Privacy Policy

Last updated: November 9, 2026

1. Who we are

This policy explains what information ORCA Systems ("ORCA", "we") collects through the ORCA CMMS web app, how we use it and who sees it. It applies to company administrators, managers, technicians and operators who use the app.

2. What we collect

• Account details: name, email address, role and company name, plus your login credentials (passwords are stored hashed by our authentication provider).
• Work records you enter: assets, repair tickets, notes, repair hours, parts and inventory, messages and uploaded photos.
• Billing data: your plan, billing interval and Stripe customer and subscription IDs. Card details go directly to Stripe; we never see or store them.
• Technical data: basic logs such as timestamps and errors, and browser storage used to keep you signed in.

3. How we use it

We use your information to run the service, authenticate users, show each company only its own records, process subscriptions, send account and billing emails, provide support, secure the service and fix problems. We do not sell your personal information or use your work records for advertising.

4. Who we share it with

We share data only with service providers that help us run ORCA:

• Supabase: database, authentication, file storage and server functions.
• FlutterFlow: builds and hosts the web app.
• Stripe: payments, subscriptions and the billing portal.
• Resend: account and notification emails.
• Google Fonts: fonts loaded when generating PDF ticket reports.

Within your company, other users see records according to their role. We may also disclose information if the law requires it or to protect our rights, or in a sale or merger of the business.

5. Where it is stored and how it is protected

Data is stored with Supabase on cloud infrastructure in East United States (North Virginia). Connections use HTTPS, database access is restricted by row-level security so each company sees only its own records, and uploaded photos sit in a private storage bucket. No system is perfectly secure, so we cannot guarantee absolute security.

6. Retention and deletion

We keep your data while your account is active. If you cancel, we keep it for at least 30 days, so you can request an export, then delete it, except where we must keep billing records for tax or legal reasons. To request earlier deletion of your company's data, email support@orcacmms.com.

7. Your choices and rights

You can ask us to access, correct, export or delete personal information we hold about you. Users should first contact their company administrator, who controls the company account; you can also email support@orcacmms.com. Depending on where you live (for example California or the EU/UK), you may have additional legal rights, and we will honor them as required.

8. Children, cookies and local storage

ORCA is for workplaces and is not directed to anyone under 18. We do not knowingly collect information from children.

We do not use advertising cookies or third-party trackers. The app uses browser storage only to keep you signed in and remember basic settings.

9. Changes and contact

If we change this policy in a meaningful way, we will notify you by email or in the app before it takes effect. Questions or requests: support@orcacmms.com.