaries you install, files, samples (including malware), Frida scripts, device state, snapshots, screenshots, recordings, logs, and network traffic you capture. Captured traffic and app data can contain personal data about other people. You decide what goes in, and you're responsible for having the right to process it.
What we collect automatically
- Request logs. Our host, Cloudflare, processes your IP address, browser and device type, the page or API route requested, the referrer and the time, to deliver the site and protect it from attacks.
- Cloudflare Web Analytics. Page views, referrers, country, device type and page-load performance, counted without cookies and without following you across other sites.
- Microsoft Clarity, only if you accept cookies. Clicks, scrolls, mouse movement, the pages you view, session replays, browser and device details, and approximate location from your IP address. Clarity masks the text you type into forms.
- Service usage. Device-hours by device type, API calls, API key use, audit-log events, quotas and errors. We need these to run, bill and secure the Service.
How we use it, and our legal bases
Where the GDPR or UK GDPR applies, we rely on these legal bases:
- To provide the Service: create your account, run your devices, store your snapshots, meter usage and bill you. Contract.
- To answer access requests and scope on-premise and enterprise deployments with you. Steps you asked for before a contract, and our legitimate interest in replying.
- To keep the Service secure: detect abuse, enforce our acceptable use rules, investigate incidents and keep audit logs. Legitimate interest, and legal obligation where it applies.
- To understand and improve the site with Microsoft Clarity. Consent, which you can withdraw. Cookieless, aggregate analytics from Cloudflare: legitimate interest.
- To send product and service messages: security notices, billing, changes to these terms. Contract and legitimate interest. We send marketing email only where the law allows, and every one has an unsubscribe link.
- To meet legal duties: tax and accounting records, and lawful requests from authorities. Legal obligation.
We process Customer Content only to provide the Service to you, to keep it secure, and as required by law. We don't sell personal data, we don't share it for cross-context behavioural advertising, and we don't make decisions about you based solely on automated processing that have legal or similarly significant effects.
International transfers
We and our providers process data in several countries, including the United States. Where data protection law restricts transfers, we rely on adequacy decisions, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful mechanism, together with additional safeguards where needed. Ask us for a copy of the relevant safeguards at privacy@tryorchard.dev.
How long we keep it
- Access requests: up to 24 months after our last contact, unless you become a customer.
- Account details: while your account is open, then deleted or anonymised within 90 days of closure.
- Customer Content: until you delete it. Devices are discarded when you terminate them or their idle timer runs out. Snapshots stay until you delete them or your account closes, then are deleted within 30 days, and from backups within a further 60 days.
- Billing records: as long as tax and accounting law requires, usually 6 to 10 years.
- Request and security logs: up to 12 months, longer when needed to investigate an incident.
- Microsoft Clarity: Microsoft keeps session replays for 30 days and aggregated data for up to 13 months.
Security
Every device runs isolated from every other. We encrypt traffic in transit with TLS, restrict internal access to people who need it, scope API keys, and keep an audit log of account actions. No system is perfectly secure; if a breach affects your personal data, we'll tell you and the relevant regulators as the law requires. Found a vulnerability in Orchard itself? Report it to privacy@tryorchard.dev.
Your rights
Depending on where you live, you can ask us to:
- tell you what personal data we hold about you and give you a copy;
- correct data that's wrong or incomplete;
- delete your data;
- send your data to you or another provider in a portable format;
- restrict or object to our processing, including processing based on legitimate interest and all direct marketing;
- withdraw consent at any time, without affecting processing that happened before.
In the EEA, UK and Switzerland you can also complain to your local data protection authority. We'd appreciate the chance to resolve it first.
In California and other US states with privacy laws, you have the right to know, access, correct and delete your personal information, and to opt out of its sale or sharing. We don't sell or share personal information as those laws define it, and we don't use or disclose sensitive personal information beyond what's needed to provide the Service. We won't treat you differently for using any of these rights, and you can act through an authorised agent.
Email privacy@tryorchard.dev to use any right. We may need to verify who you are before acting, and we reply within one month (45 days where US state law applies). For Customer Content we process on behalf of a business, we'll pass your request to that customer.
AI agents on this site
The site offers read-only tools to AI agents in your browser (WebMCP): page content, pricing, comparisons and FAQs. One tool fills in the request-access form for you to review. Nothing is sent until you check the form and press send yourself. These tools run in your browser and don't send data to us.
Children
The Service is for professionals and isn't directed at children. You must be 18 or older to use it. We don't knowingly collect personal data from anyone under 16; if you believe a child has given us data, contact us and we'll delete it.
Other sites
Our pages link to other sites, such as GitHub, X and the vendor pages we cite on our comparisons. Their own privacy policies apply once you leave tryorchard.dev.
Changes to this policy
We'll update this page when our practices change and revise the date at the top. If a change materially affects how we use your data, we'll also tell account holders by email or in the console before it takes effect.
Contact
Questions, requests or complaints about privacy: privacy@tryorchard.dev.