# Orylo Privacy Notice **Effective date:** August 25, 2026 This notice explains how the Orylo public beta, operated by Pranay Warke in California, United States, collects, uses, discloses, and deletes information. Contact pranaywarke@gmail.com with privacy questions or requests. ## 1. Information Orylo collects - **Account and workspace data:** GitHub user ID, username, avatar and profile metadata; workspace name; membership and authorization records; and essential session identifiers. - **GitHub connection data:** GitHub App account, installation, selected-repository and permission metadata; webhook delivery identifiers and payloads; pull-request metadata, code, diffs, comments, reviews, checks, deployments, and related history for selected repositories. - **Review intelligence:** repository architecture and ownership summaries, specialist definitions, customer guidance, bounded Core and Recall Memory, review stages, findings, decisions, feedback, and outcome history. - **Provider data:** encrypted model-provider credentials, connection status, bounded usage and cost metadata, model requests containing relevant Customer Content, and resumable encrypted session artifacts. Orylo does not display a stored provider key after submission. - **Operational data:** bounded identifiers, timestamps, state transitions, counts, durations, security and audit events, failure categories, and request metadata needed to operate and protect the service. Orylo's telemetry policy prohibits customer source code, unrestricted diffs, raw prompts, unrestricted model responses, and credentials in logs, traces, and metrics. - **Support communications:** information you choose to send when requesting help or reporting a problem. Orylo receives information from you, GitHub, your selected model provider, the service itself, and infrastructure providers. It does not purchase personal information from data brokers. ## 2. Why Orylo uses information Orylo uses information to authenticate users; create tenant-isolated workspaces; connect selected repositories; prepare repository intelligence; perform and publish reviews; resume follow-up conversations; enforce limits; secure, troubleshoot, and audit the service; respond to support and privacy requests; delete workspaces; and comply with law. Orylo does not sell personal information, share it for cross-context behavioral advertising, or use repository code to train a shared Orylo model. ## 3. When information is disclosed Information is disclosed only as needed to provide the beta: - **GitHub** receives authentication and GitHub App interactions and the reviews Orylo publishes. - **Amazon Web Services** hosts the Orylo control plane, encrypted records, operational telemetry, backups, and temporary review workloads in the United States. - **OpenAI** receives the repository and pull-request context needed for a review under the customer project key you provide. Your organization controls that provider account and remains responsible for its settings and terms. - **Professional advisers or authorities** may receive limited information when reasonably necessary for security, legal compliance, or the establishment or defense of legal claims. Orylo does not permit third parties to collect personal information on Orylo for targeted advertising. ## 4. Retention and deletion Account, repository, review, and repository-intelligence records are retained while the workspace is active. Encrypted provider credentials remain only while the connection exists. Encrypted session artifacts and operational logs expire after 30 days in the current beta environment. Database backups are retained for 7 days. A workspace deletion request blocks new work immediately, revokes connected access, and starts a durable purge. A content-free deletion tombstone remains for up to 30 days to reject stale events and prove completion. The separate Retention and Deletion Policy provides detail. ## 5. Your choices and requests Workspace owners can pause repositories, change GitHub repository selection, uninstall the GitHub App, rotate or disable a provider key, and delete a workspace. You may email pranaywarke@gmail.com to request access to, correction of, or deletion of personal information associated with your account. Orylo may verify your identity and authority before fulfilling a request and may retain information when required for security, legal obligations, or the establishment or defense of claims. Orylo is not currently expected to meet the California Consumer Privacy Act's business thresholds, but it will not discriminate against a user for making a good-faith privacy request. Orylo does not sell or share personal information as those terms are used for behavioral advertising. ## 6. Cookies and tracking choices Orylo uses essential, secure session cookies for authentication and request protection. It does not use third-party advertising cookies or cross-site behavioral tracking. Because Orylo does not sell or share information for targeted advertising, Global Privacy Control and browser Do Not Track signals do not change this behavior. ## 7. Security and international processing Orylo uses HTTPS, encryption at rest, tenant-scoped authorization, encrypted credential envelopes, ephemeral review workspaces, least-privilege service identities, and bounded audit records. No system is perfectly secure. Information is processed in the United States and may also be processed by GitHub or OpenAI in locations described in their terms. ## 8. Children Orylo is intended for adults acting in a professional software-development context and is not directed to children under 18. Do not use the beta if you are under 18. ## 9. Changes and contact The effective date above identifies this version. Material changes will be announced in the product or by another reasonable channel and will require renewed acknowledgement before additional customer processing. Contact Pranay Warke at pranaywarke@gmail.com. Business location: California, United States.