Privacy Policy

Last updated: 1 July 2026

1. Who we are

Orcly.io is a fraud prevention and payments consultancy operated by Orcly Ltd ("Orcly", "we", "us", "our"). Our website is located at https://orcly.io. For data protection enquiries, contact us at privacy@orcly.io.

2. Data we collect

  • Contact and enquiry data: name, email address, company name, and the content of messages submitted via our contact form.
  • Newsletter subscriptions: email address only, collected when you sign up for our newsletter.
  • Usage data: anonymised analytics via Vercel Analytics and PostHog, including pages visited, time on site, and referral source. No personally identifiable information is collected through analytics.
  • Cookies: we use strictly necessary cookies for site functionality. Analytics cookies are anonymised. We do not use advertising or tracking cookies.

3. How we use your data

  • To respond to your consultation requests and enquiries.
  • To send you our newsletter, if you have subscribed.
  • To understand how our website is used and improve it.
  • To comply with legal obligations.
We do not sell, rent, or share your personal data with third parties for marketing purposes.

4. Legal basis for processing (GDPR)

For users in the European Economic Area (EEA) and UK, we process your personal data under the following legal bases:
  • Contractual necessity: processing your enquiry or consultation request.
  • Legitimate interests: improving our services and website.
  • Consent: newsletter subscriptions. You may withdraw consent at any time.

5. Data retention

We retain contact form submissions and leads for up to 3 years for business development purposes. Newsletter subscriber data is retained until you unsubscribe. Anonymised analytics data may be retained indefinitely.

6. Third-party services

  • Supabase: database hosting for form submissions and subscriber data (EU-hosted).
  • Vercel: website hosting and anonymised analytics.
  • Resend: transactional email delivery (future integration).
Each provider has their own privacy policy and data processing agreements in place.

7. Your rights

Under GDPR and applicable privacy laws, you have the right to access, correct, delete, or restrict processing of your personal data. To exercise any of these rights, email privacy@orcly.io. We will respond within 30 days.

8. Data transfers

Your data may be transferred to and processed in countries outside the EEA. Where this occurs, we ensure appropriate safeguards are in place (e.g. Standard Contractual Clauses).

9. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top of this page will reflect any changes. Continued use of our website after changes constitutes acceptance.

10. Contact

For any privacy-related questions or requests, contact us at privacy@orcly.io.