Privacy Policy

Account and workspace details. When you create an account, we collect your name, email address, and — if you provide them — your title and profile image. When you set up a workspace, we collect your firm's name, the operator name and email signature you configure, and the email domains you tell us belong to your firm.

Mailbox data. When you connect Gmail or Outlook, you authorize Orivade through OAuth 2.0. Google grants the scopes openid, email, profile, gmail.readonly, and gmail.compose; Microsoft grants User.Read, Mail.Read, and Mail.Send. The read scope lets Orivade scan your mailbox to find investor-related correspondence. Orivade stores the messages and attachments it identifies as relevant to your fund — sender and recipient names and addresses, subject, date, the full message body with HTML stripped, and text extracted from attachments such as PDFs. Messages Orivade cannot associate with your fund's investors or operations are not retained.

Records Orivade derives. From those communications, Orivade builds structured records: investor and counterparty contacts (name, email, title, and where present, phone number), capital commitments and their amounts and dates, extracted terms and facts, and an index of fund documents such as subscription agreements, side letters, K-1s, capital calls, wire instructions, and distributions.

Billing. Paid plans are billed through Stripe, which collects your payment details directly. Orivade stores your Stripe customer and subscription identifiers and your subscription status. We never see or store full card numbers.

Product usage. We collect privacy-preserving analytics through Plausible — no cookies, no cross-site tracking — and error diagnostics through Sentry, to keep the product working and improve it.

Authentication tokens. To maintain your mailbox connection, Orivade stores the OAuth access and refresh tokens your provider issues. These are encrypted at rest.

Orivade's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

In practice, this means: we use Gmail data only to provide and improve the user-facing features described in this policy; we do not transfer Gmail data to others except as needed to provide those features, to comply with applicable law, or as part of a merger or acquisition; we do not use Gmail data for advertising; and we do not allow humans to read your Gmail data except with your explicit consent for specific messages, where necessary for security or to comply with the law, or where the data has been aggregated and anonymized.

Data obtained through Microsoft Graph is handled on the same terms.

Orivade processes your authorized communications to build and maintain your fund's institutional record — investor profiles, commitment tracking, document status, and conversation summaries — and to power features such as search, Fund Memory answers, and drafted replies. This processing serves your account only.

We use your email address to send account, billing, and security notices, and, if you opt in, occasional product updates. You can unsubscribe from product updates at any time.

Each workspace's data is isolated. We do not pool your fund's data with other funds', and we do not use your data to train generalized AI models.

Some features rely on third-party AI services. When Orivade drafts a reply, answers a Fund Memory question, or summarizes a thread, the relevant message content is sent to Anthropic (Claude) to generate the output. To power semantic search, message text is sent to Voyage AI to create embeddings. These providers process the content solely to return results to Orivade and, under their API terms, do not use it to train their models.

AI output is a starting point, not an action. Orivade does not send email on its own — every drafted message is reviewed by you before anything is sent.

We share data with a small set of providers that run infrastructure and features on our behalf. Each is bound to use your data only to provide services to Orivade:

Vercel — application hosting and scheduled jobs.

Neon — the Postgres database where your records are stored.

Anthropic — AI drafting, answers, and summaries; receives message content.

Voyage AI — embeddings for semantic search; receives message text.

Stripe — subscription billing.

Resend — transactional email, such as invitations and access notices.

Sentry — error monitoring.

Plausible — privacy-preserving web analytics.

We do not sell your personal information or your fund's data, and we do not share it for cross-context behavioral advertising.

Beyond the providers above, we may disclose information if required by law, subpoena, or valid legal process, or where we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Orivade, our customers, or the public.

If Orivade is involved in a merger, acquisition, or sale of assets, your information may transfer as part of that transaction. We will notify you of any change in ownership or in how your data is used.

We keep your fund's data while your account is active. Revoking Orivade's access from your Google or Microsoft account settings stops Orivade from reading new mail, but does not by itself remove what Orivade has already stored.

To remove stored data, delete your workspace from Settings or email [email protected]. Deletion runs as a tracked teardown that removes your workspace and its associated records — investor data, communications, documents, and tokens — from Orivade's live systems, and we confirm when it completes. Backup copies age out on our normal backup cycle.

You can request a copy of the data Orivade holds for your account, at no charge, by emailing [email protected]. You can also ask us to correct inaccurate personal information we hold about you.

If you are in the European Economic Area or the United Kingdom, you have rights under the GDPR / UK GDPR, including to access, correct, delete, restrict, or object to processing, and to lodge a complaint with your data protection authority. Orivade acts as a processor for the fund data you bring to it, and as a controller for your account information.

If you are a California resident, you have rights under the CCPA/CPRA, including to know, delete, and correct personal information and to opt out of its sale or sharing — though Orivade does not sell or share personal information as those terms are defined.

We encrypt data in transit with TLS and at rest. OAuth tokens are additionally encrypted at the application layer using AES-256-GCM. Access to production systems follows least-privilege principles and is tied to named accounts. See our Security page for more detail.

No system is perfectly secure. If you believe your account has been compromised, email [email protected] immediately.

Orivade is operated from the United States, and your information is processed there. Where required, we rely on appropriate safeguards, such as the EU Standard Contractual Clauses, for transfers of personal data out of the EEA or UK.

Orivade is a B2B product intended for fund professionals. We do not knowingly collect information from individuals under 18. If you believe a minor has provided us information, contact us and we will delete it.

We may update this Privacy Policy from time to time. We will notify you of material changes by email and/or a notice on our website at least 30 days before the change takes effect. Continued use of Orivade after the effective date constitutes acceptance of the updated policy.