Skip to main content

Privacy Policy

Last updated: September 9, 2026

The Service is a beta. We are not a registered legal entity. We are working through privacy and data-protection requirements for each country where we operate or plan to operate; that work is in progress, and this policy will be updated as it lands.

1. Who we are​

OrcaRail (“we”, “us”, “our”) operates the OrcaRail API, dashboard, and related services (the “Service”) as a beta product. No company registration has been completed. We review and implement applicable privacy and data-protection requirements country by country, and we have not finished that process.

We process personal data in connection with the Service. We have not completed company registration and have not appointed a registered data controller in any country; we still honor the requests in this policy.

Contact: [email protected]

2. Data we collect​

We collect information necessary to provide and improve the Service:

  • Account and usage: Email address, account credentials, API keys (and related usage), dashboard usage, and support communications.
  • Transaction-related data: Payment intent metadata, transaction identifiers, and logs needed for operations, security, and support (we do not custody funds; settlement is on-chain).
  • Logs and security: Server logs, IP addresses (where applicable), and data used for security, fraud prevention, and debugging.
  • Analytics: We may use analytics services (e.g. Google Analytics, Google Tag Manager) with IP anonymization enabled. We only pass a user ID to analytics—we do not send your email, name, or other identifying profile data to these services.

3. How we use your data​

We use the data we collect to:

  • Provide, operate, and maintain the Service.
  • Authenticate you and manage your account and API access.
  • Process and support transactions and webhooks.
  • Improve the Service, diagnose issues, and ensure security.
  • Communicate with you (e.g. support, important service updates).
  • Comply with applicable law and enforce our terms.

The legal basis for processing can differ by country. We are mapping those requirements as part of the work described above. Until that mapping is complete, we process personal data:

  • To provide the Service to you (e.g. account, API, transactions).
  • Where we have a legitimate interest (e.g. security, analytics, product improvement), balanced against your rights.
  • Where required by law (e.g. legal obligations, disputes).

We retain data only as long as needed for these purposes or as required by applicable law, then delete or anonymize it.

5. Your rights​

Depending on your location, you may have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate data.
  • Request deletion of your data (subject to legal and operational needs).
  • Data portability (e.g. a copy of your data in a structured format).
  • Object to or restrict certain processing.
  • Withdraw consent where processing is based on consent.
  • Lodge a complaint with a supervisory authority in your country, where that right applies. Because we are unregistered and still working through per-country requirements, the competent authority depends on your location; contact us if you need help identifying it.

To exercise these rights, contact us at [email protected].

6. Cookies and similar technologies​

We and our analytics providers may use cookies and similar technologies for:

  • Strictly necessary operation of the Service (e.g. session, security).
  • Analytics (with IP anonymization and without sending email/name), to understand usage and improve the product.

You can control cookies via your browser settings. Disabling certain cookies may affect how the Service works.

7. International transfers​

The Service may process data in more than one country. As we complete per-country requirements, we will apply the transfer safeguards those laws require (for example adequacy decisions, standard contractual clauses, or other approved mechanisms). Until then, we still limit access to what we need to operate the beta.

8. Changes to this policy​

We may update this Privacy Policy from time to time. We will post the revised policy on this page and update the “Last updated” date. Continued use of the Service after changes constitutes acceptance of the updated policy. For material changes, we may provide additional notice (e.g. by email or in the dashboard).

9. Contact​

For privacy-related questions or to exercise your rights, contact us at [email protected].