If you do not agree with the processing described in this Policy, do not provide information when requested and stop using the Service. Where contract performance or legitimate interests cannot be relied upon under applicable law, we will obtain consent or rely on another permitted basis as required.
1. Children
Children must not use the Service. “Children” means individuals under 18, or under a different minimum age where local law sets a different age for processing personal information. We do not knowingly seek or collect personal information from children below the applicable minimum age. If you believe we hold such information, or are the child’s parent or guardian, please contact us using the details in Section 7.
2. How We Process Your Personal Information
The table below describes the information we process, why we process it and the relevant legal basis where applicable. If you do not provide information needed for a feature, we may not be able to provide that feature.
| Information | How we use it | Legal basis, where applicable |
|---|---|---|
| Login, account and security information, such as email address, login credentials, username or nickname, third-party login identifiers and authentication information (if linked), avatar, IP address, user ID, system and device information. | To create, authenticate and manage your account and operate and provide the Service. | Necessary to perform our contract with you. |
| Inputs and Outputs, including prompts, text, voice, uploaded files, shared content, instructions in chat, coding and agent sessions, conversation records, generated responses and actions, and information returned through third-party connectors you authorize. | To process Inputs and provide Outputs according to your instructions; provide conversation history; troubleshoot bugs; conduct research and development; and improve the Service, including training underlying AI models. If Memory is enabled, previous Inputs may be used to personalize Outputs. | Necessary to provide the Service and conversation history; troubleshooting and improvement may rely on legitimate interests or another basis permitted by local law. |
| Configuration information about your Service settings. | To save and apply settings needed to provide the Service. | Necessary to perform our contract with you. |
| Diagnostic and usage information, such as logs and service performance signals. | To maintain service operation, verify security, detect fraud and resolve technical issues. | Legitimate interests in service operation and security, or another basis permitted by local law. |
| Feedback and support information you provide. | To respond to requests, address issues and improve the Service. | To respond to your request or improve our Service. |
| Payment, billing and consumption information. | To process payments, subscriptions, service usage and billing. | Necessary to perform our contract and comply with legal obligations. |
| Compliance information and records. | To comply with law, handle disputes and protect our rights. | Legal obligations or another basis permitted by local law. |
| Marketing information. | To send marketing communications or personalized recommendations if you choose to receive them. | Your consent. You may opt out using the instructions in the communication. |
Personal information included in your Inputs may be processed by third-party model providers, Skills, MCP connectors or integrated apps and tools, and may be reproduced in Outputs. Please do not include personal information about yourself or others unless you are authorized to provide it and accept this processing.
3. How We Store and Share Personal Information
International transfers and access
Orlino operates a global Service. Personal information is stored on servers in Singapore. Our global support, engineering and other teams, including teams in the People’s Republic of China, may access personal information for the purposes described in this Policy.
Information may be transferred, remotely accessed, locally stored or otherwise processed outside your jurisdiction. Where required, we use safeguards such as standard contractual clauses, adequacy decisions, data processing agreements and other contractual protections.
Recipients
- Service providers, including third-party LLM providers; messaging platforms you choose to use; payment processors; and providers of Skills and MCP connectors you install or configure.
- Third-party apps and services that you choose to connect through API keys, messaging platforms, MCP connectors or other integrations. We share information according to your instructions; after transfer, the third party’s privacy policy applies.
- Companies in our corporate group that help provide the Service and are required to follow this Policy.
- Regulators, courts and law enforcement when disclosure is required by law or legal process.
- Safety, security and compliance recipients where disclosure is needed to enforce terms, address security, fraud or technical issues, or protect rights, property or safety.
- Professional advisers, such as auditors, lawyers and accountants.
- Business transaction parties if all or substantially all of our business is sold, transferred, merged, consolidated or reorganized.
Service-provider details
We use service providers to support the Service. The providers and purposes currently covered by this Policy are listed below.
| Recipient | Location | Purpose | Information |
|---|---|---|---|
| Google, GitHub, X and Apple | United States | Third-party account login, when selected by the user. | Login credentials and authentication information. |
| Tencent Cloud International Pte. Ltd. | Singapore | Hosting and storage of personal information. | Account, diagnostic, usage, feedback, configuration and other Service information. |
| Tencent Technology (Shenzhen) Co. Ltd. | People’s Republic of China | Service delivery, troubleshooting, refunds, security, research and development, service improvement and training. | Account and security information, diagnostic and usage data, billing and consumption information, feedback, marketing information, Inputs and Outputs, and compliance records. |
| MOONSHOT AI PTE. LTD. (Kimi) | Singapore | Large language model processing for the Service. | Inputs and Outputs. |
| Harvest Sharp Limited; Centauri Technology Pte. Ltd.; MP Centauri Technology Europe B.V. | Singapore and Germany | Payment processing. | Payment information. |
Our service-provider contracts and other measures require recipients to protect personal information and use it only for the purposes described in this Policy.
4. Security
We maintain information-security and access policies for our systems and technology. Appropriate technical protections include encryption, hashing, role-based access controls and audit logs of data access. Internet transmission is not completely secure. We take reasonable measures to protect personal information, but cannot guarantee the security of information transmitted over the internet; any transmission is at your own risk.
5. Data Retention
We do not keep personal information longer than necessary for the relevant purpose unless the law requires or permits a longer period.
| Information | Retention period |
|---|---|
| Login, account and security credential information; diagnostic and usage data; feedback information | While you maintain an account, then deleted within one month after account termination or within 30 days after a deletion request, whichever is earlier. |
| Configuration information — Desktop Version | Stored locally on your device and not processed on our servers. Deleted no later than 30 days after account termination or your deletion request. |
| Configuration information — Web and Mobile Versions | While you maintain an account, then deleted within one month after account termination or within 30 days after a deletion request, whichever is earlier. |
| Inputs and Outputs | Up to 14 days on our servers. A local copy may remain on your device until you delete it. |
| Payment, billing and consumption information | Up to 24 months after account termination. |
| Compliance records | As long as necessary to fulfill applicable legal obligations. |
| Marketing information | While you consent to receiving marketing communications. |
6. Your Rights
Depending on where you live and subject to applicable law, you may have the right to access personal information we hold about you and learn how it is used or shared; receive a copy of certain information; correct inaccurate information; delete your account or certain information; restrict processing; object to certain processing; withdraw consent; and complain to a data-protection authority.
You may be able to access and update some information in your account. Other requests, including erasure and relevant opt-outs, may be submitted using the contact details in Section 7. We may verify your identity before acting on a request.
If you are a resident of certain U.S. states, you may also have rights to know/access, correct, delete and obtain certain information in a portable format, subject to legal exceptions. Where required, you may use an authorized agent and may appeal a denied request. We do not sell or share California residents’ personal information within the meaning of applicable U.S. state privacy laws.
7. Contact
If you have questions about this Policy or wish to exercise your privacy rights, contact us:
MX INNOVATION PTE. LTD.
UEN: 202102944K
727 CLEMENTI WEST STREET 2, #01-280, SINGAPORE 120727
Privacy requests: support@orlino.ai
Automated account email: no-reply@orlino.ai
If you wish to opt out of using Inputs and Outputs for AI model training and cannot do so in your settings, email us at the privacy-request address above.
8. Third-Party Websites and Links
You may choose to connect Orlino with third-party websites, apps and services. Those third parties process information under their own privacy policies. Links to third-party sites do not mean that Orlino endorses or approves them. Review the relevant privacy and data-processing terms before connecting a third-party service.
9. Changes to this Policy
We may update this Policy from time to time. The updated version will be posted on the official Orlino website and in the Service. Where required by law, we will notify you of material changes through the Service or by email. The revised date appears at the top of this page.
10. Regional Terms
Additional terms may apply depending on your location. Where local law provides additional requirements concerning personal information, cross-border transfers, children or individual rights, those terms apply together with this Policy. Country-specific notices and regulator contact details will be made available for the markets in which the Service is offered.