Privacy Policy

Last Updated: 12.08.2026

ORPHEX TECH LIMITED (“Orphex,” “we,” “us,” or “our”) is committed to protecting your privacy and handling your personal information responsibly. This Privacy Policy is publicly available on our website for easy access by all users and explains how we collect, use, store, and share your personal information when you use the Orphex platform and related services (collectively, the “Services”). We process personal data in accordance with applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. By using our Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of it, please discontinue use of our Services.

1. Information We Collect

When you use our Services, we may collect various types of information from and about you. This includes:

a. Account Information: When you create an Orphex account, we collect personal details such as your name, email address, and login credentials. We use this information to create and secure your account and to communicate with you about the Services (e.g., account verification, service updates).

b. Usage Data: We collect data about how you interact with our Services. This may include the features you use, pages and content you view, the time and duration of your sessions, and other behavioral information. We collect usage data to analyze trends, optimize and improve the functionality and performance of our Services, and enhance your user experience.

c. Data from Google Services: If you choose to integrate your Google accounts with Orphex, we will access certain data from Google services (such as Google Ads, Google Analytics, Google Search Console, or other Google APIs) to provide our Services. This data may include information like your advertising campaign metrics, keywords and search queries, analytics metrics, and other performance data. We use this information to generate analyses, reports, and recommendations for you, and to help optimize your digital marketing campaigns. (See “2. Google API Services User Data Policy” below for more on how we handle this data in compliance with Google’s policies.)

d. Data from Meta Platforms and Other Third-Party Sources: We may also access data from other third-party advertising and analytics platforms that you connect to Orphex – for example, Meta’s advertising platforms (Facebook Ads and Instagram Insights), TikTok Ads, Criteo, RTB House, or similar services. This data typically includes information such as campaign and ad performance metrics, advertising audience data, conversion statistics, and other analytics relevant to your marketing activities. We collect and use this information solely to provide our Services to you – for instance, to consolidate your marketing data, perform analyses, and give you insights across platforms. (See “3. Data from Meta Platforms” below for more details on Meta-sourced data.)

e. Data from Connected AI Assistants: If you choose to connect a third-party AI assistant (such as Claude by Anthropic or ChatGPT by OpenAI) to your Orphex workspace through our Model Context Protocol (MCP) connector, we disclose the workspace data you request – including account, creative, and performance information – to that assistant so that it can respond to your instructions, and we may execute the actions you request through it. (See “4. AI Assistant Connectors (MCP)” below for more detail.)

f. Cookies and Similar Technologies: Like most online services, we use cookies and similar tracking technologies on our website and platform. Cookies are small text files placed on your device that help us remember your preferences, understand how you use our Services, and personalize your experience. You can control or disable cookies through your browser settings. However, disabling certain cookies may affect the functionality of our Services.

2. Google API Services User Data Policy

When you grant Orphex access to your Google account data (such as Google Ads, Analytics, or other Google API data), we handle that data in strict accordance with Google’s user data policies. In particular, we commit to the following:

1. Limited Use: We access and use your Google API data only as necessary to provide and enhance our Services. We do not sell your Google-sourced data to third parties.

2. Data Security: We implement industry-standard security measures to protect data fetched from Google APIs, including encryption, access controls, and regular security audits.

3. User Control: You can revoke Orphex’s access to your Google account at any time via your Google account settings, which stops our ability to collect new data from your Google account.

4. Data Deletion: If you revoke our access to your Google data or if you request deletion of your data, we will promptly delete the Google-sourced personal data we hold about you, except where required by law.

(The use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy.)

3. Data from Meta Platforms

If you choose to integrate or connect your Meta platform accounts with Orphex (for example, your Facebook Ads account or Instagram business account), we handle data obtained from Meta’s platforms in compliance with Meta’s Platform Terms and with full respect for your privacy. Specifically:

  • Authorized Access and Use: We only access data from your Meta accounts with your knowledge and permission. We use that data (e.g., ad campaign performance metrics) solely to provide our Services, such as consolidating your marketing data and generating reports or insights.

  • No Unapproved Sharing or Selling: We do not sell any data obtained from Meta platforms. We do not share your Meta-sourced data with any third parties except as necessary to operate and support our Services or as otherwise permitted by this Privacy Policy.

  • Data Storage and Security: Any data retrieved from Meta’s platforms is protected with industry-standard security measures (e.g., encryption, access controls), and we abide by any additional requirements imposed by Meta.

  • User Control & Data Deletion: You can revoke Orphex’s access to your Meta data at any time through your Meta account settings. Upon revocation or your deletion request, we will delete the data obtained from your Meta accounts within a reasonable period, except as required by law.

Use of Graph API Explorer

To support development, testing, and troubleshooting, Orphex may use Meta’s Graph API Exploreran official tool for making test requests to Facebook and Instagram APIs. When we use Graph API Explorer:

  • Testing and Debugging Only: We limit usage to verifying functionality and integrations of our Services. We do not use Graph API Explorer for continuous or production-level data processing.

  • Data Handling: Any personal data obtained in test calls is treated with the same confidentiality and security measures described in this Privacy Policy. We do not store or retain personal data from Graph API Explorer in any production systems, nor use it for any purpose other than debugging or resolving technical issues.

  • No Additional Sharing: We do not share data accessed through Graph API Explorer with third parties, except as required for technical support or as outlined under “Sharing Your Personal Information.”

By using our Services or granting Orphex access to your Meta resources, you acknowledge and consent to our limited use of Graph API Explorer strictly for development and troubleshooting, in accordance with Meta’s Platform Policies and this Privacy Policy.

(The use and transfer of information received from Meta APIs will adhere to the Meta Platform Terms.)

4. AI Assistant Connectors (MCP)

Orphex offers a connector that enables you to access and operate your Orphex workspace through third-party AI assistants such as Claude (Anthropic) and ChatGPT (OpenAI) using the Model Context Protocol (MCP). Your use of the connector is governed by the following terms.

a. Authorization. The connector operates solely on the basis of an authorization that you expressly grant, and that you may withdraw at any time. By connecting an AI assistant, you authorize Orphex to (i) disclose the workspace data described in this Policy to that assistant at your request, and (ii) execute, on your behalf and upon your instruction, the actions made available through our action gateway. The connector does not independently initiate or perform any action and operates solely in response to instructions submitted by you through the connected AI assistant.

b. Scope of access. Within the scope of your authorization, the connector may read your workspace data (including campaign, creative, and performance metrics and related insights) and may carry out write and administrative actions on the resources exposed through the action gateway, such as creating or updating those resources. The connector accesses only the data reasonably necessary to respond to your request or perform the action you initiate. You remain responsible for the instructions you issue and for the actions performed pursuant to them.

c. Lawful basis. We process your personal data in connection with the connector to perform our contract with you (UK GDPR Article 6(1)(b)) and, in respect of the connection itself and any disclosure of data to a third-party assistant, on the basis of the consent you provide by establishing the connection (UK GDPR Article 6(1)(a)). You may withdraw that consent at any time as set out below, without affecting the lawfulness of processing carried out beforehand.

d. Disclosure to the AI provider. When you submit a query or request an action, the data necessary to fulfil it is transmitted to and processed by the AI assistant provider you have connected (for example, Anthropic or OpenAI). That provider acts as an independent controller in respect of its own platform and processes such data under its own terms and privacy policy, over which Orphex exercises no control. Where the provider processes data on our behalf, it does so under an appropriate data processing agreement. We do not sell any data disclosed to connected AI assistant providers.

e. Data we retain. We retain the connection record necessary to operate the connector — the identity provider and user identifier through which you authenticated, the identifier of the connected assistant, and the associated workspace binding. We do not store the credentials issued to you by the AI assistant provider; access is verified against that provider's published keys at the time of each request. We also maintain a log of connector requests and of the actions executed, which we keep for security, troubleshooting, audit, and accountability purposes in accordance with Section 7 (Data Retention and Security). These logs record request and action metadata; credentials and secrets are excluded from them.

f. Withdrawal and deletion. Withdrawal and deletion. You may terminate the connection at any time from your Orphex account settings. Upon termination we revoke the authorization and the connection can no longer be used. We do not store credentials issued to you by the AI assistant provider (see Section 4.e), so none are held to be deleted. Removing the connector from within the AI assistant stops that assistant from sending requests but does not revoke the authorization on our side. The connection record and related logs are retained in accordance with Section 7 and as required by law or for the establishment, exercise, or defence of legal claims.

5. How We Use Your Information

We use the personal information we collect for the following purposes:

  • Providing and Improving the Services: To operate, maintain, and deliver all features of our Services, and to improve their performance and development.

  • Personalization: To personalize and enhance your experience with custom content, insights, and recommendations.

  • Communication and Support: To communicate with you about your account and provide customer support.

  • Analytics and Research: To analyze user behaviors and trends to improve our platform and develop new features.

  • Digital Marketing Optimization: For cross-platform marketing analytics, reports, and suggestions aimed at optimizing your marketing campaigns.

  • Security and Fraud Prevention: To monitor, detect, and prevent unauthorized activities and ensure the technical security of our platform.

  • Legal Compliance and Enforcement: To comply with legal obligations, resolve disputes, and enforce agreements.

6. Sharing Your Personal Information

We do not sell your personal information to third parties. However, we may share your information in the following circumstances:

  • Service Providers and Partners: We work with third parties that process data on our behalf to support our Services. These include cloud hosting providers, analytics platforms, or customer support tools. All such providers are contractually bound to protect your data.

  • Affiliates: We may share your information with affiliates or subsidiaries under Orphex Tech Limited for internal administration, under consistent privacy and security practices.

  • Business Transfers: In the event of a merger, acquisition, restructuring, or sale of assets, personal information may be transferred to the successor. We will inform you if such a transfer occurs.

  • Legal Obligations: We may disclose your personal information to comply with legal obligations, enforce our agreements, or protect the rights and safety of Orphex, our users, or the public.

  • AI Model Providers (automated analysis): Parts of our Services — including the generation of insights, recommendations, and creative analysis — rely on third-party AI models. Where these features are active on your workspace, the relevant campaign, creative, and performance data is transmitted to the model provider as part of producing that output. Where our primary provider is unavailable, a secondary provider may be used. This processing is part of how the Services function. We do not sell this data, and we do not use it to train AI models.

  • AI Model Providers (Orpheus): Orpheus is an optional feature. If you choose to use it, the workspace data relevant to your question — such as campaign, creative, and performance information — together with the messages you send, is transmitted to the AI model provider that powers the feature so that a response can be generated. You are not required to use Orpheus, and no data is sent to a model provider on this basis unless you do. See “4. AI Assistant Connectors (MCP)” above for details on how this works and how to withdraw authorization. We do not sell this data, and we do not use it to train AI models.

7. Data Retention and Security

Data Retention: We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, or to the extent required by law. If you close your account or request deletion of your data, we will delete or anonymize your information within a reasonable timeframe, unless retention is required by law.

Security Measures: We implement industry-standard security safeguards to protect your information, including encryption, firewalls, and access controls. While we strive to protect your data, no security system is impenetrable. If we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as required by law.

8. International Data Transfers

Because Orphex is based in the United Kingdom and works with providers worldwide, your personal information may be transferred to and stored in countries outside your home jurisdiction. We will ensure such transfers comply with applicable data protection laws (e.g., using Standard Contractual Clauses for EU/UK data). This includes transfers to connected AI assistant providers such as Anthropic,OpenAI, and Gemini which are based in the United States; such transfers are likewise made subject to appropriate safeguards, including Standard Contractual Clauses.

9. Your Rights and Choices

Depending on your location, you may have rights under data protection laws to:

  • Access the personal information we hold about you.

  • Rectify any inaccurate or incomplete information.

  • Delete or request erasure of your information.

  • Restrict our use of your information.

  • Object to certain processing of your information.

  • Port your information to another provider.

To exercise any of your rights, contact us at info@orphex.co. We will respond to your request in accordance with applicable laws. You may also manage data sharing for third-party integrations (e.g., revoking access for Google, Meta, or a connected AI assistant) directly in those external account settings or, for a connected AI assistant, from your Orphex account settings as well.

10. Children’s Privacy

Our Services are not intended for use by anyone under 13, and we do not knowingly collect personal data from children. If we learn that we have inadvertently collected information from a child, we will delete it promptly. If you believe we have collected data from a minor, please contact us.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal obligations. The “Last Updated” date at the top indicates the latest revision. If we make material changes, we will notify you by email or by posting a prominent notice on our website. Your continued use of our Services after any changes indicates acceptance of the updated policy.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how Orphex handles your personal data, please contact us at:

Email: info@orphex.co

We are committed to addressing any privacy-related concerns promptly and transparently.

13. Data Protection Authority

If you are located in the United Kingdom or the European Union, you have the right to lodge a complaint with a supervisory authority:

By using our Services, you acknowledge and agree to the terms of this Privacy Policy, including the handling of your personal information as described here. Thank you for choosing Orphex. We appreciate your trust and remain committed to protecting your privacy.