How Orkestia handles your data.

Orkestia publishes this website. For the data described below, we are the controller — the party that decides why and how it is processed.

• Controller: LTINTEG SOFTWARE LTDA - EPP — CNPJ 45.337.609/0001-99
• Data-protection contact (encarregado): lgpd@orkestia.dev

This policy covers orkestia.dev and its Orkestia subdomains, including the public website, the Orkestia application, its API, and the MCP service at https://mcp.orkestia.dev.

For account, authentication, security, and operation of the platform, LTINTEG is the controller. When an organization uses Orkestia to process personal data from its own people, customers, or connected services, that organization decides the purpose and means of that processing and is generally the controller; LTINTEG processes that data to provide the service and under the organization's instructions.

This site is a set of static files. It has no login, no comment box and no shopping cart. There is one contact form, on the Portuguese pages /, /contabilidade, /seu-chat and /chatgpt (described in part 6), and three other ways data reaches us.

1. Technical connection data

Every request to a web server carries an IP address, a user agent, the URL requested, a timestamp and a referrer. Our CDN processes these to deliver the page and to keep the service available and protected against abuse. We do not use them to build a profile of you and we do not combine them with anything else.

2. Storage on your device

Strictly-necessary storage is limited to recording the choice you make in the cookie panel. Anything beyond that is stored only after you allow it, and is deleted from your browser as soon as you refuse or withdraw.

We load no analytics tool, no tag manager and no session recorder. Our advertising tags, the Meta Pixel and the Google Ads tag, load only after you allow Marketing: Meta and Google then receive the pages you visit here, your IP address and browser details (and whether you sent a contact form, never what you wrote in it), and set the cookies listed above, to measure our ads. Fonts are served from this domain rather than from a third-party font service, so simply reading a page does not announce your visit to anyone else. The capability catalog is baked into the page at publish time, so browsing it makes no call to the Orkestia platform. The only embeds are the demo videos on /chatgpt and /seu-chat: they play from YouTube only after you allow Marketing in the cookie panel. Otherwise /chatgpt plays the video from this domain and /seu-chat shows a link. The live chat demonstrations on the home run entirely in your browser, with fictional data: what you type there is not sent to anyone.

3. What you choose to send us

If you write to an address published here, we process what you send — your name, your email address, your company and whatever else you put in the message — for the sole purpose of answering you and, if it goes that way, discussing working together. We do not add you to a marketing list off the back of a message you sent us.

4. Orkestia platform, API, and MCP data

When you create or use an Orkestia account, we process account and access data such as your name, email address, user and organization identifiers, role or membership, authentication claims, and OAuth authorization artifacts. The MCP service uses these data to confirm the caller and scope every request to the right organization.

When an organization asks Orkestia to run a workflow, we process the workflow's inputs, outputs, state transitions, audit information, and the data needed to use the integrations that organization chose. Nothing is sent to a connected provider merely because the provider is available: a workflow sends data or takes action only when an authorized user or agent instructs it to do so.

Orkestia does not provide an AI model. A person or organization may connect its own AI client or provider, including through MCP. That client can receive the tool request and result needed to answer the user's prompt; its handling is governed by its own terms and privacy policy. We do not use platform or MCP data to train a general-purpose AI model.

5. Sensitive data and data minimization

The platform does not require sensitive personal data to create an account or connect MCP. A workflow may handle data an organization deliberately makes available through a chosen integration, but users should provide only data needed for that specific workflow. Do not submit payment-card numbers or CVV, passwords, private keys, authentication secrets, one-time codes, health information, biometrics, or government identifiers through chat or MCP unless the relevant product explicitly requires it, explains the purpose, and presents the applicable authorization or consent.

6. The contact form

The form on /, /contabilidade, /seu-chat and /chatgpt asks for your name, your WhatsApp number and your kind of business and, if you want, your site or Instagram and what takes most of your time. With it goes the page you sent it from and the campaign tags (utm_*) of the link that brought you here, so we know which ad or post you answered.

• Purpose: to answer that request, on WhatsApp, and to prepare a demonstration for your business. It is not a marketing list.
• Legal basis: pre-contractual measures at your request (LGPD Art. 7, V).
• Where it goes: your browser posts the answers straight to Google Forms (Google, United States), a separate form for each page, where we read them. There is no database of visitors on this website.
• How long: while we are talking, plus 12 months (see “How long we keep it”). Deleted sooner if you ask.
• Ads: if you have allowed Marketing, the Meta Pixel and the Google Ads tag learn that a form was sent, never what you wrote in it.

Earlier versions of the forms on /chatgpt, /seu-chat and /contabilidade asked for company name, sector or number of clients, email and telephone; those answers are kept on the same basis and for the same time.

We do not sell personal data, and we do not share it for advertising. The service providers that operate the website are listed below.

The following providers operate the Orkestia platform and MCP infrastructure. A connected provider chosen by an organization is a separate recipient for the workflow the organization requests.

We may also disclose data when a law, a regulator or a court requires it, or to establish or defend a legal claim.

Our website hosting, email, platform infrastructure, and the providers listed above operate in the United States. An organization can also direct a workflow to a provider in another location. Where data leaves Brazil, the transfer rests on the applicable contractual guarantees and safeguards under LGPD Art. 33.

We keep personal data only as long as the purpose that justified collecting it lasts.

The website, application, API, and MCP service use HTTPS. Access to platform infrastructure is limited to authorized people using individual credentials, and MCP requests are authenticated and scoped to an organization. Contact-form submissions are stored in Google Forms; they are not stored in an application database on orkestia.dev. No measure is absolute — if something ever goes wrong with personal data, we will tell affected people and the ANPD as the law requires.

Brazil's LGPD gives you six rights over your personal data — access, correction, deletion, portability, objection and anonymization. They are set out in full, with how to exercise each one and how long we take to answer, on the LGPD page.

• Access (acesso) — Know whether we hold data about you and get a copy of it.
• Correction (correção) — Have incomplete, inaccurate or outdated data fixed.
• Deletion (deleção (eliminação)) — Have data removed when it is no longer necessary, or when you withdraw the consent it rested on.
• Portability (portabilidade) — Receive your data in a structured format so you can take it elsewhere.
• Objection (oposição) — Object to a specific use of your data, including any use we base on legitimate interest.
• Anonymization (anonimização) — Have your data anonymized, blocked or deleted where it is unnecessary, excessive, or processed outside the law.

To change what this site stores on your device, open the cookie preferences panel — available on every page, and as free to refuse as to accept.

For platform, API, or MCP data, write to lgpd@orkestia.dev. You can also revoke an app or provider connection, ask your organization administrator to change access, and request access, correction, export, deletion, or restriction through that channel.

This site addresses businesses and the people who run their technology. It is not directed at children or adolescents and we do not knowingly collect their data. If you believe a child sent us personal data, write to us and we will delete it.

When this policy changes materially, we update the version and the effective date at the top of the page. If the change touches what we store on your device, the recorded consent version changes with it, the cookie panel asks again, and a decision you made against an older version is not carried over.

Write to lgpd@orkestia.dev for a privacy question, rights request, or complaint, or to hello@orkestia.dev for general questions. You may also take a complaint straight to the ANPD, Brazil's data-protection authority.