Orqestra Privacy Policy

This Privacy Policy explains how Orqestra Solutions Inc., doing business as Orqestra (“Orqestra,” “we,” “us,” or “our”) handles personal information in connection with our websites, applications, communications, and services.

It applies to information Orqestra controls. Organizations, sellers, event organizers, and other users may independently control information they collect through Orqestra and are responsible for their own privacy practices.

Personal information is information about an identifiable individual, subject to applicable law. It does not generally include information that has been effectively de-identified or aggregated so it can no longer reasonably identify a person.

We may collect names, email addresses, authentication identifiers, profile images, contact details, biographies, interests, skills, preferences, account settings, and information supplied through social login. Public-profile fields are visible according to the feature and privacy settings presented to you.

We may process volunteer participation, hours, activities, organization relationships, causes, achievements, and other impact information supplied by you, generated through your activity, or confirmed by participating organizations. Some impact information may be displayed publicly when you choose a public profile or sharing option.

We collect organization names, descriptions, missions, contact details, locations, public pages, registration information, administrator memberships, team permissions, tool settings, posts, supporter relationships, and operational records. Business contact information may still be personal information when it identifies an individual.

Volunteer applications and management tools may collect availability, interests, experience, schedules, work areas, attendance, messages, emergency or accommodation information, and organization notes. The exact information depends on the opportunity and organization.

Organizations should request only information reasonably necessary for the opportunity and are responsible for safeguarding sensitive volunteer information, screening records, information about minors, and any data they export or use outside Orqestra.

Orqestra is not designed to encourage unnecessary collection of sensitive information about minors. Where a minor participates, a parent, guardian, school, or organization should be involved as appropriate to age, context, and law. Organizations remain responsible for safeguarding, supervision, permissions, and limiting public disclosure.

We may process supporter relationships, donation amounts, campaign designations, donor display preferences, receipts or reference numbers, transaction status, and communications. Anonymous public display does not necessarily mean the transaction is anonymous to Orqestra, the receiving organization, or the payment processor.

Payment-card information is handled by payment processors such as Stripe. Orqestra does not store full payment-card numbers.

We may process auction items, donor and bidder details, bids or results where supported, winner information, payment status, pickup or delivery details, and related communications. Auction organizations control much of this information and are responsible for their auction rules and notices.

We may collect listings, photos, prices, seller and buyer profiles, beneficiary organizations, reservations, orders, payment status, fulfilment details, reports, disputes, and marketplace messages. Transaction participants and relevant organizations may receive information necessary to complete and account for the transaction.

We may process event listings, registration details, attendance, staffing assignments, accessibility requests, communications, and transaction information. Event organizers control registration information they receive and must use it appropriately.

We process messages, posts, comments, uploaded images, forms, and other content to deliver the feature, maintain records, investigate reports, and protect users. Recipients and organization administrators may be able to view or retain messages relevant to their role.

Do not include sensitive personal information about yourself or others unless it is necessary and you have authority to share it.

When you use Orqestra, our systems and service providers may process IP address, browser and device information, timestamps, requested pages, referral information, session identifiers, error information, and security events needed to operate, troubleshoot, and protect the Services.

Orqestra uses essential cookies and similar browser storage for authentication, session continuity, security, checkout, and saved account state. Disabling essential storage may prevent features from working.

We have not identified a configured advertising-cookie or third-party behavioural-analytics provider in the current application. If non-essential analytics or advertising technologies are introduced, this Policy and any legally required consent controls will be updated before they are relied upon.

Users and organizations may enter addresses, service areas, event locations, or volunteer locations. Address autocomplete may send search text to a maps provider when you use that feature. Orqestra does not claim to continuously track precise device location.

We use personal information to create and secure accounts; provide profiles, organizations, volunteering, events, fundraising, donations, auctions, marketplace, payments, messaging, and support; personalize relevant content and navigation; maintain records; detect abuse and fraud; comply with law; and improve the usability and reliability of the Services.

We use information only for purposes that are reasonable in the circumstances, compatible with the context in which it was collected, or otherwise permitted by law.

We may use operational metrics, support feedback, errors, and de-identified or aggregated information to understand feature performance and improve the product. If we later deploy a named analytics provider or non-essential tracking, we will update our disclosures and consent approach as required.

Orqestra may offer optional AI-assisted drafting or organization tools. When a user invokes such a feature, the submitted prompt and relevant content may be processed to generate the requested result, potentially through a service provider. Users should review generated content and avoid submitting unnecessary sensitive information.

Orqestra does not state that AI makes legally significant decisions about users. If automated decision-making with significant effects is introduced, we will provide appropriate disclosure and controls.

We send transactional communications needed for account verification, security, registrations, volunteering, payments, messages, service operation, and legal notices. These are separate from marketing.

Marketing email is optional. We record the preference separately from legal acceptance. You may withdraw marketing consent using an unsubscribe mechanism or available account controls without losing your account.

We share information with organizations when needed for a relationship you request or participate in—for example, a volunteer application, event registration, donation, supporter relationship, auction, or marketplace transaction. Authorized organization administrators may access information according to their permissions.

Organizations are independent users of information they receive and must meet their own privacy obligations. Orqestra does not authorize administrators to use information for unrelated purposes.

We may use service providers for hosting, databases, authentication, email delivery, maps, customer support, security, file storage, AI-assisted features, and payment processing. They may process information only to provide contracted services or as otherwise permitted by their agreements and law.

Payment processors such as Stripe may independently collect identity, banking, tax, fraud-prevention, and transaction information. Their privacy notices apply to their processing.

Orqestra and its service providers may process or store information outside your province or country, including in jurisdictions where service providers operate. Information may then be subject to the laws and lawful access processes of those jurisdictions.

Information may be disclosed in connection with financing, reorganization, due diligence, merger, sale, or transfer of all or part of the business, subject to appropriate protections.

We may disclose information when reasonably necessary to comply with law or legal process, enforce agreements, investigate fraud or abuse, protect rights and safety, respond to an emergency, or establish or defend legal claims.

Organization pages, public profiles, posts, listings, events, opportunities, auction catalogues, supporter acknowledgements, and selected impact information may be public. Public content can be copied, indexed, or shared by others beyond Orqestra’s control. Review visibility choices before publishing.

We use administrative, technical, and physical safeguards appropriate to the sensitivity of the information and the nature of the Services. No system is completely secure, and we cannot guarantee absolute security.

You are responsible for protecting credentials, using secure devices, and promptly reporting suspected compromise. Organization owners should assign the minimum administrative access reasonably needed and remove access promptly when roles change.

We assess suspected privacy and security incidents and take steps appropriate to the circumstances. Where law requires, we will notify affected individuals or regulators. We do not promise a specific monitoring, logging, backup, encryption, or incident-response control beyond practices actually maintained.

We retain personal information only as long as reasonably needed for the purposes described, including account operation, organization records, transactions, tax and accounting needs, safety, disputes, legal obligations, and enforcement.

Transaction and organization records may be retained after account closure or organization deactivation. Backups and archival copies, where used by our providers, may take time to cycle out. De-identified or aggregated information may be retained when it no longer reasonably identifies you.

Subject to law, you may request access to or correction of personal information Orqestra controls and may withdraw consent where processing depends on consent. Withdrawal does not affect prior lawful processing and may limit features that require the information.

Where legally required and technically reasonable, we may provide an export or portable copy of information you supplied. We may need to verify identity and may withhold information where law permits or another person’s rights would be affected.

You may request account closure through available account or support channels. Organization deactivation removes public visibility but does not automatically erase operational, transaction, financial, safety, or audit history.

Deletion requests are subject to legal retention, fraud prevention, dispute, transaction, organization, and backup requirements, as well as information controlled independently by organizations or other users.

Available controls may include profile visibility, public display choices, notification preferences, organization permissions, and marketing unsubscribe options. Messaging participants retain copies of messages they receive, and changing a setting does not remove information already shared or made public.

If you use Google or another supported identity provider, we receive information the provider makes available, such as an authentication identifier, name, email address, and profile image. We use it to authenticate you and maintain your Orqestra account. The provider’s own privacy practices also apply.

We may use account, technical, transaction, and activity information to prevent fraud, spam, unauthorized access, and abuse. Users and organizations must keep information accurate.

Access by Orqestra personnel and contractors is limited by role and legitimate operational need under applicable obligations. This statement does not promise a particular technical access-control or monitoring implementation.

Depending on the feature and law, Orqestra may act as an organization responsible for its own processing or as a service provider processing information for a participating organization. Organizations determine many purposes for volunteer, event, supporter, fundraising, auction, marketplace, and administration information and must provide required notices and respond to applicable requests.

Privacy rights and obligations vary by location. This Policy is intended to describe Orqestra’s general practices and does not limit rights that cannot be waived. Additional notices or controls may be introduced as Orqestra expands or as laws require.

You may raise a privacy question, request, or complaint using the verified privacy contact shown below. We may ask for information needed to verify identity and understand the request. You may also have the right to contact a privacy regulator.

We may update this Policy as the Services or legal requirements change. We will update the version and date and provide notice appropriate to the significance of the change. Material changes may require renewed acknowledgement before normal account use.