Privacy notice

Who we are

Orchard28 provides autonomous AI agents that shop, book and transact on your behalf. For visitors to this website, the data controller is Orchard28 Limited, Block 3, City East Plaza, Ballysimon, Limerick, V94 56R2, Ireland, with offices in Palo Alto (United States) and Melbourne (Australia). You can reach us about anything in this notice at hello@orchard28.com.

What we collect on this website

• Early-access signups. If you join the access list we collect your name, email address, company, job title, phone number and the time you signed up.
• Contact enquiries and complaints. If you use the contact or complaints forms we collect your name, email address, phone number, country (contact form) and the text of your query or complaint.
• Careers introductions. If you introduce yourself on our careers page we collect your name, email address, phone number, your GitHub and LinkedIn addresses, and what you tell us you could bring to Orchard28.
• Technical details of your submission. Whichever form you use, we also record the time you submitted it, your IP address and your browser’s user-agent string (the browser and operating system it reports). We keep these with the rest of your submission so we can investigate abuse of our forms and evidence when and how an enquiry reached us.
• Server logs. Like almost every website, our web server records standard technical logs (IP address, browser type, pages requested, timestamps) for security and troubleshooting.

This website sets no advertising or analytics cookies, and we use no third-party analytics or advertising trackers. The one third-party service we rely on is Google reCAPTCHA, used solely to protect our forms from bots — see Bot protection below. Beyond that and what is listed above, we collect nothing about you.

Bot protection (Google reCAPTCHA)

To stop automated abuse of our forms — early-access, contact, complaints and careers — we use Google reCAPTCHA v3. When you submit a form, reCAPTCHA assesses whether the request is likely to be automated. To do this it loads from Google and may collect device and usage information (such as your IP address, browser characteristics and interaction signals) and set cookies on Google domains. That information is sent to and processed by Google, including in the United States.

We use reCAPTCHA only for security — never for advertising or profiling — and we receive only a pass/fail risk score, not the underlying signals. Your use of reCAPTCHA is subject to Google’s Privacy Policy and Terms of Service. Our lawful basis is our legitimate interest in keeping the site secure and free from spam and abuse.

Why we use it

• To email you when early access reaches you — because you asked us to.
• To answer the query or complaint you sent us and follow up on it.
• To consider you for roles at Orchard28 — including reviewing the public GitHub and LinkedIn profiles you point us to — and to contact you about them.
• To keep the website secure and running reliably.

We do not sell your personal information, we do not share it with third parties for their own marketing, and we do not use it for automated decision-making about you. Personal information is shared only with the infrastructure providers that host our systems and the service providers listed below, under contracts that restrict what they can do with it.

Service providers

We use Google Workspace as a data processor to facilitate our contact with you. When you submit one of our forms, a copy of the details — your access-list signup, contact enquiry, complaint or careers introduction — is delivered to our team by email through Google Workspace so we can act on it and reply. Google processes this information on our behalf, under its data-processing terms, and may process it in the United States. It is used to receive and respond to your message, never for advertising or profiling.

We also use ClickUp as a data processor to manage our contact with you. When you submit one of our forms, a record of it — your name, email address, phone number, company where you gave one, the technical details described above and the content of your message — is created in our ClickUp workspace so the right person picks it up and nothing is lost. ClickUp processes this information on our behalf, under its data-processing terms, and may process it in the United States. It is used to manage and respond to your enquiry, never for advertising or profiling.

How long we keep it

Access-list emails are kept until the early-access programme ends or you ask to be removed, whichever comes first. Contact enquiries and complaints are kept for up to 24 months after we resolve them, then deleted. Careers introductions are kept for up to 12 months so we can consider you for future roles, then deleted — or sooner if you ask us to remove them. The technical details recorded with a submission are kept for as long as that submission is, and these periods apply wherever we hold the record — including in email and in ClickUp. Server logs are rotated and deleted within 90 days.

International transfers

Because we operate from Ireland, the United States and Australia, your information may be processed in any of those countries. Where information about people in the European Economic Area or the United Kingdom is transferred outside those regions, we rely on the European Commission’s Standard Contractual Clauses or an applicable adequacy decision to protect it.

Your rights in the EEA and UK (GDPR)

If you are in the European Economic Area or the United Kingdom, the General Data Protection Regulation applies to our use of your information. Our lawful bases are consent (joining the access list), legitimate interests (answering your enquiry and keeping the site secure) and, where relevant, performance of a contract.

You have the right to:

• access the personal data we hold about you;
• have inaccurate data rectified;
• have your data erased (“right to be forgotten”);
• restrict or object to our processing;
• receive your data in a portable format;
• withdraw consent at any time, without affecting prior processing.

To exercise any of these rights, email hello@orchard28.com. We respond within one month. You also have the right to lodge a complaint with your supervisory authority — for our Irish establishment, that is the Data Protection Commission (dataprotection.ie).

Your rights in California (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you specific rights over your personal information. The only categories we collect are identifiers (name, email, phone number) and the contents of your enquiry; we collect no sensitive personal information.

• Right to know — request the categories and specific pieces of personal information we have collected about you.
• Right to delete — request deletion of your personal information.
• Right to correct — request correction of inaccurate information.
• Right to opt out of sale or sharing — we do not sell or share personal information as defined by the CCPA, and have not done so in the preceding 12 months, so there is nothing to opt out of.
• Right to non-discrimination — we will never treat you differently for exercising your rights.

Submit a request by emailing hello@orchard28.com with “California privacy request” in the subject line. We verify requests by confirming control of the email address on file, respond within 45 days, and accept requests from authorised agents.

Your rights in Australia (Privacy Act)

Our Melbourne office handles personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We collect personal information directly from you, use it only for the purposes described above, and take reasonable steps to protect it from misuse, interference, loss and unauthorised access.

• You may request access to the personal information we hold about you, and request correction if it is inaccurate, out of date or incomplete (APPs 12 and 13).
• You may deal with us anonymously or under a pseudonym where practicable — for example, a general enquiry does not require your real name.
• We will notify you and the regulator of any eligible data breach as required by the Notifiable Data Breaches scheme.

Complaints can be sent to hello@orchard28.com — we respond within 30 days. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (oaic.gov.au).

Changes to this notice

If we change how we handle personal information, we will update this page and revise the effective date above. Significant changes will be flagged on the website before they take effect.