Privacy Notice

This notice is effective from 11 October 2026. It explains what personal data Orishare LLC, a California limited liability company (“Orishare”, “we”), processes, why, and what rights you have. For people who use our dashboard and website (“users”) we are the controller. For the end users of our customers' programs (“players”) we act as a processor (a “service provider” under the CCPA) on the instructions of the organization that runs the program.

Users of Orishare

• Account data: name, email, sign-in provider id, role and organization memberships. Basis: performing the contract.
• Product usage: pages viewed and actions taken in the dashboard, tied to your user id, through PostHog hosted in the US. Autocapture is off. On the website we record only page views and signup clicks. Basis: consent where the law requires it, otherwise our legitimate interest in understanding and improving the Service.
• Support and billing: messages you send us, invoices, payment status. Card details are collected and held by Stripe, our payment processor; we never see the full card number. Basis: contract and legal obligations.
• Security logs: request ids, IP addresses and timestamps in operational logs for up to 30 days. Basis: legitimate interest in keeping the Service secure.

Users must be at least 18. The dashboard uses a session cookie to keep you signed in, and a PostHog cookie and browser local storage for product analytics.

Players of our customers

Organizations send us events, player identifiers and attributes to run their loyalty and rewards programs. We process this data on their instructions under the data processing terms. If you are a player, contact the organization you have a relationship with; it decides what is collected, how long it is kept, and whether it has the consent needed for any minors. On its instruction we export or delete your data through the API. Deletion redacts your attributes and events and removes your aliases; pseudonymous ledger entries are kept so the program's balances and financial history stay correct.

AI features

When someone uses the built-in AI assistant or asks for a rule draft, their message, together with the configuration and records the assistant needs to answer (which can include player identifiers and attributes), is sent to Anthropic through its API to generate the reply. For rule drafts, attributes flagged as personal data are excluded and values under personal-looking keys are redacted. Anthropic does not train on this data. AI tools you connect yourself (for example over MCP) are your own choice of provider.

Subprocessors

The current list is on the subprocessors page. We notify organization owners at least 30 days before adding one.

Retention

• Account data is kept while the organization exists. After closure there is a 30-day export window; we then delete or anonymize personal data unless the law requires us to keep it.
• Test event data is kept 30 days and live event data 90 days in the operational store, with history in an archive for as long as the organization keeps it.
• Database backups expire within 15 days, so deleted data leaves them by then.
• Invoices and payment records are kept for 7 years for tax and accounting.
• Support emails are kept for 3 years after the last message.
• Pseudonymous ledger entries remain after a player is deleted.

Your rights

Depending on where you live, you can ask to access, correct, delete or receive a portable copy of your personal data, to restrict or object to its use, and to withdraw consent you have given. You can also complain to your data protection regulator. To make any of these requests, including deleting your account, email support@orishare.com. We may need to verify your identity, or an authorized agent's authority to act for you.

California residents: we do not sell or share personal information, and we will not treat you differently for exercising your rights.

Contact

support@orishare.com