Know where your data goes.

2. Workstation Data Sovereignty & Model Training

Client-side workstation tool: Orek AI executes locally on your workstation (macOS, Linux, or Windows). Your repository files, source code, branch history, file paths, diffs, and project metadata are parsed and indexed locally on your workstation.

No automatic project uploads: The client does not automatically upload your repository files, terminal output, or local session journals to OrekGames. Material you send to a configured model provider, an external tool, or our support team follows the destination’s data handling rules. Review support attachments before sending them.

No model training on customer code: OrekGames does not collect or use customer source code, files, prompts, or model outputs to train artificial intelligence or machine learning models.

3. Model Provider Independence (BYOK)

Orek AI operates on a Bring-Your-Own-Key (BYOK) model. When you invoke AI capabilities, the client tool connects directly from your workstation to your configured model providers (such as OpenAI, Anthropic, Google Gemini, Groq, Ollama, or custom OpenAI-compatible endpoints).

Local credential security: The client reads provider credentials from the sources you configure, including environment variables, local configuration, and the operating system’s secure credential store. Account, purchase, and license requests do not send your model provider keys to OrekGames or to our license signing service.

Provider data policies: Because your workstation communicates directly with your chosen model providers, your usage of those endpoints is governed exclusively by each provider’s respective terms of service and privacy policies. We encourage you to review their data retention and model training policies directly.

4. Information Collected by the Website & Licensing Service

To provide software downloads, process orders, issue license keys, and maintain customer accounts, our website and licensing services collect the following limited information:

• Customer Account Identity: When you sign in using Google or GitHub, we receive an account subject identifier, verified email address, and display name (when supplied).
• Billing and Purchases: New purchases use Stripe Managed Payments, with the merchant of record identified as “Sold through Link” in Checkout. Payment card details and any billing information requested by Checkout are submitted to Stripe, rather than to an OrekGames payment form. We retain the order and payment identifiers, purchased edition and release version, base order amount and currency, final declared billing country, tax status, accepted terms version, and timestamps. When Stripe returns a buyer-facing amount or currency, we retain those separately from the base order total. We retrieve receipt links from Stripe when you view Billing. Software support remains available through OrekGames support.
• Device Seat Allocations & Activations: To enforce your license's device allowance, the licensing service records a device identifier, your chosen device nickname, operating system platform, activation status, and activation timestamps. It does not monitor offline use or require a periodic paid-license check-in.
• License Signing: We send the signed document’s input to Google Cloud Key Management Service (KMS). Activation input contains account, license, activation, installation, and issuance identifiers; a hash of the installation binding; edition; issuance time and revision; and trial dates or purchased version and update rights. Revocation input identifies the affected license, activation, issuance, and revision. These are account-linked identifiers, rather than anonymous data. Signing input does not contain your email address, display name, model provider keys, source code, prompts, the installation’s private binding secret, or an online activation bearer token.
• Infrastructure and Security Logs: When accessing our website or downloading software packages, web server logs record transient connection metadata (IP address, user agent, and request timestamps) strictly for rate limiting, DDoS defense, and abuse prevention.
• Customer Support Inquiries: When you submit a request through our Support & Contact page, we collect the contact address you provide, inquiry details, and any diagnostic logs you choose to share.

Service providers and locations: Cloudflare hosts the website, customer service, and stored account and licensing records. Google Cloud provides KMS signing, security audit logging, and operational alerts and reconciliation. Our KMS key is configured in Google Cloud’s global location, so we do not promise that these services keep data within your country or a particular region. Stripe and Link handle the checkout, payment, tax, and merchant-of-record activities described in their own privacy notices. See Cloudflare’s privacy policy, Google Cloud’s data processing terms, Stripe’s privacy policy, and Link’s privacy policy.

5. Telemetry & Client Observability

Zero OrekGames telemetry: OrekGames does not collect telemetry, usage metrics, feature analytics, or crash reports from the Orek client tool. We do not operate an analytics intake server and offer no mechanism to opt in to OrekGames telemetry collection.

User-configured observability: The client includes an optional OpenTelemetry exporter for a monitoring destination you choose. That destination’s privacy and retention policies apply to the data you configure the client to send.

Service security monitoring: Our hosted services record operational failures and compare aggregate license signature counts with KMS audit events. Failure alerts contain the environment, signing stage, key identifier, event time, and count. They do not contain signed documents, customer identity, payment details, or signing input. This monitoring does not report how you use the client.

6. Cookies & Browser Storage

We do not use advertising tracking cookies, marketing pixels, or third-party behavioral analytics on our website.

• Essential Session Cookies: We issue a cryptographically random, high-entropy, HttpOnly, Secure, SameSite=Lax session cookie (__Host-orek_session) with a 7-day expiration to maintain your authenticated customer console session. A short-lived cookie is also used during OAuth sign-in to prevent cross-site request forgery.
• Browser Storage: Your browser's localStorage stores only client-side UI preferences (theme selection and sound effects toggle), and sessionStorage holds temporary state while you complete a device handoff or manual license activation in the console.

7. Legal Bases for Processing (GDPR / UK GDPR)

If you are located in the EEA or UK, we process your personal data under the following lawful bases established by Article 6 of the General Data Protection Regulation:

• Contractual Necessity (Art. 6(1)(b)): To authenticate your account, issue perpetual license keys, and verify authorized device seat allocations.
• Legal Obligation (Art. 6(1)(c)): To maintain sales records, invoices, and tax documentation in compliance with applicable federal, state, and international tax and accounting laws.
• Legitimate Interests (Art. 6(1)(f)): To secure our web services against fraud, abuse, and denial-of-service attacks, and to defend against payment disputes and unauthorized chargebacks.

8. Data Retention & Account Deletion

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy:

• Active Sessions & Temp Records: Browser sessions expire automatically after 7 days or immediately upon sign-out. Temporary rate-limiting counters expire within hours.
• Customer Accounts: Account identity records and active device seat allocations remain active for the lifespan of your customer account to enable license management.
• Account Deletion: You may delete your account from the Customer Console or request deletion through our Support & Contact page. The request immediately invalidates sessions and online license and device authority. Subsequent removal processing severs sign-in identities and replaces the stored email and name with a deleted-account marker. We preserve account-linked issuance and revocation history, revoked installation bindings, and keyed trial-identity hashes for license integrity and trial abuse prevention. These records are pseudonymous, not anonymous. Account deletion cannot recall a signed document already held by an offline workstation.
• Financial Retention: Completed, refunded, and disputed orders remain restricted from customer access after account deletion. Our financial retention policy is up to seven (7) years for tax, accounting, and payment dispute obligations, with longer preservation only where an applicable legal hold requires it. Retention and deletion requests are reviewed through support; account deletion does not immediately erase these records.
• Signing Audit Logs: Google Cloud signing audit logs are configured for 400 days of retention. They record signing access and operational metadata for security review and reconciliation. We do not write license claims or signing input into application failure logs. See Google Cloud’s KMS audit logging documentation.

9. Data Subject Rights (GDPR & CCPA/CPRA)

Depending on your location, applicable data protection laws (including the GDPR, UK GDPR, and California Consumer Privacy Act / CPRA) grant you specific rights regarding your personal information:

• Right to Access: You have the right to request a copy of the personal information we hold about you.
• Right to Rectification: You have the right to correct inaccurate or incomplete personal information.
• Right to Erasure (“Right to be Forgotten”): You have the right to request deletion of your account and personal data, subject to the statutory tax and legal dispute retention rules described above.
• Right to Restrict or Object: You may restrict or object to our processing of your personal data under certain conditions.
• Right to Data Portability: You may request an export of the account information you provided to us in a structured, machine-readable format.
• Non-Sale of Personal Information (CCPA/CPRA): OrekGames LLC does not sell or share your personal information with third parties for monetary or other valuable consideration, nor for cross-context behavioral advertising.

To exercise any of these rights, submit a request via our Support & Contact page. We do not discriminate against customers who exercise their statutory privacy rights.

10. Merchant Identity & Privacy Inquiries

For questions, concerns, or requests regarding this Privacy Policy or our data handling practices, reach out via our support page:

• Company: OrekGames LLC
• Jurisdiction: Wisconsin, United States
• Support & Contact Page: https://orek.ai/support