Privacy Policy

AORKA ("we", "our", "us") is an intelligence platform for founders provided by Get Positioned. This Privacy Policy explains what personal data we collect when you use the AORKA app, how we use it, who we share it with, and the rights you have over it. We aim to comply with the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA), and other applicable privacy laws.

1. Who we are

The data controller for personal data processed through AORKA is Get Positioned. If you have questions about this policy or want to exercise your rights, contact us at privacy@getpositioned.com.

2. Information we collect

• Account data: name, email address, password hash, workspace name.
• Business context you provide: answers in onboarding, uploaded documents, decisions, notes and any content you send to the Boardroom or Business Brain.
• Usage data: pages visited, features used, timestamps, device and browser information, IP address, and diagnostic logs.
• Billing data: plan, subscription status and the last four digits of your payment method. Full card details are handled by our payment processor and never stored by us.
• Marketing list data: your name, email address, sign-up date and engagement with our emails (opens, clicks, unsubscribes), held by our email provider.
• Cookies and similar technologies: see our Cookie Notice.

3. How we use your data

• To provide, operate and improve the AORKA app and its features.
• To generate recommendations, decisions and reports using our intelligence engine on your behalf.
• To authenticate you, secure your workspace and prevent abuse.
• To communicate with you about your account, reminders you set, security alerts and billing (service and transactional messages you cannot unsubscribe from while your account is open).
• To send you AORKA product updates, feature announcements and occasional offers by email. Creating an account opts you in to these; the opt-out is shown at sign-up, every email carries a one-click unsubscribe link, and you can switch it off at any time in Profile → Privacy.
• To meet legal, tax and accounting obligations.

4. Legal bases (GDPR / UK GDPR)

We rely on the following legal bases: performance of a contract (to provide the app you subscribed to), our legitimate interests (to keep the service secure and to improve it), your consent (for non-essential cookies, and for marketing email wherever local law requires prior consent) and legal obligation (to comply with laws).

For marketing email to people who signed up for AORKA, we rely on the soft opt-in permitted by the ePrivacy Directive and PECR (and on our legitimate interest in promoting our own similar products) — we collected your address when you created an account, we offer the opt-out at that point, and we repeat it in every message. Where local law requires express prior consent instead, we rely on the choice you made at sign-up. You can object or withdraw at any time with no effect on your use of AORKA. Every choice is written to our consent ledger with a timestamp and source so we can demonstrate accountability under Article 5(2).

5. Intelligence processing

AORKA sends prompts derived from your inputs to third-party intelligence model providers (currently OpenAI and Google) via the Lovable Gateway to generate responses. We do not train foundation models on your data. Providers may process your prompts to deliver a response and to run abuse detection, but do not use your content to train their models under the API agreements we rely on.

6. Sharing your data

We share personal data only with service providers that help us run AORKA, under written data-processing agreements. Current categories include: cloud hosting and database, authentication, transactional and marketing email delivery (Mailchimp, operated by Intuit), payment processing, intelligence model providers, and product analytics. We do not sell your personal data. We do not share your personal data for cross-context behavioural advertising.

7. International transfers

Some providers process data outside your country of residence, including in the United States. Where required, we rely on the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, and equivalent safeguards.

8. How long we keep your data

• Account and workspace content: while your account is active, and up to 90 days after deletion for backups.
• Billing records: as required by tax and accounting law (typically 6–10 years).
• Diagnostic logs: up to 90 days.
• Marketing list data: until you unsubscribe or delete your account, plus a minimal suppression record kept indefinitely so we do not email you again by mistake.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete, port or restrict processing of your personal data, to object to processing based on legitimate interests, and to withdraw consent. California residents have the right to know, delete, correct and limit use of sensitive personal information, and to opt out of "sale" or "sharing" — although we do neither. To exercise any of these rights, email privacy@getpositioned.com. You also have the right to lodge a complaint with your local data protection authority.

10. Security

We use industry-standard controls including encryption in transit (TLS), encryption at rest for our database and file storage, role-based access, row-level security, and audit logging. No system is ever perfectly secure — if you believe you've found a vulnerability, please email security@getpositioned.com.

Our control environment is aligned to the AICPA SOC 2 Trust Services Criteria for Security, Availability and Confidentiality: least-privilege access reviews, workspace-level data isolation, audit logging of privileged actions, change management and code review for production changes, vendor due diligence with written data-processing agreements, tested backup and recovery, and a documented incident-response process under which we notify affected customers without undue delay and, where the GDPR requires it, report a personal-data breach to the relevant supervisory authority within 72 hours of becoming aware of it. Alignment to these criteria is not the same as a completed SOC 2 attestation; we will say so plainly when an independent report is available and share it under NDA. A Data Processing Addendum incorporating the EU Standard Contractual Clauses is available from privacy@getpositioned.com.

11. Children

AORKA is not intended for people under 16 and we do not knowingly collect data from children.

12. Changes to this policy

If we make material changes we'll notify you by email or an in-app notice at least 14 days before they take effect.