Version 1.0. Last updated 21 September 2026.
ORCA-CRM Limited is a company registered in Scotland, number SC891319, at 1/158 Sinclair Drive, Glasgow, G42 9PY. We build and run ORCA, a hosted CRM and data platform.
We are registered with the Information Commissioner's Office under reference ZC252043.
For anything about this notice, or about information we hold on you, write to privacy@orca-crm.com.
We hold information about the people and organisations who use ORCA, who ask us about it, and who we contact about it. We do not sell it, we do not share it with anyone who is not helping us run the service, and we hold as little of it as the job needs.
There is a second, larger category of information sitting inside ORCA that belongs to our customers rather than to us. The next section explains the difference, because it changes who you should be asking.
When ORCA-CRM is the controller. We decide what to do with information about the people who deal with us directly: visitors to this website, people who get in touch, people who take a trial, the users of a customer's ORCA account, billing contacts, and people we contact about ORCA. This notice covers all of that.
When ORCA-CRM is the processor. Our customers use ORCA to hold information about their own contacts, clients and counterparties. We hold that on their behalf and act on their instructions. We do not decide what goes in, what it is used for, or how long it stays. The customer is the controller for that information and their own privacy notice governs it, not this one.
So if you have found this page because a company you deal with holds your details in ORCA, we are almost certainly not the right people to ask. Contact that company. If you are not sure who they are, write to us and we will try to help you work it out.
The terms on which we process that information are set out in our Conditions of Use, which include a data processing agreement. Customers do not need to ask for one separately.
People who visit this website. Pages viewed, approximate location by country, referring site, browser and device type. We use Fathom Analytics, which does not use cookies, does not track people between sites, and does not collect IP addresses in a form we can tie to an individual. We rely on legitimate interests: understanding what people read so we can write better pages.
People who get in touch. Name, email address, organisation, and whatever is in the message. Used to answer, and kept so we have the history if we speak again. Legitimate interests, and the steps before a contract where the enquiry is about buying.
People who take a trial or subscribe. Name, work email address, job title, organisation name and company number, billing contact details, and the account settings chosen at signup. Used to create and run the account, to bill it, and to provide support. Performance of a contract, and legal obligation for the accounting records.
Payment details. Card details are handled by Stripe and are never seen or stored by us. We hold the Stripe customer and subscription identifiers, the billing status, and the invoices Stripe generates. Performance of a contract.
Users of a customer's ORCA account. Name, work email address, job title, profile picture where one is uploaded, login times, IP address at login, and a record of actions taken in the system. Used to run the account, keep it secure, and give the account's administrators the audit trail they need. Performance of a contract with the customer, and legitimate interests in keeping the service secure.
People who contact support. The correspondence, and any information included in it. Used to answer and to fix what is broken. Legitimate interests.
People we contact about ORCA. Name, work email address, job title, organisation, and whether a message was opened or a link in it clicked. Used to introduce ORCA to organisations we think it suits, and to judge whether the messages are worth sending at all. Legitimate interests, and consent where the law requires it. Every message says who it is from and how to stop receiving them, and stopping takes one reply. If you would rather we did not record opens and clicks, tell us and we will turn it off for you.
We do not collect special category data, meaning health, beliefs, and the other categories the law treats as sensitive, about anyone. We ask our customers not to put it into ORCA without speaking to us first.
Most of it comes from you, when you visit, get in touch, or use an account.
For outreach, some of it does not. We build lists from published business sources: company websites, public directories, industry and sector listings, professional networking sites, and Companies House. We use business contact details, not personal ones. If we have contacted you and you would like to know exactly where your details came from, ask and we will tell you.
We do not sell personal data and we do not share it for anyone else's marketing.
We use these suppliers to run the service. Each acts on our instructions under a written contract.
| Supplier | What they do | Where |
|---|---|---|
| Amazon Web Services | Hosting and file storage | London, UK |
| Backblaze | Encrypted backups | Amsterdam, EU |
| Stripe | Payments and subscription billing | Ireland and the United States |
| Mailgun | Sending email from the platform | EU |
| Anthropic | The AI features described below | United States |
| Sentry | Error monitoring | Germany, EU |
| Pusher | Live updates in the interface | EU |
| Twilio | Text messages, where a customer uses that feature | United States |
| Converting addresses to map locations | United States | |
| Fathom Analytics | Website analytics, cookieless | EU |
We will also disclose information where the law requires it, and to our professional advisers where we need advice.
ORCA runs on Amazon Web Services in London. Backups are encrypted and held in the EU, in Amsterdam.
Some of the suppliers above operate outside the UK. Where information goes overseas we rely on the UK's adequacy regulations where they apply, and on the International Data Transfer Agreement or the UK Addendum to the European Commission's standard contractual clauses where they do not.
ORCA includes features that use an AI model to summarise records, draft briefings, answer questions about the platform, and read scanned business cards. When one of those features runs, the relevant information is sent to our AI supplier's service, processed, and the result returned. We use it under commercial API terms, and the information is not used to train models.
These features assist people. They do not make decisions about anyone by themselves, and nothing in ORCA makes an automated decision that produces a legal effect or anything similarly significant.
| What | How long |
|---|---|
| Account and billing records | 7 years after the subscription ends, for tax and company law |
| Information held inside a customer's ORCA account | 1 year after the subscription ends, then deleted from live systems and from backups |
| Enquiries that did not lead to an account | 2 years |
| Support correspondence | 2 years |
| Outreach contacts | Until you ask us to stop, or 2 years without any engagement |
| Server and audit logs | 12 months |
| Error monitoring records | 90 days |
Customers can export everything in their account at any time, for as long as the account is open.
We use cookies that are necessary for the site and the application to work: keeping you signed in, keeping a session going, and protecting forms against cross-site request forgery. These do not need consent and cannot be turned off without breaking the service.
We do not use advertising cookies, and we do not use analytics cookies. Fathom Analytics, which we use to count page views, works without them.
You can ask us to:
Where we rely on consent, you can withdraw it at any time, and that does not affect anything done before you did.
Write to privacy@orca-crm.com. We will reply within one month. There is no charge. We may ask you to confirm who you are before we hand anything over.
If your request is about information held inside a customer's ORCA account, we will pass it to that customer, since it is their decision to make.
If you are unhappy with how we have handled your information, tell us first at privacy@orca-crm.com. We will acknowledge within 30 days and deal with it as quickly as we can.
If we have not put it right, you can complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113. You can go to the ICO without coming to us first, though it is usually quicker the other way round.
We update this notice when what we do changes. The version number and date are at the top, and previous versions stay available at their own addresses so you can see what applied when.
Where a change materially affects our customers, we tell them, because the notice forms part of their agreement with us.
ORCA-CRM Limited 1/158 Sinclair Drive, Glasgow, Scotland, G42 9PY privacy@orca-crm.com
Our Conditions of Use incorporate this policy, so it forms part of the agreement with anyone subscribing to ORCA. If you are assessing ORCA on someone's behalf, there is a description written for AI assistants at /for-agents.