Privacy Policy.

Orelyn Studio (“Orelyn”, “we”, “us”) takes your privacy seriously. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights you have under India's Digital Personal Data Protection Act, 2023 (the “DPDP Act”).

It applies to orelyn.in, any subdomain we operate, and the personal data we process in connection with our engagements.

Orelyn Studio is a forward-deployed AI studio registered in Bangalore, India. We are the data fiduciary (controller) for personal data collected through orelyn.in and our engagements. Our registered operating address and contact details are listed at the bottom of this page.

We try to collect as little as possible. The categories below cover everything we may collect, depending on how you interact with us:

• Identity and contact data: your name, work email, company, role, country, and any details you choose to share when you book a call, email us, or sign an engagement contract.
• Engagement data: information you share during the Recon or any deployment so we can do the work, including documents, screen recordings, system access credentials, and meeting notes.
• Financial data: billing details processed by our payment providers; we do not store full card numbers.
• Technical data: IP address, browser type, device type, referring URL, and pages visited on orelyn.in, collected through cookies and standard server logs.
• Calendar & communications: if you book a call through Calendly or email us, basic information from that interaction (name, email, timezone, scheduled time).

We do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal data, please contact us so we can delete it.

• Direct interactions: when you email us, book a call, sign a contract, or share data during an engagement.
• Automated technologies: standard cookies and server logs that record how the site is used, for analytics and uptime monitoring.
• Third-party sources: publicly available business information about prospective clients (for example, a company website or LinkedIn profile) to prepare for an initial call.

Under the DPDP Act, we process personal data only where we have a lawful basis. The bases we rely on are:

• Consent: when you book a call, email us, or otherwise voluntarily share personal data for a specific purpose.
• Performance of a contract:to deliver an engagement you've hired us for, including the Recon and any deployment.
• Legitimate uses: to operate orelyn.in, respond to enquiries, send transactional communications, prevent abuse, and improve our services.
• Legal obligation: to comply with applicable Indian law, including tax, accounting, and regulatory requirements.

We don't sell personal data, and we don't share it for third-party advertising. We share personal data only with the following categories of recipients, and only as needed:

• Service providers who help us operate the site and our business (hosting, analytics, email, calendar scheduling, payment processing, customer relationship management).
• AI model providerswhere the engagement uses commercial AI APIs and the Statement of Work permits it. We do this on enterprise tiers with data-processing controls wherever available, and we'll always tell you which providers a deployment uses.
• Legal or regulatory authoritieswhere we're legally required to disclose information.

Each service provider is contractually bound to handle personal data only on our instructions and in line with this policy.

Some of our service providers and AI model providers are located outside India. Where personal data is transferred outside India, we do so in accordance with the DPDP Act and any restrictions notified by the Central Government from time to time. We use contractual safeguards with overseas processors to keep your data protected to the standard required by Indian law.

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These include access controls, encryption in transit, secure credential storage, audit logging on systems we deploy, and incident-response procedures. No system is perfectly secure; if we ever discover a breach affecting your personal data, we'll notify the Data Protection Board of India and affected users in accordance with the DPDP Act.

We keep personal data only for as long as we need it for the purpose we collected it, plus any period required by Indian law. As a rough guide:

• Engagement records are retained for the duration of the engagement and for up to 7 years after, to meet legal and accounting requirements.
• Enquiries that don't become engagements are retained for up to 24 months and then deleted.
• Website analytics are retained for up to 26 months.

You can ask us to delete personal data earlier; we will do so where we're not required to keep it by law.

Subject to the conditions in the DPDP Act, you have the right to:

• access a summary of the personal data we process about you;
• correct or update personal data that is inaccurate or incomplete;
• erase personal data we hold about you, where we no longer need it;
• nominate another person to exercise these rights on your behalf; and
• withdraw consent at any time where consent is the basis for processing. Withdrawal doesn't affect processing that happened before withdrawal.

To exercise any of these rights, email founders@orelyn.in. We'll respond within the timelines set out by the DPDP Act.

If you're not happy with our response, you have the right to register a complaint with the Data Protection Board of India.

Orelyn.in uses a small set of essential and analytics cookies to make the site work and to understand how visitors use it (for example, page views and source of traffic). We don't use cookies for advertising. You can disable cookies in your browser settings; if you do, some parts of the site may not work as intended.

Orelyn.in may link to third-party sites (for example, our case studies, partner platforms, or Calendly for scheduling). We're not responsible for the privacy practices of those sites; please review their own privacy policies before sharing personal data with them.

We may update this Privacy Policy from time to time. When we do, we'll post the updated version on this page and update the “Last updated” date at the top. If a change materially affects how we handle your personal data, we'll let active clients know directly.

Questions about this policy, your data, or our practices? Reach the founders at founders@orelyn.in.

Orelyn Studio
48, Church St, Haridevpur, Shanthala Nagar, Ashok Nagar
Bengaluru, Karnataka 560001, India