Privacy Policy

1. Who we are

Orlyo Ltd is a company registered in England and Wales. We operate the Orlyo mobile application and website at orlyo.app. For the purposes of UK GDPR and the Data Protection Act 2018, Orlyo Ltd is the data controller for personal data collected through our services.

2. What data we collect

We collect the following categories of personal data:

• Account information: Name, email address, password (encrypted), profile photo, job title, industry, skills, experience and career goals
• Location data: City and country (used to match you with mentors in compatible timezones). We do not collect precise GPS location.
• Career data: Goals, milestones, session notes, coaching conversations, gap analysis results and career signals
• Communication data: Messages exchanged with mentors or mentees through the Orlyo platform
• Payment data: Billing information processed securely by Stripe. We do not store card numbers.
• Usage data: How you interact with the app, features used and general analytics
• Device data: Device type, operating system version and app version

3. How we use your data

• Provide and improve the Orlyo service
• Match you with appropriate mentors or mentees using our AI system
• Power Orla, our AI career companion, to provide personalised guidance
• Process payments and manage subscriptions
• Send important service notifications
• Analyse career signals and generate market intelligence relevant to your goals
• Comply with legal obligations

4. AI features and data processing

Orlyo uses artificial intelligence powered by Anthropic's Claude API. When you use AI features, relevant profile and conversation data is sent to Anthropic's API to generate responses. Anthropic processes this data as a data processor on our behalf and does not use your data to train their models.

5. Data sharing

We share your data only with: your connected mentor or mentee (as necessary to provide the service); trusted service providers including Supabase, Anthropic, Stripe, Daily.co and Expo; and where required by law. We will never sell your personal data.

6. Data retention

We retain your data while your account is active. On deletion, personal data is removed within 30 days. Payment records are retained for 7 years as required by UK financial regulations.

7. Your rights

Under UK GDPR you have the right to access, rectify, erase, restrict, port and object to processing of your personal data. To exercise these rights contact privacy@orlyo.app. We will respond within 30 days.

8. Children's privacy

Orlyo is not intended for persons under 18. We do not knowingly collect data from minors. Contact us immediately if you believe we have done so.

9. Changes to this policy

We may update this policy from time to time and will notify you of significant changes by email or through the app.

10. Complaints

If you have concerns, please contact us first. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk.