Effective date: August 4, 2026

This Privacy Policy explains how Orthalon, Inc. ("Orthalon," "we," "us," or "our") collects, uses, discloses, and protects personal information when you visit our website, create an account, or use Orthalon's hosted services, browser extension, desktop agent, AI gateway, MCP discovery agent, connectors, and related support services (collectively, the "Services").

1. Our role

Orthalon provides AI security and data-loss-prevention tools to organizations. For account, website, billing, sales, and service-administration data, Orthalon generally acts as the controller or business responsible for deciding why and how that information is processed.

When an organization uses Orthalon to monitor or protect its workforce, that organization controls the deployment, policies, users, retention settings, and data submitted to the Services. For that information, the organization is the controller or business and Orthalon generally acts as its processor or service provider. If you use Orthalon through your employer or another organization, please also review that organization's privacy notice and contact its administrator first with questions about its monitoring or policies.

2. Information we collect

Information you provide

We may collect:

account details, such as your name, business email address, password credentials in hashed form, profile details, and authentication identifiers;
organization details, such as organization name, domains, members, roles, policy configuration, and administrator settings;
billing and transaction details, such as plan, seat count, subscription status, and limited payment metadata supplied by our payment provider. We do not receive full payment-card numbers;
communications, such as support requests, sales inquiries, survey responses, and feedback; and
configuration data and credentials you choose to provide for SSO, SCIM, enterprise discovery connectors, sensors, gateways, or other integrations.

Information processed through the Services

Depending on the features and configuration selected by an organization, we may process:

security-event metadata, including timestamps, application or provider, detector category, policy decision, severity, counts, user or device identifiers, and remediation status;
AI application and model usage metadata, including application domain, provider, model, request status, and token or usage measurements;
directory, network, OAuth application, and connector inventory used for AI application discovery;
endpoint and MCP inventory, such as device metadata, client type, server name, transport, and sanitized command or URL metadata;
audit records, approvals, reports, and administrator actions; and
prompt or response content when a selected protection layer must inspect it to apply policy; and
files submitted for Business or Enterprise content analysis when an administrator enables supported file inspection.

Browser and compatible desktop detection is designed to run at the enforcement point. The hosted AI gateway must process routed request and response content in memory to proxy it. Orthalon is designed not to persist raw prompt or response bodies by default; it records policy and detector metadata and may record redacted or placeholder-only excerpts where configured. An organization's settings, integrations, or support request may change what is submitted, so administrators should validate their deployment before enabling production monitoring.

For supported file analysis that cannot run safely in the browser, the browser uploads the file through a short-lived signed URL to a private object-storage bucket. Orthalon processes the object to extract supported text, deletes the raw object after analysis, and retains only job status and hashed detector metadata. A storage lifecycle rule provides a deletion backstop if processing is interrupted. Encrypted archives, unsupported embedded objects, images, audio, and video are not represented as successfully inspected.

Chrome Extension & Browser Protection Privacy Practices

The Orthalon Browser Extension operates with strict data minimization and adheres to the Google Chrome Web Store Developer Program Policies:

Single Purpose: The extension provides real-time Data Loss Prevention (DLP) and policy enforcement on supported generative AI websites to prevent unintended disclosure of sensitive credentials, personally identifiable information (PII), and proprietary data.
Client-Side Processing: All real-time text analysis, regular expressions, and detector evaluations execute locally on the user's device inside browser memory.
No Prompt or Keystroke Logging: The extension does not record, log, or store prompt keystrokes, chat conversations, or unflagged text.
Data Transmission & Telemetry: When a policy rule is triggered, the extension sends only anonymized security metadata (salted SHA-256 finding hashes, detector category, timestamp, application domain, and policy decision) to the organization's designated Orthalon ingest server. Raw text is never transmitted or retained.
No Sale of Data: Personal data and security telemetry are never sold, traded, or used for third-party advertising, retargeting, or creditworthiness evaluation.

Information collected automatically

When you use our website or hosted Services, we may collect device and usage information such as IP address, browser type, operating system, referring page, pages viewed, session timestamps, language, approximate region, error logs, security signals, and cookie or similar-technology identifiers.

3. How we use information

We use personal information to:

provide, operate, secure, and troubleshoot the Services;
authenticate users and administer accounts and organizations;
evaluate security events and apply customer-configured policies;
process subscriptions, prevent fraud, and maintain business records;
provide support and communicate service, security, and product updates;
understand feature usage and improve reliability and usability;
comply with law and enforce our agreements; and
protect Orthalon, our customers, users, and the public from abuse or harm.

We do not sell personal information for money. We do not use customer prompt content or customer security-event content to train general-purpose AI models unless the customer gives separate, explicit authorization.

4. Legal bases

Where applicable law requires a legal basis, we rely on:

contract, when processing is necessary to provide the Services requested by you or your organization;
legitimate interests, such as securing, operating, improving, and preventing abuse of the Services, balanced against individual rights;
legal obligations, such as tax, accounting, sanctions, and lawful government-request requirements; and
consent, where we specifically ask for it. You may withdraw consent at any time without affecting earlier lawful processing.

For customer-controlled data, the customer determines the applicable legal basis and is responsible for providing required notices to its users.

5. How we disclose information

We may disclose information:

to infrastructure, hosting, database, authentication, email, analytics, customer-support, payment, and security providers that process it for us under contractual restrictions;
to AI model providers or other destinations selected by the customer when a customer routes traffic through the AI gateway or configures an integration;
to an organization that owns or administers the account through which you use Orthalon;
to professional advisers, auditors, insurers, and financing parties subject to appropriate confidentiality obligations;
when required by law or when reasonably necessary to protect rights, safety, and service integrity; and
as part of a merger, acquisition, financing, reorganization, or sale of assets, subject to appropriate confidentiality and notice requirements.

We do not disclose customer data to third parties for their independent advertising purposes.

6. Retention

We retain account and customer-controlled information for the period configured by the customer or needed to provide the Services. After account termination, we delete or de-identify information within a reasonable period, subject to backup cycles, contractual commitments, legal obligations, dispute resolution, and security needs.

Security logs, billing records, and records required for fraud prevention, audit, or legal compliance may be kept longer. Retention can vary by data type and plan. Organization administrators should document and configure retention appropriate to their legal and operational requirements.

7. Security

We use administrative, technical, and organizational safeguards designed to protect information, including access controls, encryption in transit, credential hashing, audit logging, secret protection, and tenant-scoped authorization. No system is completely secure, and we cannot guarantee that unauthorized access or loss will never occur.

Customers are responsible for safeguarding their credentials and sensor keys, restricting administrator access, configuring integrations securely, and promptly revoking credentials that may have been exposed.

8. International transfers

Orthalon and its service providers may process information in countries other than the country where it was collected. Where required, we use recognized transfer safeguards, such as contractual protections, and take steps designed to protect information consistently with applicable law. Available hosting regions do not by themselves guarantee that every support, security, or subprocessor operation remains within that region unless a written agreement expressly says so.

9. Your choices and rights

Depending on where you live, you may have rights to request access, correction, deletion, restriction, portability, or a copy of personal information; to object to certain processing; to withdraw consent; or to appeal a denied request. You may also have the right to complain to your local data protection authority.

You can update some account information in Orthalon. To submit another request, email security@orthalon.com. We may need to verify your identity and authority. If Orthalon processes the information solely for a customer, we may direct the request to that customer.

You may opt out of non-essential marketing messages by using the unsubscribe link in the message. We may still send transactional, account, and security notices.

10. Cookies and similar technologies

We use technologies necessary for authentication, security, preferences, localization, and core website operation. We may also use limited analytics to understand performance and product usage. Where required, non-essential technologies are used only with consent. Browser settings can restrict cookies, but blocking necessary cookies may prevent authentication or other features from working.

Orthalon does not respond to every browser "Do Not Track" signal. Where legally required and technically supported, we honor applicable opt-out preference signals for activities covered by those laws.

11. Children

The Services are intended for organizations and adults acting in a business capacity. They are not directed to children under 16, and we do not knowingly collect personal information directly from children. Contact us if you believe a child has provided personal information to Orthalon.

12. Changes to this policy

We may update this Privacy Policy to reflect changes to the Services, law, or our practices. We will post the updated version and change the effective date. If a change materially affects how we use personal information, we will provide additional notice where required.

13. Contact

Questions, privacy requests, and security concerns may be sent to security@orthalon.com. Orthalon, Inc. is the entity responsible for this policy. You may use that address to request our current postal contact details or any regional representative details applicable to your request.