Privacy Policy

Effective: [[EFFECTIVE_DATE]] Controller: Thinqmesh Technologies (https://thinqmesh.com), A Block, Sector 63, Noida, Gautam Budh Nagar, Uttar Pradesh 201301, India Product: Orfyn, a product of Thinqmesh Technologies Contact: privacy@thinqmesh.com

The short version

Orfyn is self-hosted software. The daemon runs on infrastructure you control, holds credentials you issued, and talks to your systems from inside your network.

We do not receive your source code, your prompts, your model usage, or the contents of your systems. Not because we promise not to look, but because the architecture never sends them to us. There is no multi-tenant service holding your data.

What follows is therefore mostly about a website and a contact form.

1. Personal data we collect

1.1 When you request a meeting

If you submit the meeting-request form we collect what you type:

Purpose: to contact you about the meeting you asked for, and to prepare for it. Lawful basis (DPDP Act 2023, India): processing for the specified purpose for which you have voluntarily provided your data. Lawful basis (UK/EU GDPR): Article 6(1)(b), steps taken at your request prior to entering a contract; and Article 6(1)(f), our legitimate interest in responding to business enquiries. Retention: for as long as needed to handle the enquiry and any resulting relationship, and no more than 24 months after the last contact unless you become a customer.

Please do not paste confidential information, credentials, or personal data about other people into the workflow description. A short description is enough; the detail belongs in the meeting.

1.2 When you email us

We keep the correspondence, for the same purposes and on the same basis.

1.3 When you visit the website

Standard server logs, retained for a short operational period for security and abuse prevention. We do not use advertising cookies, we do not build behavioural profiles, and we do not sell or share personal data for cross-context behavioural advertising.

1.4 When you run the software

We collect nothing about your code. There is no telemetry on the contents of your repositories, your prompts, or your agent activity.

If you use the optional relay to connect a client to your daemon over the internet, the relay transports end-to-end encrypted traffic. It cannot read your messages or see your code. Connection metadata necessary to route and rate-limit a connection is processed transiently. (See README.md in this folder — confirm and state the exact retention here before publishing.)

If you connect a client to your daemon directly over your own network, no Orfyn-operated component is involved at all.

1.5 Model providers

When an agent sends a prompt, that request goes from your infrastructure directly to the model provider you configured, using your credentials. We are not in that request path and never receive it. Your relationship with that provider — and their privacy terms — is between you and them.

2. What we never do

• Sell personal data
• Use your code or prompts to train models — we never receive them
• Place advertising or cross-site tracking cookies
• Require an account to evaluate the software

3. Sharing

We share personal data only with the service providers needed to run the website and respond to you, listed in sub-processors.md, and where legally required. Our sub-processor list is short because the architecture keeps it short.

4. International transfers

Where personal data from the UK/EEA is transferred outside it, we rely on adequacy decisions or Standard Contractual Clauses with appropriate supplementary measures. The list of relevant providers and their locations is in sub-processors.md.

Note that your data residency for the software itself is determined by where you install the daemon — a decision you make, not one we make for you.

5. Your rights

Depending on where you live you may have the right to access, correct, delete, restrict, object to, or port your personal data, and to withdraw consent where processing relies on it.

Contact privacy@thinqmesh.com. We respond within one month. You may also complain to your supervisory authority — in India, the Data Protection Board; in the UK, the Information Commissioner's Office; in the EEA, your national authority.

California residents: we do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not discriminate against you for exercising your rights.

6. Security

The website and our internal systems are protected with access control, encryption in transit, and least-privilege administration. Report a suspected vulnerability to security@thinqmesh.com; we will acknowledge it and will not pursue researchers acting in good faith under a coordinated disclosure.

The security of the daemon and the host you run it on is yours, because it is your infrastructure. ../04-security.md sets out that division precisely.

7. Grievance Officer

In accordance with the Information Technology Act, 2000 and the rules made under it, and the Digital Personal Data Protection Act, 2023, the contact for grievances relating to personal data is:

Grievance Officer Thinqmesh Technologies A Block, Sector 63, Noida, Gautam Budh Nagar, Uttar Pradesh 201301, India privacy@thinqmesh.com

We acknowledge grievances within 24 hours and aim to resolve them within 15 days of receipt, as required under the applicable rules.

If you are not satisfied with our response, you may escalate to the Data Protection Board of India.

8. Children

The service is for business use and is not directed at anyone under 16.

9. Changes

We will post the new version here with a new effective date, and where the change is material we will take reasonable steps to tell you directly.

Questions: privacy@thinqmesh.com