Privacy Policy

AORKA ("we", "our", "us") is an AI operating layer for founders provided by Get Positioned. This Privacy Policy explains what personal data we collect when you use the AORKA app, how we use it, who we share it with, and the rights you have over it. We aim to comply with the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA), and other applicable privacy laws.

1. Who we are

The data controller for personal data processed through AORKA is Get Positioned. If you have questions about this policy or want to exercise your rights, contact us at privacy@getpositioned.com.

2. Information we collect

• Account data: name, email address, password hash, workspace name.
• Business context you provide: answers in onboarding, uploaded documents, decisions, notes and any content you send to the AI Boardroom or Business Brain.
• Usage data: pages visited, features used, timestamps, device and browser information, IP address, and diagnostic logs.
• Billing data: plan, subscription status and the last four digits of your payment method. Full card details are handled by our payment processor and never stored by us.
• Cookies and similar technologies: see our Cookie Notice.

3. How we use your data

• To provide, operate and improve the AORKA app and its features.
• To generate recommendations, decisions and reports using AI on your behalf.
• To authenticate you, secure your workspace and prevent abuse.
• To communicate with you about your account, reminders you set, service updates and — with your consent where required — product news.
• To meet legal, tax and accounting obligations.

4. Legal bases (GDPR / UK GDPR)

We rely on the following legal bases: performance of a contract (to provide the app you subscribed to), our legitimate interests (to keep the service secure and to improve it), your consent (for optional marketing and non-essential cookies) and legal obligation (to comply with laws).

5. AI processing

AORKA sends prompts derived from your inputs to third-party AI model providers (currently OpenAI and Google) via the Lovable AI Gateway to generate responses. We do not train foundation models on your data. Providers may process your prompts to deliver a response and to run abuse detection, but do not use your content to train their models under the API agreements we rely on.

6. Sharing your data

We share personal data only with service providers that help us run AORKA, under written data-processing agreements. Current categories include: cloud hosting and database, authentication, email delivery, payment processing, AI model providers, and product analytics. We do not sell your personal data. We do not share your personal data for cross-context behavioural advertising.

7. International transfers

Some providers process data outside your country of residence, including in the United States. Where required, we rely on the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, and equivalent safeguards.

8. How long we keep your data

• Account and workspace content: while your account is active, and up to 90 days after deletion for backups.
• Billing records: as required by tax and accounting law (typically 6–10 years).
• Diagnostic logs: up to 90 days.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete, port or restrict processing of your personal data, to object to processing based on legitimate interests, and to withdraw consent. California residents have the right to know, delete, correct and limit use of sensitive personal information, and to opt out of "sale" or "sharing" — although we do neither. To exercise any of these rights, email privacy@getpositioned.com. You also have the right to lodge a complaint with your local data protection authority.

10. Security

We use industry-standard controls including encryption in transit (TLS), encryption at rest for our database and file storage, role-based access, row-level security, and audit logging. No system is ever perfectly secure — if you believe you've found a vulnerability, please email security@getpositioned.com.

11. Children

AORKA is not intended for people under 16 and we do not knowingly collect data from children.

12. Changes to this policy

If we make material changes we'll notify you by email or an in-app notice at least 14 days before they take effect.