Privacy Policy
Last updated: 11 October 2026
Summary: Orton is currently in closed beta. We collect the minimum data needed to run the waitlist, your account, and the product itself. We use PostHog for analytics, but it doesn’t set cookies or similar technologies, or record your session, until you say yes to that in the cookie banner. You can ask us to delete or export your data at any time.
Who we are
Orton (“Orton”, “we”, “us”) operates orton.app. Orton is currently a trading name rather than a separately registered company — while we’re in beta, you can reach us at legal@orton.app for anything to do with this policy or your data. This section will be updated with our registered company details before Orton leaves beta and starts billing.
What we collect and why
| Data | Why we collect it | Lawful basis |
|---|---|---|
| Waitlist email address | To invite you to the closed beta | Legitimate interest (running the beta) |
| Account data (name, email, avatar) via Clerk | To create and secure your account | Contract (providing the service) |
| When you last used Orton (the time you last opened a page while signed in, recorded at most once an hour) and when we last sent you a “while you were away” email | To send you one catch-up email if you haven’t visited or added progress for two weeks, at most once every 30 days. It’s never shown to your organisation or anyone else. Turn it off with the Reminders setting on your account page. | Legitimate interest (helping you keep your objectives up to date) |
| Objectives, key results, progress updates (“OKR content”) | This is the product — it’s what you use Orton to track | Contract (providing the service) |
| Replies to our Friday progress email | To add what you wrote as progress notes, or mark a quiet week, on the objectives listed in that email | Contract (providing the service) |
| Weeks you mark “Nothing this week” | To show you your own private run of weeks and stop that week’s prompts | Contract (providing the service) |
| Feedback, thanks and review packs | When colleagues thank or give feedback on your progress updates, or you share a review pack, we store who gave it, who received it, what was written and when. Feedback is visible only to the giver and the recipient, and the recipient may include it, with the giver’s name, in a review pack they choose to share. Thanks, and the names of the people who gave them, are visible to anyone who can see that objective. Purpose: to help you and your team reflect on progress. | Contract (providing the service), on behalf of your organisation |
| Product analytics (pages viewed, features used) via PostHog | To understand what’s working and prioritise what to build next | Legitimate interest is the lawful basis for the underlying analytics; PECR separately requires your consent before we store or read anything non-essential on your device (see Cookies, below) |
| Session replay via PostHog | To see how the beta is actually used so we can fix confusing bits | Consent — off until you accept analytics cookies |
| Beta survey answers | To hear directly what’s working and what isn’t | Legitimate interest — answering is always optional |
Who we share it with
We use the following sub-processors to run Orton. None of them can use your data for their own purposes. Where a sub-processor is outside the UK, we put appropriate safeguards in place: the UK–US data bridge where the provider is certified, otherwise the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
| Sub-processor | Purpose | Location |
|---|---|---|
| Clerk | Authentication and account management | US |
| Neon | Database hosting | EU |
| Vercel | Application hosting and background jobs | Global, primary region EU |
| PostHog | Product analytics and session replay | EU (PostHog Cloud EU) |
| Resend | Sending email, and receiving your replies to our Friday progress email | US (received email stored in the EU) |
| Upstash | Rate limiting (IP addresses and user IDs as short-lived counters) | EU |
| Sentry | Error monitoring | EU |
| Stripe (once billing is live) | Payment processing | US/EU |
Inside your organisation, its owner and admins can see team totals of how Orton is used: how many team objectives keep moving and how much progress is added. These are never shown per person, and counts from fewer than 3 people are hidden.
How long we keep it
- Active account data: kept while your account is active.
- Deleted/anonymised account data: personal fields removed as soon as we process your request.
- Free-tier objectives: soft-deleted after a period of inactivity, then hard deleted later — the exact windows are still being finalised alongside our plan limits.
- Activity and audit history: kept 12 months.
- When you last used Orton: kept while your account is active, and cleared if you ask us to erase your data.
- Weeks you mark “Nothing this week”: kept while your organisation exists, and deleted if you ask us to erase your data.
- Replies to our Friday progress email: we keep only the progress notes or quiet week they create, under the rules above, and never store the email itself. We keep a record that a reply arrived, with no content, for 7 days. Our email provider, Resend, keeps received emails for 30 days, then deletes them.
- Feedback, feedback requests and shared review packs: deleted after 24 months, or sooner if you or the person who shared them deletes them. Revoking a shared review pack deletes it immediately.
- Error reports (Sentry, EU region): kept for up to 90 days, then automatically deleted.
- Waitlist entries: held in Clerk; deleted on request, and cleared once everyone on the waitlist has been invited or the open beta starts.
- Session replays (only if you accept analytics cookies): kept in PostHog for 30 days.
- Beta survey answers: kept in PostHog for the life of the beta readout, then deleted or anonymised.
Your rights
You can ask us, at any time, to:
- Erase your personal data. We anonymise your account rather than deleting it outright, so your team’s objective history stays intact — attributed to “Former Member” instead of your name. Feedback and thanks you gave, and your feedback requests, are deleted, and so is your sign-in account. Your Personal space is deleted, with every goal and progress note in it, because nobody else shares it. Goals only you could see in an organisation stay with that organisation, attributed to “Former Member”. If you own a team organisation, you’ll need to transfer it or delete it first; we’ll contact you to arrange that. Analytics events linked to your account are deleted from PostHog too, which finishes removing them in a later batch. Page views and session replays from your browser aren’t linked to your account and expire under PostHog’s retention (replays after 30 days). None of them record your name or email address, the parts of page addresses that could identify you, or the text of what you click on.
- Export your data. We’ll send you everything personally associated with your account (your objectives, updates, and memberships) as a JSON file.
- Rectify inaccurate data — you can already edit most of your own data directly in the product.
- Object to processing based on legitimate interest, or withdraw consent for analytics cookies at any time.
To exercise any of these, email legal@orton.app. You can also complain to the UK Information Commissioner’s Office (ico.org.uk) if you think we’ve mishandled your data.
Changes to this policy
If we make a material change to this policy, we’ll email everyone with an account before it takes effect, and update the “Last updated” date above.