Privacy Policy
Zero Data Selling: We never sell, rent, or monetize client or user data.
Full IP Protection: Custom software code & assets belong 100% to our clients.
Encrypted Transmission: End-to-end TLS 1.3 encryption across all APIs and forms.
01.Information We Collect
Orcashel collects information strictly required to deliver digital product design, software engineering, and consulting services. This includes:
- Contact & Discovery Details: Name, business email, phone or WhatsApp number, company name, and project scope submitted through our contact forms or Project Estimator.
- Technical & Log Information: IP address, browser type, device metadata, and referring pages collected automatically to maintain system security and uptime.
- Client Project Assets: Architecture diagrams, database schemas, brand guidelines, and API specifications provided during active engineering contracts under strict non-disclosure obligations.
Google Business Profile & OAuth Data
When you authenticate and connect your Google Business Profile to our Hospitality Review Management Portal (hospitality.orcashel.com), we collect and store:
- Your Google Account email address and unique account identifier.
- Associated Google Business Profile location names, IDs, and address metadata.
- Publicly available Google customer reviews associated with your authorized location(s) (including reviewer display names, profile avatars, star ratings, review timestamps, review comments, and existing published replies).
- Cryptographically encrypted OAuth authentication tokens (access and refresh tokens).
02.How We Use Your Information
We utilize collected data strictly for lawful, project-specific purposes:
- Formulating project proposals, technical roadmaps, and commercial estimates.
- Executing software development, multi-tenant SaaS integration, and 360° virtual tour rendering.
- Dispatching lead delivery notifications and inquiry receipts via transactional email.
- Preventing malicious traffic, bot spam, and denial-of-service attempts.
03.Analytics & Cookie Policy
We use lightweight, privacy-conscious analytics (including Meta Conversions API and Google Analytics 4) to monitor website performance and measure conversion funnels.
Cookies are employed solely to remember user preferences (such as light/dark mode selection) and session authentication for authorized CMS administrators. You may block or purge cookies through your browser settings at any time without impacting public browsing capability.
04.Data Protection & Encryption Standards
Orcashel applies defense-in-depth security across all infrastructure layers:
All traffic across orcashel.com and client portals is forced over HTTPS with modern HSTS headers.
Client databases and sensitive credentials utilize AES-256 encryption at rest and isolated environment variables.
05.Third-Party Processors & Infrastructure
To deliver high-availability software products, Orcashel partners with tier-1 cloud providers bound by strict data processing agreements:
- Cloud Hosting & Edge CDN: Vercel & Amazon Web Services (AWS).
- Transactional Email Delivery: Resend / AWS SES.
- Security & DDoS Shield: Cloudflare.
06.Compliance with Digital Personal Data Protection (DPDP) Act, 2023
Orcashel adheres strictly to the provisions of the Digital Personal Data Protection Act, 2023 (DPDP Act) of India and applicable international data protection benchmarks (including the EU GDPR). We process digital personal data in an ethical, transparent, and legally accountable manner.
Roles Under the DPDP Act
• As a Data Fiduciary: When you browse orcashel.com, submit an inquiry, or interact with our Project Estimator, Orcashel determines the purpose and means of processing your personal contact details.
• As a Data Processor: When we architect and deploy custom software, web platforms, and CRMs for our corporate clients, Orcashel processes end-user data strictly under our clients' contractual instructions, implementing row-level security and sovereign access controls.
Your Statutory Rights as a Data Principal
Under the DPDP Act, 2023, you are recognized as a Data Principal and are entitled to exercise the following enforceable rights:
Request a summary of the digital personal data we hold about you and the identities of third-party processors with whom it has been shared.
Request the correction of inaccurate personal data, the completion of incomplete records, or the permanent deletion of records no longer required.
Withdraw consent previously granted for processing at any time as easily as giving consent, without affecting lawful prior processing.
Nominate any other individual to exercise your data rights in the unfortunate event of death or incapacity.
Protection of Minors (Children's Data)
Orcashel provides B2B software engineering, architecture, and technology consulting services. We do not knowingly solicit or collect personal data from individuals under 18 years of age. If we discover that personal data of a minor has been collected without verifiable parental consent, we will purge it immediately.
07.Data Retention & Cross-Border Transfers
In compliance with the principle of Storage Limitation, Orcashel retains personal data only as long as necessary to fulfill the intended commercial or contractual purpose, or to satisfy statutory accounting obligations. Once the purpose is fulfilled or consent is withdrawn, records are permanently deleted or irreversibly anonymized.
Cross-border data transfers for cloud computing or CDN caching are performed strictly in compliance with government-notified lists under Section 16 of the DPDP Act, 2023, utilizing encrypted channels.
08.Google Business Profile API & User Data Policy
Orcashel provides hospitality and reputation management tools via hospitality.orcashel.com that integrate with Google Business Profile APIs. This section governs the collection, processing, and handling of data received through Google OAuth 2.0.
A. Read-Only Operations & Intended Use
Our integration with Google Business Profile operates strictly on an authorized, read-only basis for the purpose of:
- Ingesting customer reviews, ratings, and existing owner responses for your authorized business location.
- Displaying review metrics and customer feedback in your tenant dashboard.
- Facilitating internal drafting and team approval of review replies.
The system does not modify your Google Business Profile details, does not create or delete locations, and does not post automated or public replies without explicit manual intervention.
B. Google API Services User Data Policy Compliance (Limited Use)
Orcashel's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically:
- No Third-Party Sale or Advertising: We never sell, rent, lease, or monetize Google user data or customer review data to any third party, data broker, or advertising network.
- No AI Model Training: We do not use Google user data, customer reviews, or business profile information to train generalized artificial intelligence (AI) or machine learning (ML) models.
- Access Limitation: Access to raw Google OAuth tokens and ingested review data is restricted strictly to authorized staff on a need-to-know operational basis for technical maintenance and security troubleshooting.
C. Cryptographic Storage & Security
All Google OAuth tokens (both short-lived access tokens and refresh tokens) are encrypted at rest using authenticated industry-standard AES-256-GCM encryption. API communication between our servers and Google APIs occurs exclusively over encrypted TLS 1.3 channels.
D. Revocation and Deletion of Google Data
You maintain complete control over your Google account authorization:
- Disconnecting within Portal: You may disconnect your Google Business Profile at any time from your business settings in the Orcashel Portal, which immediately revokes our access to fetch new reviews.
- Revoking Access via Google: You can revoke Orcashel's permissions at any time directly through your Google Account Security Settings.
- Data Deletion Requests: To permanently erase all historical review data and cached business metadata ingested from your Google Business Profile, email privacy@orcashel.com with the subject line “Google Data Erasure Request”. All associated records and stored credentials will be permanently purged from our databases within 48 hours.
Data Protection & Grievance Officer
In accordance with the Digital Personal Data Protection Act, 2023, Orcashel has appointed a designated Grievance Redressal Officer to address inquiries, exercise of Data Principal rights, or complaints regarding personal data processing:
Designation: Data Protection & Grievance Officer
Entity: Orcashel Digital Engineering Studio
Direct Email: privacy@orcashel.com
Statutory Timelines: Inquiries are acknowledged within 48 business hours, with final resolution provided within 30 days.
*If a Data Principal is not satisfied with the resolution provided by our Grievance Officer, they maintain the statutory right under the DPDP Act to file a complaint directly with the Data Protection Board of India (DPBI).