Privacy Policy
This Privacy Policy explains how Orca collects, uses, stores, shares, and protects personal information when users access the website, create an account, submit forms, use Community, or participate in beta services. It should be read together with the User Manual, Terms of Service, and AI-Generated Design Notice.
Data controller
The data controller responsible for personal information processed through Orca is Curvature Flow Co., Limited, a company registered in the Hong Kong Special Administrative Region (company number 80431269), with its registered office at Unit 1618B, 16/F, Pioneer Centre, 750 Nathan Road, Mong Kok, Hong Kong. Privacy questions and data-rights requests can be sent to [email protected].
Information collected
Orca may collect account information, such as username, email address, password credentials in hashed form, avatar, profile details, language preference, login records, and account settings. Orca may also collect waitlist information, including role, region, CAD experience, use cases, trial intention, interview consent, design upload consent, and messages submitted by users.
Usage, analytics, and cookies
Orca may use essential cookies for login sessions and security. The website may collect lightweight first-party analytics such as page visits, active dwell time, locale, device type, referrer host, country or region from request metadata, and conversion events. Raw IP addresses are not intentionally stored for analytics in the current implementation.
Community and design data
When users access Community, order model packages, post comments, adjust parameters, or download files, Orca may store related records such as model identifiers, claim records, download counts, parameter snapshots, comments, and usage events. If users upload design works or other content, that content may be processed to review applications, provide features, improve product quality, and maintain platform safety.
How information is used
Orca uses information to operate the website, authenticate users, manage accounts, review beta access, provide Community permissions, deliver model packages, respond to support requests, improve product quality, maintain security, prevent abuse, comply with legal obligations, and communicate important service updates.
Data minimization and accuracy
Orca aims to collect only information reasonably necessary for the stated purposes. Users should keep submitted information accurate and avoid submitting unnecessary sensitive information, confidential third-party data, trade secrets, or content that the user is not authorized to share.
Sharing and service providers
Orca does not sell or rent personal information. Orca may share limited information with service providers that support hosting, email delivery, authentication, analytics, storage, security, customer support, or future manufacturing coordination. Orca may also disclose information where required by law, to protect rights and safety, to investigate abuse, or in connection with corporate restructuring.
International access and transfers
Users may access Orca from different countries or regions. Data may be processed or stored in jurisdictions different from the user's location, subject to applicable laws, hosting arrangements, and service-provider infrastructure. Where required, Orca will seek to follow applicable cross-border data-transfer requirements.
Retention
Orca retains information for as long as needed to provide services, maintain records, resolve disputes, enforce terms, comply with legal obligations, and improve product safety. Some logs, analytics, model claim records, and compliance records may be retained for a reasonable period even after account activity ends.
Security
Orca uses reasonable administrative, technical, and organizational safeguards, such as password hashing, access controls, HTTPS deployment where configured, and limited internal access. No online system can be guaranteed to be completely secure, and users should protect their own accounts and devices.
User rights and choices
Subject to applicable law, users may request access, correction, deletion, export, restriction, objection, or withdrawal of consent for certain personal information. Requests can be sent to [email protected]. Orca may need to verify identity and may retain information where required for legal, security, or legitimate business reasons.
Legal bases and regional rights
Where required by applicable law, Orca processes personal information on legal bases such as performance of a contract (operating accounts and delivering services), legitimate interests (security, abuse prevention, and product improvement), consent (where requested, such as for certain communications), and compliance with legal obligations. Users in the European Economic Area or the United Kingdom may have rights under the GDPR or UK GDPR, including the right to lodge a complaint with their local data-protection supervisory authority. Users in California may have rights under the CCPA/CPRA, including the right to know, delete, and correct personal information and to opt out of the sale or sharing of personal information; Orca does not sell personal information. To exercise any of these rights, contact [email protected].
Children and sensitive use
Orca is not intended for children or for users below the age required by applicable law to provide valid consent. Users should not submit sensitive personal information unless specifically requested and legally permitted.
Changes and contact
Orca may update this Privacy Policy as the product evolves. Material changes may be communicated through the website or account system. Questions about privacy can be sent to [email protected].