Privacy Policy

Orakyl (the "Service") is a personal assistant service accessed through messaging applications, currently WhatsApp and Telegram. The Service is operated as a sole proprietorship based in Bangalore, India; no separate legal entity has been incorporated. References in this Privacy Policy to "Orakyl", "we", "us", or "our" mean that operator.

This Privacy Policy describes the personal information that we collect about users of the Service, the purposes for which we process that information, the parties with whom we share it, and the rights you have in relation to it. Questions or requests relating to this Privacy Policy should be addressed to mukundmr95@gmail.com.

2.1 Account information

When you authenticate with Google to create an Orakyl account, we receive your name, email address, and Google profile picture from Google. We use this information to identify your account and associate it with your messages and connected services.

2.2 Messages and conversation history

We store the messages you send to the Service and the responses the Service returns to you. This includes plain text messages, text transcribed from voice notes, and captions accompanying photos and documents. Conversation history is retained so that the Service can maintain context across consecutive interactions.

2.3 Voice notes, images, and documents

When you transmit a voice note, image, or document file (including .pdf, .docx, .xlsx, and .pptx formats) to the Service, the file is downloaded and processed for the purpose of responding to your request. Voice notes are transcribed to text. Images and documents are passed to the AI processor (described in Section 4) for analysis. Once processing is complete, the original media file is discarded; only extracted text or generated summaries are retained in conversation history.

2.4 Connected services (Google Workspace)

If you authorize Orakyl to access your Google account, we may request access to specific Google services (Gmail, Calendar, Docs, Sheets, and Drive) on your behalf. We access these services only when required to fulfill a request you have made through the Service. Authentication tokens issued by Google are encrypted at rest. We do not perform bulk extraction of your Google data.

2.5 Stored facts and preferences

The Service may extract and store small factual statements inferred from your interactions (for example, your role, recurring contacts, or stated preferences) so that future responses are more useful to you. You may instruct the Service to delete any specific fact, or you may delete all stored information by deleting your account.

2.6 Operational and diagnostic data

We collect technical logs related to the operation of the Service, including error reports, response timings, and AI token usage. These logs are scoped to your account for diagnostic purposes and are not used for advertising or shared with third parties for marketing.

We process your personal information for the following purposes:

• To deliver the Service, including answering questions, drafting messages, managing calendars, retrieving documents, and other tasks you request.
• To maintain conversational context across sessions so that the Service remains coherent over time.
• To detect, diagnose, and remedy errors and to improve the reliability of the Service.
• To respond to data-rights requests, legal process, or regulatory obligations.

We do not sell your personal information, use your User Content to train artificial intelligence models, or use your personal information for advertising purposes.

We engage the following sub-processors and third-party service providers to operate the Service. Each receives only the information required to perform its function:

• Anthropic, PBC — provides the underlying large language model (Claude) used to generate responses. Receives messages and tool invocations on a per-request basis. Anthropic does not train its models on data submitted through its API.
• Groq, Inc. — performs speech-to-text transcription of voice notes. Receives audio data for the duration of the transcription request only.
• fal.ai, Inc. — performs image generation when such a feature is invoked. Receives only the textual prompt supplied by the user.
• Google LLC — provides authentication and, where authorized, access to your Google Workspace data. Google's own privacy policy applies to its handling of your data.
• Supabase, Inc. — hosts the database in which account data, conversation history, and stored facts are persisted.
• Vercel, Inc. — hosts the web application and the server-side functions that operate the Service.
• Meta Platforms, Inc. — provides the WhatsApp Business Cloud API used to deliver messages between users and the Service.
• Telegram FZ-LLC — provides the Telegram Bot API used to deliver messages between users and the Service.

Your personal information may be transferred to and processed in countries other than your country of residence, including the United States and member states of the European Union, depending on the location of the sub-processors listed in Section 4. Where applicable, such transfers are made on the basis of contractual commitments imposed on the relevant sub-processor.

We retain your personal information for as long as your account remains active, in order to provide the Service to you.

Following deletion of your account, we retain your data for an additional period of thirty (30) days, after which we permanently purge your data from our active systems. Routine database backups created prior to deletion may persist for up to ninety (90) days from the date of the backup, after which they are overwritten in the normal course of operations.

Operational and diagnostic logs are retained for a period of up to ninety (90) days from the date of generation.

You may, at any time, exercise the following rights:

• Request that the Service forget any specific stored fact (e.g., by issuing a "forget that..." instruction).
• Disconnect any third-party service you have authorized, including by revoking Orakyl's access from your Google account settings.
• Request export of your personal information by writing to mukundmr95@gmail.com.
• Request deletion of your account and personal information by writing to mukundmr95@gmail.com. Deletion will be effected within thirty (30) days of receipt, subject to the retention provisions in Section 6.

If you reside in a jurisdiction that confers additional data protection rights — including, without limitation, the European Union (GDPR), the United Kingdom (UK GDPR), or India (Digital Personal Data Protection Act, 2023) — you may have further statutory rights. We will honor such rights to the extent required by applicable law.

We implement reasonable technical and organizational measures to protect your personal information, including TLS encryption for data in transit, encryption at rest for OAuth tokens issued by third-party services, and restricted database access limited to the application server.

No method of transmission or electronic storage is fully secure, and we cannot guarantee absolute security. To report a security concern relating to the Service, please contact mukundmr95@gmail.com.

Our web application uses a small number of essential cookies and similar local-storage mechanisms strictly necessary to operate the Service:

• Session cookies — issued upon sign-in to maintain your authenticated session.
• Cross-site request forgery tokens — issued during OAuth flows to prevent unauthorized cross-site requests.

We do not use advertising cookies, third-party tracking pixels, or analytics cookies that profile users across other websites. You may disable cookies in your browser settings; however, the Service will not function correctly without session cookies.

The Service is not directed to children under the age of eighteen (18), and we do not knowingly collect personal information from such individuals. If you believe a minor has registered for the Service, please contact mukundmr95@gmail.com and we will promptly delete the account.

We may amend this Privacy Policy from time to time to reflect changes in the Service or in applicable law. Material changes will be communicated to you through the messaging application you use to access the Service, with at least fourteen (14) days advance notice prior to the effective date. The "last updated" date at the top of this page reflects the most recent revision.

For all questions, requests, or concerns relating to this Privacy Policy or the personal information we hold about you, please contact mukundmr95@gmail.com. The operator of the Service is based in Bangalore, Karnataka, India.