Privacy Policy

Application / Service: AI Orchestra (ORCHESTRA.AI) Website: https://ai-orchestra.net Privacy contact: ai_orchestra_main@ai-orchestra.net Effective: March 27, 2026

This Privacy Policy belongs to the AI Orchestra application and platform operated at ai-orchestra.net. It describes how we collect, use, store, and share data when you use our services, including Meta (Facebook / Instagram) integrations.

1. What We Collect

We collect the minimum data necessary to provide our services:

Account Data

• Telegram user ID, username, first and last name (received from Telegram upon authentication).
• Access session information (IP address, user agent) for security purposes.

Project Data

• Content you create: Mini App configurations, templates, products, media files.
• AI-generated content: videos, images, scripts, audio files.
• Chat history with the AI assistant within the Platform.

Payment Data

• Invoice records (amount, status, timestamps). We do not store card numbers or CVV codes; these are handled entirely by the payment provider.
• Subscription and token transaction history.

End-User Data (B2B2C)

• If you operate a Telegram bot through our Platform, we store messages between your bot and its end users for chat functionality.
• End-user Telegram IDs and basic profile data are stored to enable bot interactions.

2. How We Use Your Data

• To provide, maintain, and improve the Platform.
• To process payments and manage subscriptions.
• To enforce token usage limits and prevent abuse.
• To communicate important service updates.
• To comply with legal obligations.

3. Data Storage and Security

• Data is stored in managed PostgreSQL databases with encryption at rest.
• Sensitive credentials (API keys, bot tokens) are encrypted using AES before storage.
• Access to production systems is restricted and audited.
• Media files are stored in S3-compatible object storage.

4. Third-Party Services

We use the following third-party services that may process your data:

• Telegram — bot and Mini App integration.
• Bank CenterCredit (BCC) — payment processing.
• xAI (Grok), RunwayML, ElevenLabs — AI content generation (prompts and generated content are sent to these providers).
• Meta Platforms (Facebook, Instagram) — see Section 4a below for full disclosure of Meta Graph API usage.

Each provider operates under its own privacy policy.

4a. Platform integrations (social networks and ad platforms)

When you connect a third-party social or ad platform from inside AI Orchestra, we only read and write data on your behalf in service of the feature you explicitly enabled, and we follow the principle of incremental authorization (we ask for one permission only when you trigger the action that needs it). Each integration has its own dedicated disclosure document covering data we read, data we write, what we store, what we never do, the exact permissions we request, and how to revoke access:

• Meta (Facebook, Instagram) — full disclosure: Meta Platform Integration. Technical reference: /meta-permissions.
• TikTok — full disclosure: TikTok Integration.
• YouTube — full disclosure: YouTube Integration.

If you have not connected an integration, none of the data described in those documents is collected.

Data retrieved from any connected third-party platform (Meta, TikTok, YouTube) is governed by that platform's developer terms and is never sold, licensed, rented, transferred, or otherwise monetized — in any form, including anonymized, de-identified, or aggregated derivatives. We do not transfer Platform Data to ad networks, data brokers, or other advertising / monetization services. Aggregated or anonymized analytics we derive from Platform Data are used solely to operate and improve AI Orchestra for the originating user, in accordance with each provider's developer terms.

5. Data Retention

• Account data: retained while your account is active, plus 30 days after deletion.
• Generated content: retained until you delete it or your account is terminated.
• Payment records: retained for 3 years for legal/accounting compliance.
• Server logs: retained for 90 days.

6. Your Rights

You have the right to:

• Access your personal data stored on the Platform.
• Request correction of inaccurate data.
• Request deletion of your account and associated data.
• Export your project data.

To exercise these rights, contact us at ai_orchestra_main@ai-orchestra.net.

7. Cookies and Tracking

We use a session cookie for authentication. We do not use third-party advertising trackers. We may use analytics to understand Platform usage patterns.

8. Children's Privacy

The Platform is not intended for users under 18. We do not knowingly collect data from minors.

9. Changes to this Policy

We may update this Privacy Policy. The "Effective" date at the top will be updated accordingly. Continued use constitutes acceptance.

10. Contact

For privacy-related inquiries: ai_orchestra_main@ai-orchestra.net.