Skip to content
Talk to usStart free
Legal

The rules we hold ourselves to, in plain words where we can.

Privacy Policy

Last updated: October 7, 2026

1. Overview

This Privacy Policy explains how Orisu (“Orisu,” “we,” “us”) collects, uses, shares, and protects personal data when you use our AI creative-workflow platform (“the Service”). Orisu lets you build node-based workflows that generate images, video, audio, and text, then review and share the results. We serve a global audience, and this policy is written to address the requirements of the EU/UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), among others.

2. Data We Collect

Account information: Your name, email address, password credentials (stored hashed), and organization membership. Authentication is handled by Better Auth.

OAuth profile data: If you sign in with Google, we receive basic profile information (name, email, profile image) from Google to create and identify your account.

Workspace content: The node graphs, workflows, prompts, configuration, uploaded files, and other content you create or import into Orisu.

Generated assets: The images, video, audio, and text produced by your workflows, stored so you can review, edit, and share them.

Usage and analytics data: Which pages you view and which features you use, with the time of each event, plus device and browser type and an approximate location (country or city) derived from your IP address. We collect this with PostHog only to understand how the Service is used and to improve it; we do not use it to build profiles for sale or to make decisions about you. You can turn it off at any time (see Section 7).

Payment information: Billing is processed by Polar. We do not store full card numbers; we retain transaction metadata (plan, amount, status) needed to manage your subscription and credits.

Communications: Messages you send us (e.g. support requests) and records of transactional emails we send you.

3. How We Use Your Data & Legal Bases

To provide the Service (contract): Creating and securing your account, running your workflows, generating and storing assets, processing payments and credits, and providing customer support. This processing is necessary to perform our contract with you.

To operate and improve the Service (legitimate interest): Maintaining reliability and security, preventing abuse and fraud, debugging, and understanding aggregate usage to improve features. We balance these interests against your rights and freedoms.

Product analytics (legitimate interest, with opt-out): Understanding how Orisu is used so we can improve it. You can opt out at any time from the cookie banner, and we stop collecting analytics from you when you do.

Advertising measurement (consent, or opt-out where the law allows): Measuring which of our ads lead to signups. In the EEA, the UK and Switzerland we only do this after you accept it in the cookie banner. Elsewhere it is on by default and you can opt out at any time from the same banner.

Legal compliance: Where we are required to retain or disclose data to comply with applicable law.

4. Who We Share Data With

We share data with third-party processors only as needed to operate the Service. Each processor receives the minimum data required for its function and is bound by its own data-protection obligations.

  • Polar — payment processing, subscriptions, and credit purchases.
  • FAL.ai — running image, video, and audio generation models on the prompts and inputs in your workflows.
  • Anthropic and OpenRouter — large language model inference for text generation and the in-product copilot.
  • ElevenLabs — voice and audio generation, transcription, and voice features.
  • PostHog — product analytics (see Section 7).
  • Meta, TikTok, LinkedIn, Reddit and Google Ads — advertising measurement and retargeting, so we can see which ads lead to signups (see Section 7).
  • Resend — sending transactional email (e.g. sign-in, verification, account notices).
  • Cloudflare R2 — object storage for uploaded and generated files; Cloudflare Workers — brand extraction / scraping.
  • Railway — hosting and managed database infrastructure.
  • Vercel — hosting for our website and web app.
  • Inngest — orchestrating background and long-running jobs.
  • Apify — social/web scrapers used by certain source nodes.
  • Composio and Google — Google Drive integration (import/export) and Google OAuth sign-in.

We do not sell your personal data. We may disclose data if required by law or to protect the rights, safety, or property of Orisu, our users, or the public.

5. AI Model Providers & Your Content

When you run a workflow, the prompts, inputs, and uploaded media required for that step are transmitted to the relevant AI provider (e.g. FAL.ai, Anthropic, OpenRouter, ElevenLabs) to produce the output. Your use of generated content is also subject to those providers’ terms. We do not use your private workspace content to train our own models.

6. Using Orisu from ChatGPT, Claude and Other AI Assistants

You can connect Orisu to an AI assistant such as ChatGPT or Claude through our MCP server. When you connect, you sign in to Orisu and approve the permissions the assistant asks for; we store that connection (the assistant’s name, its sign-in redirect address and the permissions you granted) and the access tokens it uses.

Orisu only receives what the assistant sends to Orisu’s tools: the prompts, settings and IDs for the action it is asked to take, and any files you ask it to upload. We do not receive the rest of your conversation with the assistant. We use this data to perform the action you asked for, such as generating an image or running a saved workflow, and the results are stored in your workspace like any other work. Prompts and media needed for a generation step are shared with the relevant AI model provider as described in Section 5.

For each request we keep a log entry with the tool name, time, outcome, response time and the account and connection it came from. We use these entries for reliability, security and abuse prevention. When the assistant asks us to make a request safe to retry, we keep a fingerprint of that request and its response for 24 hours so a retry does not repeat the action; the response is then deleted.

What the assistant does with Orisu’s responses is governed by that assistant provider’s own privacy policy (for example OpenAI for ChatGPT or Anthropic for Claude). You can disconnect an assistant at any time from Account → Connected apps in Orisu, or by removing the Orisu connector in the assistant’s settings.

7. Cookies & Analytics

We use cookies and similar technologies that are strictly necessary to run the Service (e.g. keeping you signed in via Better Auth). Beyond those we use two kinds of optional tracking:

  • Product analytics (PostHog): page views, feature usage and the time of each event, with device, browser and approximate location from your IP address. It is on by default and you can turn it off at any time from the cookie banner.
  • Advertising measurement (Meta, TikTok, LinkedIn, Reddit, Google Ads): whether a visit from one of our ads leads to a signup. In the EEA, the UK and Switzerland it stays off until you accept it in the cookie banner. Elsewhere it is on by default and you can turn it off from the same banner.

We use this data only for the purposes above, and we do not use it to profile you for anything else. For full detail, see our Cookie Policy.

8. Data Retention

We retain your account and workspace data for as long as your account is active and as needed to provide the Service. Generated assets and run history are retained until you delete them or close your account. We may retain limited data after account closure where required to comply with legal, tax, accounting, or fraud- prevention obligations, after which it is deleted or anonymized. Analytics data is retained in aggregate or pseudonymized form according to our analytics provider’s retention settings.

  • Account, workspace content, generated assets and run history: until you delete them or close your account.
  • Deleted assets: kept in your trash for 30 days, then permanently removed.
  • AI assistant connections and their access tokens: until you disconnect the assistant or close your account.
  • AI assistant request log entries (Section 6): until your account is closed, then deleted with it.
  • Retry fingerprints for AI assistant requests: 24 hours.
  • Product analytics and advertising measurement: per our providers’ retention settings, in pseudonymized form.

You can ask us to delete any of this sooner at privacy@orisu.ai (see Section 10).

9. International Transfers

Orisu and its processors operate in multiple countries, including the United States. When we transfer personal data outside your country or region (such as from the EU/UK), we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, to protect your data.

10. Your Rights

Depending on where you live, you have rights over your personal data, including the right to access the data we hold about you, rectify inaccurate data, erase your data, obtain a portable copy, and object to or restrict certain processing. You also have the right to withdraw consent for analytics at any time, and to lodge a complaint with your local data- protection authority.

Erasure and data export: Self-serve deletion and export are not yet available in-app. To request erasure of your data or a portable copy of it, email privacy@orisu.ai. We will verify your identity and action your request within 30 days.

11. Security

We use industry-standard measures to protect your data, including encryption in transit, access controls, and trusted infrastructure providers. No method of transmission or storage is completely secure, but we work to protect your data and to notify you of material breaches as required by law.

12. Children’s Privacy

Orisu is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us and we will delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email or a prominent notice within the Service. The “Last updated” date above reflects the most recent revision.

14. Contact

Questions about this Privacy Policy or your data? Contact us at privacy@orisu.ai.