Privacy Policy

This policy covers the orqlabs.com website, the app.orqlabs.com panel, the api.orqlabs.com API and the AI agent, workflow and integration services offered through them (together, the "Platform").

We process data in two different roles:

• As a controller: data of people who create accounts, organization administrators and visitors of our website (name, email, billing, support messages, security logs).
• As a processor: data about our customers' own customers and prospects, for example messages received on WhatsApp or Telegram, lead lists and social media comments. The business using the Platform is the controller of that data; we process it only on its instructions and to provide the service.

The controller is the company operating under the OrqLabs brand. Its legal name and address are listed in the Contact section at the end of this page.

For any question or request about your personal data, write to hello@orqlabs.com. Sending your request from the email address registered on the Platform helps us verify your identity.

We do not intend to process special categories of personal data (health, biometric, religion, political opinion, etc.) and ask you not to upload such data to the Platform.

When an agent performs a task, the information relevant to that task (project and brand details, strategy document, the related message or lead record, tool results) is sent through the API to the provider of the model you selected (Anthropic or OpenAI), and the response returns to the Platform.

• OrqLabs does not use your data to train models.
• Anthropic and OpenAI state that they do not use API data to train their models by default; they may retain it for a limited period (typically up to 30 days) to monitor abuse.
• When you use your own API key (BYOK), requests go through your account and your agreement with that provider applies.
• Agent output can be wrong or incomplete. We recommend human approval before publishing or sending; the Platform provides approval steps for this.
• We do not make solely automated decisions that produce legal effects on individuals. Scores produced by agents (e.g. lead scores) are decision support for you.

When you connect a social, messaging, analytics or CRM account we request only the permissions the service needs. The connection screen lists them, for example publishing posts, reading metrics and comments, or sending messages. Data received from these platforms is used only to provide the features you use.

• Meta (Facebook, Instagram, Messenger, WhatsApp, Threads): page and account details, posts, comments, messages and insights. You can remove the app under Settings → Business Integrations on Facebook; Meta then notifies us and we delete the stored tokens.
• X, LinkedIn, TikTok, Pinterest: profile details, posts and post metrics; we follow these platforms' developer policies.
• YouTube: we use the YouTube API Services. By using this feature you agree to the YouTube Terms of Service; how Google processes your data is explained in the Google Privacy Policy. You can revoke access at any time in your Google security settings.
• Google (Analytics, Search Console, Sheets, YouTube): OrqLabs' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use this data for advertising, do not sell it, and allow humans to read it only with your request, for security or where required by law.

To provide the service we work with the service providers (sub-processors) below. Each is bound by a contract with data protection obligations and receives only the data it needs.

e-Arşiv and e-Fatura invoices are issued through the systems of the Turkish Revenue Administration (Gelir İdaresi Başkanlığı) as required by tax law, so your billing details are transmitted to those systems.

In addition, data is sent on your instructions to the platforms you connect, for example to publish a post on Instagram or reply on WhatsApp. Those platforms are governed by their own privacy policies. We disclose information to authorities only where legally required.

Our servers are in the European Union and some sub-processors are in the United States. Transfers from the EU rely on the European Commission's Standard Contractual Clauses (SCCs) with supplementary safeguards, and transfers from Turkey rely on the standard contracts announced by the Personal Data Protection Board under Article 9 of KVKK or adequacy decisions.

When a period ends, data is deleted, destroyed or anonymized.

• All connections are encrypted with TLS (HTTPS).
• Connected account tokens and API keys are stored encrypted with AES-256-GCM and are never shown in plain text in the panel.
• Passwords are hashed irreversibly with argon2.
• Each organization's data is logically isolated; access is role-based (Owner, Admin, Member, Viewer).
• Important actions are written to an audit log; incoming webhooks are verified by signature.
• AI usage is protected by budget limits; outbound requests are filtered against access to internal networks.

No system is completely risk-free. If a breach affects your data, we notify the competent authority and you within the time limits set by GDPR and KVKK.

To measure visits, see which pages are read and improve the site we use Google Analytics 4 and our own first-visit source cookie (orq_attr); to measure the results of our Meta (Facebook, Instagram) ads we use Meta Pixel. All of them only with your consent, and Meta Pixel needs a separate consent (you can decline it with "Analytics only"):

• Before you choose, or if you decline: Google Analytics is not loaded at all – no data is sent to Google before you give consent and no cookies are set. The first connection to Google is made only when you click "Accept".
• If you accept: the _ga and _ga_<id> cookies collect statistics such as sessions, page views, traffic sources and device type. Google Analytics 4 does not log your IP address. Data is kept for the retention period set in our Google Analytics account (at most 14 months) and is never used for advertising.
• First-visit source (`orq_attr`): if you consent, a first-party cookie stores where your first visit came from – campaign parameters (utm_*, whether it was a Google Ads or Meta ad click), the referring website's domain and the first page you opened – for 90 days (orqlabs.com and its subdomains). If you sign up in the panel, this information is saved with your account; we use it to measure which channels work, never for advertising.
• Meta Pixel (marketing cookies, only if you choose "Accept all"): the _fbp cookie (browser id, 90 days) and, if you came from a Meta ad, _fbc (ad click id, 90 days) are set, and events such as page views and contact form submissions are sent to Meta. If you sign up in the panel or buy a paid plan, our server reports that event to the Meta Conversions API on the same consent; your e-mail address is sent only one-way hashed (SHA-256). We use this to measure how many sign-ups and purchases our ads bring and to improve ad delivery. Without your consent Meta Pixel is not loaded and nothing is sent to Meta.
• International transfer: Google Analytics data is processed by Google Ireland Ltd. and Google LLC, Meta Pixel data by Meta Platforms Ireland Ltd. and Meta Platforms, Inc., and may be transferred to servers in the EU and the USA, based on your consent and the companies' Standard Contractual Clauses (and, under KVKK, your explicit consent).
• Changing your choice: use the Cookie preferences link in the site footer to withdraw or give consent at any time. When you withdraw, the Google Analytics cookies, the orq_attr cookie and the Meta cookies (_fbp, _fbc) are deleted and these tools are not loaded on the following pages.

Apart from that, we use your browser's local storage for functional purposes only:

• Theme and language: to remember your light/dark theme and language choice.
• Cookie choice: to remember your analytics and marketing consent (orq.consent, orq.consent.marketing).
• Session: a short-lived access token and a refresh token keep you signed in to the panel.

Under GDPR and Article 11 of KVKK you have the right to:

• Learn whether your personal data is processed and obtain information about it
• Learn the purpose of processing and whether data is used in line with it
• Know the third parties to whom data is transferred, in Turkey or abroad
• Request correction of incomplete or inaccurate data
• Request deletion or destruction, and notification of this to third parties that received the data
• Object to an outcome against you that results solely from automated analysis
• Claim compensation for damage caused by unlawful processing
• Receive your data in a structured, machine-readable format (portability) and object to processing
• Withdraw consent at any time where processing is based on consent

Send requests to hello@orqlabs.com from your registered email address. We respond free of charge within 30 days. If you are not satisfied, you can complain to the data protection authority in your country of residence or, in Turkey, to the Personal Data Protection Board.

1. 1Remove a connection: in the panel go to Integrations → account → Disconnect. Tokens and keys are deleted immediately.
2. 2Delete individual records: leads, content, reports and conversations can be deleted on their pages.
3. 3Delete your whole account: write to hello@orqlabs.com. Your organization's data is deleted within 30 days, and from backups within 90 days. You can ask for an export before deletion.
4. 4Through your Meta account: when you remove the app in Facebook settings and request data deletion, you receive a confirmation code you can use to check the status of the request.

The Platform is intended for businesses and is not suitable for anyone under 18. We do not knowingly collect children's data; if we become aware of such data, we delete it.

We may update this policy as our services or the law change. The current version is always on this page and the date at the top changes. We announce significant changes by email or in-panel notice before they take effect.