Last Updated: December 21, 2025
Orchestra Engine Inc (Orchestra, We, Us) provides law firms and legal professionals with Shadow AI detection and prevention technology. We deliver software for monitoring and controlling GenAI interactions in professional settings. We operate the Ovna platform available for sign up at https://orchestraengine.com and its associated services (collectively referred to as our "Platform").
We respect your privacy and want to be clear about what information we collect, why we collect it, and what we do with it. We follow the Personal Information Protection and Electronic Documents Act ("PIPEDA"), which is Canada's privacy law for businesses collecting and handling Personal Information.
This Privacy Policy ("Policy") applies to the Personal Information we collect from those who use our Platform ("Users"). Please read this Policy carefully. If you have any questions about the Policy or our privacy practices, you can reach out to team@orchestraengine.com.
If you are located in a jurisdiction outside Canada with specific privacy laws, you may have additional rights not described in this Policy. We recommend you seek independent legal advice to determine whether our privacy practices are compatible with your local legal privacy legislation before using our Platform. If our practices do not meet your local legal requirements, do not use our Platform or provide any Personal Information. Continued use of our Platform constitutes your acknowledgment of these limitations and your voluntary assumption of any associated risks.
Platform use and any dispute over privacy are subject to the terms of this Policy, our Terms of Service, and the terms of any other agreement you have entered into with us.
By using our Platform, you acknowledge you have read and understood this Policy and consent to the collection and use of Personal Information as described in this Policy. If you do not consent, you must not use the Platform.
"Personal Information" is any information that could be used to identify you as an individual. Personal Information includes information that could identify you when combined with other details.
We collect Personal Information from all Users of our Platform, including those who visit our website, those who install our browser extension, and those who register an account.
You are a "Visitor" when you visit our website and its subdomains and interact with the content of our website. From Platform Visitors, we may collect:
You are a "Browser Extension User" when you install and use our Chrome extension for real-time GenAI detection. From Browser Extension Users, we collect:
IMPORTANT: We monitor content entered into AI platforms to enforce organizational policies. We do NOT collect, store, or transmit the actual content of your prompts or AI responses unless explicitly configured by your organization's administrator for audit purposes. Our extension analyzes content locally and only transmits detection metadata and policy decision information to the backend services.
You are a "Registered User" when you register for an account and interact with or configure services through our Platform. From Registered Users, we collect:
Organization administrators who configure the Ovna platform may provide:
ORGANIZATION ADMINISTRATORS REPRESENT AND WARRANT THAT THEY HAVE OBTAINED ALL NECESSARY CONSENTS FROM THEIR USERS AND CLIENTS TO COLLECT, USE AND DISCLOSE PERSONAL INFORMATION THROUGH OUR PLATFORM, AND THAT SUCH CONSENTS COMPLY WITH ALL APPLICABLE PRIVACY LAWS, INCLUDING BUT NOT LIMITED TO ATTORNEY-CLIENT PRIVILEGE REQUIREMENTS AND PROFESSIONAL RESPONSIBILITY RULES.
When configured by your organization for audit purposes, we may collect:
YOUR ORGANIZATION CONTROLS WHAT INTERACTION DATA IS COLLECTED AND RETAINED. Contact your organization's administrator to understand what data is being monitored and stored.
We may collect other information which may be used in combination with identifying or potentially identifying information. We will treat combined information as Personal Information.
We collect Personal Information for the following purposes:
We will ask for your permission before using your Personal Information for any purpose not described in this Policy. You can withdraw your consent at any time by contacting us using the information provided below.
We do not sell Personal Information to third parties. We do not use your prompt content or AI interaction data to train AI models or for any purpose other than providing the Ovna service to your organization.
We collect Personal Information:
We take safeguarding your information very seriously. We have implemented commercially reasonable administrative, technical and physical safeguards to protect against unauthorized access, use, modification and disclosure of Personal Information in our custody and control.
All Personal Information we collect is stored as data on third-party servers. We take reasonable steps to ensure our server providers adhere to industry security standards for the protection of Personal Information. These servers are located in Canada and the United States of America. When Personal Information is transferred to the United States, it becomes subject to the U.S. CLOUD Act and other U.S. laws that may permit U.S. government authorities to access such data.
We protect the Personal Information of our Users using:
Some of our third-party service providers are located outside of Canada. For Users located in Quebec, data may be stored outside of Quebec. Data may be transferred to or processed in the United States of America. We take steps to safeguard data and keep Personal Information secure when it is shared with third-party service providers outside Canada. The laws in other places may differ from those in Canada. Government authorities in jurisdictions outside Canada may access Personal Information in accordance with local laws.
By using our Platform, you agree to the transfer of your Personal Information for the purpose of storage and processing.
Where you must complete sign-in processes to access certain features of our Platform, you are responsible for keeping your sign-in information confidential and secure. Do not share your sign-in information with anyone.
For browser extension users, protect your device and browser from unauthorized access.
If we discover a security incident that compromises our storage and protection of Personal Information, we will notify Users and the appropriate regulatory authorities as required by applicable law. For legal professionals, we will also provide notice consistent with professional responsibility requirements.
We retain your Personal Information while it is needed to fulfill the intended purpose for which it was collected and for seven years following the cessation of its intended purpose. We may also retain Personal Information as necessary:
For legal professionals: Our retention periods are designed to meet or exceed state bar association requirements and federal rules of civil procedure. Contact your organization's administrator for specific retention configurations.
Third-party service providers are external, independent entities that offer technologies and services useful to our Platform. We may share Personal Information with third-party service providers.
We may transfer Personal Information to the following third-party service providers:
In addition to the third parties listed above, we may share your Personal Information with third parties for the following purposes:
By using our Platform, you consent to our sharing your Personal Information with third parties for the purposes described in this Policy. We will seek your consent before sharing Personal Information with a third party for a purpose not described in this Policy.
Our Platform includes links to third-party websites and AI platforms. We provide links to third-party websites as a convenience to the user. These links are not an endorsement of or referral to the third party. We are not responsible for the websites or privacy policies of these third parties. If you follow any of these links, please read the third party's privacy policy carefully.
IMPORTANT: When you use AI platforms (ChatGPT, Claude, Gemini, etc.), those platforms have their own privacy policies and terms of service. Ovna monitors and enforces policies regarding your use of these platforms but does not control how those platforms handle your data. Review each AI platform's privacy policy before use.
The transmission of information via the internet is not completely secure. While we use commercially reasonable security measures to protect our Users' Personal Information, no method of electronic storage or transmission over the Internet is 100% safe. The use of our Platform carries inherent risks that, despite our use of commercially reasonable security safeguards, we cannot completely eliminate. By using our Platform, you acknowledge that you understand and accept this risk.
For legal professionals: While Ovna is designed to prevent inadvertent disclosure of privileged or confidential information, no technological solution is foolproof. Attorneys and legal staff maintain independent professional responsibility for compliance with attorney-client privilege, work product doctrine, and applicable rules of professional conduct.
Under PIPEDA, Users have the following rights when it comes to the collection and use of their Personal Information:
Note: Certain features of our Platform require Personal Information to function effectively (e.g. account registration, browser extension context management, policy enforcement). Where accurate Personal Information is a necessary technical and/or operational requirement for service delivery, not providing accurate Personal Information, deleting your Personal Information or withdrawing your consent for the collection, use or disclosure of your Personal Information may limit or prevent your access and use of our Platform.
You may access, update, delete, and/or correct inaccuracies in the Personal Information shared when you registered for your account, subject to limited exceptions prescribed by law. To make these changes, log into your account, go to your account profile, and make the necessary changes.
To access or delete browser extension data, contact your organization's administrator or use the extension settings interface.
You may exercise your right to access or correct your Personal Information or withdraw your consent to its use by submitting a written request using the contact information team@orchestraengine.com. We will respond to your request within 30 days of receiving the request and may verify your identity before fulfilling any such request. If we need more time, we will let you know and explain why.
When you make a privacy-related request that involves data collected by our third-party service providers, we may communicate with them as needed and to the extent permitted by law. We will keep you informed on the status of your request in such cases.
If you have a concern or complaint, you can contact our privacy officer (contact details below). We will respond to you within 30 days of receiving your complaint. If we need more time to resolve your complaint, we will let you know and provide you with an expected timeline for resolution.
Our services are not meant for people under 16 years old. We do not knowingly collect Personal Information from children under 16. If you are under 16, please do not use our services or provide any Personal Information to us. We encourage parents and legal guardians to monitor their children's internet usage and to help enforce this prohibition. If you have reason to believe that a child under the age of 16 has provided information to us, please contact our privacy officer as set out below.
Ovna is designed specifically for use by law firms, legal departments, and legal service providers. Users in these contexts should be aware of additional privacy considerations:
Ovna monitors content to detect potential privilege violations. However, the transmission of privileged information through AI platforms may constitute waiver of privilege regardless of Ovna's monitoring. Consult with appropriate legal counsel regarding privilege implications.
Attorneys using Ovna remain independently responsible for compliance with applicable rules of professional conduct, including duties of confidentiality, competence, and supervision of non-lawyer assistants.
Different jurisdictions have varying requirements regarding use of AI tools and technology competence. Ovna provides audit trails and compliance reporting to assist with bar association requirements, but users should independently verify compliance with local rules.
Ovna helps enforce client confidentiality policies but does not replace independent professional judgment regarding confidentiality obligations. Attorneys must exercise independent judgment consistent with professional duties.
We update this Privacy Policy when necessary to reflect changes in our practices or legal requirements. When we make important changes that affect your privacy rights, we will:
The updated policy will take effect 30 days after we post it, unless we specify a different date.
We strongly encourage you to check back frequently to see any updates or changes to our Privacy Policy.
All issues and questions concerning the application, construction, validity, interpretation and enforcement of this Privacy Policy shall be governed by and construed in accordance with the laws of the Province of Ontario, and the federal laws of Canada applicable therein. Any disputes arising from this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of Ontario, provided nothing herein prevents us from seeking injunctive relief in any jurisdiction to protect our intellectual property or confidential information.
Please contact our privacy officer at team@orchestraengine.com directly if:
To protect your privacy, we will verify your identity before providing access to your Personal Information or responding to your privacy requests. We will only ask for information necessary to verify your identity.
© 2025 Orchestra Engine Inc. All rights reserved.