Privacy Policy

1. Introduction

This Privacy Policy describes how Orvanthis collects, uses, stores, and discloses information when you use the Orvanthis website, application, market-research tools, dashboards, canonical Signals, Opportunity Radar, qualified Opportunities, Research Drawer, Research Desk, Pinned Research, Analyst features, reports, subscriptions, feedback tools, and related services (together, the “Service”).

In this policy, “Orvanthis,” “we,” “us,” and “our” refer to Orvanthis LLC, an Indiana limited liability company. This policy applies to information handled through the Service; it does not replace the privacy terms of third-party websites or services you choose to use.

2. Information we collect

A. Account and profile information

We collect information used to create and maintain an account, including name, email address, a password hash, authentication and session state, email-verification state, plan, account settings, onboarding choices, monitoring settings, and research preferences such as sectors, time horizons, opportunity focus, risk preference, and location preference when you provide one.

B. Research and user-provided content

We process content you submit or save, including watchlists, pinned or saved setups, Analyst prompts, generated briefs, saved reports, notes, theses, supporting evidence, risks, validation plans, invalidation signals, feedback, support messages, custom tasks, and other research content. You should not submit information you are not authorized to use.

C. Usage and interaction data

We collect product activity such as pages and features used, research actions, briefs requested or generated, items saved, platform events, plan-usage counts, workflow state, and associated timestamps. We also use a hosted analytics service for event-level product analytics. The application limits custom analytics properties to a defined set of product fields and does not intentionally send research prompts, watchlist symbols, notes, or preference values as custom analytics properties.

D. Technical and security information

Web requests may include IP address, browser, device, operating system, referral information, request time, authentication events, security events, diagnostic details, and service logs. Orvanthis currently uses IP addresses in request-rate controls; hosting, analytics, or security providers may also process IP-derived approximate location where applicable. Orvanthis does not currently ask for precise device geolocation through the Service.

E. Subscription and billing information

We process plan selection, billing interval, Stripe customer and subscription identifiers, subscription state, invoice and payment outcomes, cancellation state, and related billing events. Stripe processes payment-card details. Orvanthis does not store full payment card numbers in its application database.

F. Market-research context

Symbols, asset types, research preferences, tracked setups, saved baselines, review state, completed tracked outcomes, bounded historical setup context, and user-selected market interests may be stored to provide the Service. Market data and public-information records may be shared across users when they are not tied to a user account.

3. How we collect information

• Directly from you, when you create an account, choose preferences, write notes, submit prompts, save research, subscribe, request support, or send feedback.
• Automatically through the Service, through authentication sessions, local browser storage, product events, usage counters, request controls, and diagnostic or security logs.
• From service providers, including authentication/session infrastructure, Stripe, transactional email delivery, hosting, analytics, AI processing, and security or diagnostic services.
• From market-data and public-information providers, including quote, closed-candle, market-mover, news-metadata, press-release-metadata, and earnings-context sources.

4. How we use information

We use information to:

• operate, maintain, secure, and troubleshoot the Service;
• create accounts, verify email addresses, manage sessions, and recover access;
• personalize research relevance using the preferences you choose;
• provide canonical Signals, Radar, Opportunities, research drawers, saved research, notes, monitoring, and validation workflows;
• create explicit AI-assisted research briefs and preserve them when you choose to save them;
• perform deterministic discovery, automated review, tracked-outcome evaluation, and bounded historical-context calculations;
• administer plans, usage limits, subscriptions, renewals, cancellations, and payment status;
• send verification, password-reset, billing, security, support, and other service communications;
• measure aggregate product use and improve reliability, usability, and deterministic research systems;
• prevent abuse, apply rate limits, investigate incidents, and enforce our Terms; and
• comply with law and respond to valid legal process.

The current code audit did not confirm a commercial marketing-email program. If one is introduced, Orvanthis must add appropriate notices and preference or unsubscribe controls before using account emails for that purpose.

5. AI and automated processing

Orvanthis separates deterministic product systems from explicit AI-assisted generation. Deterministic systems identify market developments, organize and rank research priority, review material changes, track completed outcomes, and calculate bounded, sample-aware historical context. AI model providers process prompts and the market or research context included in a generation request to create a brief or response.

AI outputs may be inaccurate, incomplete, outdated, or misleading. Verify important information using reliable sources. Do not submit financial-account credentials, government identifiers, health data, confidential third-party information, or other highly sensitive information through Analyst prompts, notes, or feedback.

Historical tracked outcomes provide context, not prediction. Current evidence remains primary. An LLM is not permitted to autonomously change Orvanthis’s core ranking weights, detector thresholds, or automated-review rules.

The current source audit does not establish that private user content is used to train public AI models, and this policy does not grant Orvanthis that right. Provider-side handling remains subject to the applicable provider terms and Orvanthis configuration, which should be confirmed before broad commercial launch.

6. How we disclose information

We disclose information only as reasonably needed for the following purposes and categories of recipients:

• Infrastructure and hosting: to deliver the website, application, network, and deployment services.
• Database and authentication: to store account and research records, verify credentials, and maintain sessions.
• Payment processing: to Stripe for checkout, recurring billing, billing-portal access, payment status, and subscription administration.
• Email delivery: to send account verification and password-reset messages and other confirmed service communications.
• AI processing: prompts and selected context are sent to an enabled AI model provider when an AI-assisted feature is requested.
• Market-data and public-information providers: symbols and bounded request parameters may be sent server-side to obtain supported research data; provider calls are not made directly from browser code.
• Analytics, security, and diagnostics: to understand product use, detect misuse, maintain availability, and investigate failures.
• Legal and safety: when reasonably necessary to comply with law, valid process, protect rights or safety, or investigate fraud or abuse.
• Business transfer: as part of a proposed or completed financing, acquisition, merger, reorganization, or sale, subject to appropriate confidentiality and applicable law.

Orvanthis does not currently sell personal information for monetary consideration. The current source audit also did not identify a targeted-advertising integration. This statement describes current practice and may be updated if the Service’s practices change.

7. Cookies and browser storage

Orvanthis uses authentication cookies or equivalent session technologies to keep users signed in and protect account access. The Service also uses local storage for product settings and fallback or draft state, including workspace density, navigation state, onboarding and personalization settings, checklist state, draft thesis content, and certain locally tracked research items. Session storage is used for short-lived interface state, such as whether an onboarding item was viewed during the current browser session.

Hosted analytics is enabled in the application. The repository does not currently include a cookie-consent banner or preference center, so this policy does not claim one exists. Browser controls can block or clear cookies and storage, but doing so may sign you out, remove local drafts or preferences, or limit product functionality.

8. Data retention

Retention depends on the category and why it is needed:

• Account and saved research: generally retained while the account remains active or until you delete the content or account, subject to technical and legal exceptions.
• Billing and transaction records: retained by Stripe and, where received by Orvanthis, as needed for subscription administration, accounting, disputes, fraud prevention, and legal obligations.
• Authentication tokens: verification and reset tokens have defined expirations in the product, although expired-record cleanup behavior should be separately confirmed.
• Usage, audit, diagnostic, and security records: retained for operational periods needed to administer limits, investigate events, protect the Service, and meet legal obligations. Exact schedules are not yet documented.
• Deleted accounts: the current deletion flow removes the account and user-linked research records through deletion and database cascade behavior, redacts linked feedback, and de-identifies linked audit records where reasonably possible.
• Backups: deleted data may persist temporarily in infrastructure backups until backup rotation or deletion occurs. Backup configuration and precise periods require operational confirmation.

We may retain information longer when required by law, needed to establish or defend legal claims, necessary for security or fraud prevention, or requested by you. Orvanthis has not adopted exact public retention periods for every category. More specific schedules remain an operational and attorney-review item.

9. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information. Confirmed measures include password hashing, authenticated and verified-user access controls, request-origin checks on sensitive changes, rate controls, restricted internal routes, payment-webhook signature verification, security headers, audit logging, and encrypted HTTPS transport in production.

No system is perfectly secure. We do not guarantee that unauthorized access, loss, misuse, alteration, or disclosure will never occur, and we do not claim a security certification that has not been obtained.

10. User controls and privacy requests

Account settings provide controls to update research and monitoring preferences, download a JSON export of specified account records, and request account deletion. The automated export is useful but does not currently include every user-linked outcome, learning, review, or internal security record. Contact Orvanthis LLC at Orvanthis@gmail.com for access, correction, a broader export, deletion, objection, or restriction requests that cannot be completed in the product.

Deleting the Orvanthis account does not cancel a Stripe subscription or erase Stripe-side records. Cancel recurring billing in the billing portal before deleting the account. Subscription cancellation stops future renewals as shown in the portal; it is different from a refund.

We may need to verify your identity and may deny or limit a request where permitted by law, including when information must be retained for security, fraud prevention, billing, tax, legal claims, or another lawful reason. Authorized-agent requests may require proof of authority.

11. State and regional privacy rights

Privacy rights vary by location. Depending on applicable law, you may have rights to know or access information, obtain a portable copy, correct information, delete information, object to or restrict certain processing, withdraw consent where consent is the legal basis, and appeal a request decision. These rights are subject to exceptions.

California

If the California Consumer Privacy Act applies to Orvanthis and to your information, you may have rights to know and access categories and specific pieces of personal information, delete information, correct inaccurate information, opt out of sale or sharing, limit certain uses of sensitive personal information, and receive equal service without unlawful discrimination for exercising applicable rights. Orvanthis does not claim that it currently meets CCPA applicability thresholds.

The current source audit found no sale for monetary consideration and no targeted-advertising integration. A sale/sharing opt-out mechanism and Global Privacy Control handling are not currently implemented. Those items must be reassessed if practices or legal applicability change.

European Economic Area and United Kingdom

Depending on applicable law, you may have rights of access, rectification, erasure, portability, restriction, objection, and complaint to a supervisory authority. The appropriate legal bases, transfer mechanism, representative requirements, and controller identity must be confirmed with qualified counsel before Orvanthis broadly offers the Service in those regions. This policy does not claim GDPR compliance.

12. Children

The Service is not directed to children under 13. Orvanthis does not knowingly collect personal information from children under 13. If you believe a child under 13 submitted personal information, contactOrvanthis@gmail.com so we can investigate and delete it where appropriate.

13. International transfers

Orvanthis is designed to use service providers that may process information in the United States and in other jurisdictions where they operate. Those locations may have different privacy laws from your jurisdiction. Orvanthis does not promise a specific international transfer framework in this policy; the applicable safeguards and contracting requirements must be confirmed for launch markets.

14. Do Not Track and Global Privacy Control

The Service does not currently implement a specific response to browser Do Not Track signals. The current source audit also did not identify Global Privacy Control recognition. We do not claim GPC support. Signal handling remains a legal and product item to assess before launch in jurisdictions where it may be required.

15. Policy changes

We may update this policy as the Service, providers, or legal requirements change. We will update the Last Updated date and, when a revised policy takes effect, the Effective Date. We may provide an additional notice when a change is material and applicable law requires it.

16. Contact

For privacy questions or requests, contact Orvanthis LLC at Orvanthis@gmail.com. The Orvanthis support inbox currently handles privacy requests and general product support. Orvanthis does not publish a private residential or registered-agent address on this website.