Privacy Policy
Effective October 31, 2026
The short version: we use your information to build, host and bill for your website, and for nothing else. We don’t sell it or use it for advertising. Your messages and site content are sent to our AI provider so it can make your edits. Visitors to your site aren’t tracked: we count visits without cookies and never build profiles of people. You can download or delete everything from your Account page at any time.
1. Who we are
OrngPages (“OrngPages”, “we”, “us”) is an online service that lets small businesses build and run a website by chatting with an AI assistant. OrngPages is operated by a sole proprietor based in Pakistan. For your account data we are the data controller. You can reach us about anything in this policy at [email protected].
This policy covers our website and app (the “Service”) and the websites our customers publish with it. It works together with our Terms of Service.
2. Owners and visitors
We handle two kinds of personal information, in two different roles:
- Owners are the people who sign up and build a site. For owner accounts we decide how the information is used, so we are the controller.
- Visitors are people who view a site built with OrngPages, or fill in its contact form. The business that owns that site decides what to do with the enquiries it receives, so the business is the controller and we act as its processor. If you sent an enquiry to a business, please contact that business first about your information. If you can’t reach them, write to us and we’ll help.
- Buyers are people who order from a site built with OrngPages. The site’s owner is responsible for your order details and how they’re used; we store and process them for the owner. Questions about an order, or requests to see or delete your details, go to the business you ordered from. You can also contact us and we’ll pass it on.
3. What we collect
Information you give us
- Account details: your email address and password. We store only a secure hash of the password, never the password itself.
- Sign in with Google: if you use it, Google tells us your name, email address, whether Google has confirmed that email, and your Google account’s ID. We use them only to sign you in and keep that sign-in linked to your account. We don’t get your Google password, contacts or anything else in your Google account.
- Business details: what you tell us during setup and in chat, such as your business name, services, prices, opening hours, location, phone number and social links.
- Chats and files: your conversations with the AI assistant, and any images, logos or other files you upload or attach.
- Your sites: the pages, text, code, theme and version history of every site you build, and any custom domain you connect.
- OrngBot’s memory: what you give your chat assistant to answer from: your site’s pages, other websites you point it to (we fetch their public pages), and the text, files and logo you add. You can remove any of it at any time.
- Alert settings: if you turn on lead alerts by text message, WhatsApp or browser notification, the phone number or browser subscription needed to send them.
- Billing: your plan, invoices and credit history. Card details are entered on Lemon Squeezy’s secure checkout and go straight to Lemon Squeezy. We never see or store your full card number. Lemon Squeezy sends us your name, email, country and the details of your orders, subscription, refunds and disputes.
- Your existing website: if you give us the address of a site you already have, we fetch its public pages and images to use in your first build.
- Messages to us: anything you send when you contact support or ask about the Custom plan.
Information visitors give through your site
- Enquiries: what a visitor types into your site’s contact form (for example their name, email, phone number and message), plus the page it came from. We store each submission as a notification and send it to you by email and optional phone alerts.
- Orders: when someone orders from a store built with OrngPages: their name, email, phone number (optional), delivery address (for delivery or shipping), any note they add, what they ordered and the totals, how they chose to pay and whether it’s been paid, and when they ordered. Their IP address is kept only as a short-lived count for spam limits, not stored with the order. Card details are typed on Stripe’s page; we never see or store a card number.
- Visits (Analytics): we count visits to your site per day: which pages were viewed, where the visit came from (the name of the referring site, like Google or Instagram, and any campaign tags in the link, never the full address), the country, and the type of device and browser. To count each person once a day, we combine their IP address and browser with a secret that changes every day into a scrambled code. The code is held for at most 30 minutes after a visitor’s last page, only to tell one visit from the next, and is never written to our database. The secret is deleted after two days, so old codes can’t be worked out again. We never store the IP address or the browser details. Nothing is stored on your visitors’ devices and no cookies are set. We also count taps on your phone number, and which visits led to a lead, an order or a sign-up, as totals.
- OrngBot chats: if you add our chat assistant to a website, we store what visitors ask it and its answers, the page they asked from, their country, and a random ID kept in their browser’s local storage so a conversation continues across pages. No cookies are set. If a visitor leaves their details for you, we store their name, email and message and send them to you by email.
- Search engines: we count how often search engines and AI assistants fetch your pages, by their name. If you paste a verification tag from a search engine, we add it to your pages.
Information collected automatically
- Technical logs: like any web service, our servers log requests, including IP address, browser type and time, to keep the Service secure, stop abuse and fix problems.
- Error reports: when something breaks, our error monitoring tool receives details of the error and the browser or server it happened in.
- Spam protection: sign-up, contact and order forms may use Cloudflare Turnstile, which checks signals from the browser to tell people from bots.
- Sign-up checks: when you sign up we look at the network your IP address belongs to and check that your email domain can receive mail and isn’t a throwaway service. We use this only to give free welcome credits once per person and to stop abuse.
4. How we use it, and why we’re allowed to
We use personal information to:
- create and run your account, build and host your sites, deliver leads to you and send the alerts you ask for (to perform our contract with you);
- take payments, keep records for tax and accounting, and respond to lawful requests (to meet legal obligations);
- keep the Service secure, prevent fraud, spam, chargebacks and repeat sign-ups for free credits, help you when you contact support, fix bugs, measure how features perform, and improve the Service (our legitimate interests, which we balance against your rights);
- send you service emails, such as verification codes, lead alerts, receipts and important changes. We don’t send marketing email unless you’ve agreed to it, and every marketing email lets you unsubscribe (consent).
We do not sell personal information, share it for cross-context behavioural advertising, or use it to build advertising profiles.
5. How the AI uses your information
To make an edit or answer a question, the Service sends the AI model the information it needs: your message and any attachments, your site’s files and theme, your project details. After design work we may also send screenshots of your pages so the model can check its result.
The AI models are run by third-party AI providers. We reach them through OpenRouter, and we only send requests to model hosts that, under their published policies, don’t keep or train on the data we send. They process it only to return a response to us. We don’t use your content or your leads to train AI models. The AI can make mistakes, so please check what it produces before you publish.
OrngBot answers a visitor by sending the AI model their question, the last few messages of the conversation and the parts of your information it found relevant (your website’s pages, the text and files you added). The same providers and rules apply.
When the assistant looks for stock photos, the search words it uses (for example “bakery storefront”) are sent to Pexels. Your personal details are not.
8. International transfers
We operate from Pakistan, and our service providers process information in other countries, including the United States, the European Union and the countries where AI model hosts run their models. When we transfer personal information out of the European Economic Area, the United Kingdom or Switzerland, we rely on safeguards the law recognises, such as the European Commission’s Standard Contractual Clauses and the UK’s addendum to them.
9. How long we keep it
- While your account is open we keep your account, sites, chats, files and leads so the Service works. You can delete a site, with its leads, at any time. To remove a single lead, email us.
- When your plan ends the site you published most recently stays live on Free; we keep your other sites and their data for 90 days, then delete them. On the Free plan, sites are deleted after 12 months without a sign-in or any use. We email you before either happens; your account stays.
- OrngBot conversations are deleted after 90 days. Details a visitor left for you are kept until you delete them or your bot.
- Deleted sites can be restored for 7 days. After that they are permanently deleted, together with their files, chats and leads.
- Orders are kept while the store exists so the owner has their records, and are deleted with the site or the owner’s account, or when the owner’s plan has ended as described above. Orders that are never confirmed are closed after 24 hours.
- Published versions of a site: we keep the most recent 10 so you can roll back, and remove older ones automatically.
- When you delete your account we cancel any subscription and delete your account, sites, chats, files and leads. Copies in our backups are overwritten on their normal cycle, within 35 days.
- Billing records, including your credit history, refunds and disputes, are kept as long as tax and accounting law requires, usually up to 10 years.
- Server logs and error reports are kept for up to 90 days, unless we need them longer to investigate abuse or a security issue.
10. Your rights and choices
Depending on where you live (including under the EU and UK GDPR and US state laws such as California’s CCPA), you may have the right to:
- access the personal information we hold about you and get a copy of it;
- correct information that is wrong;
- delete your information;
- receive your information in a portable format;
- object to, or ask us to restrict, certain processing;
- withdraw consent at any time, where we rely on consent;
- not be treated differently for using these rights.
You can do the most common things yourself on the Account page: download a full export of your data, change your details and alert settings, or delete your account. For anything else, email [email protected]. We’ll answer within 30 days, and we may ask you to confirm your identity first.
If you’re in the EU, the UK or Switzerland and you’re unhappy with how we handle your information, you can also complain to your local data protection authority. We’d appreciate the chance to put it right first.
Visitors and buyers: to access or delete an enquiry or an order, contact the business you sent it to. If you can’t reach them, email us and we’ll help.
11. If you collect leads or orders with your site
When your site collects enquiries or orders, you’re responsible for using them lawfully: answer the people who contacted you, don’t send them marketing they didn’t agree to, and respond to their privacy requests. Depending on your location and business, you may need a privacy notice of your own on your site. We process your leads only on your instructions and to provide the Service, as described in our Terms of Service. Your store comes with a policies page that explains this to buyers. Fill in the marked details and keep it accurate.
Please don’t use your site’s forms to collect sensitive information, such as health, financial account or government ID details.
12. Security
We protect your information with encryption in transit (HTTPS), hashed passwords, access controls and regular reviews. No online service can be perfectly secure, so please use a strong, unique password. If a breach affects your personal information, we’ll tell you and the relevant authorities as the law requires.
13. Children
OrngPages is a service for businesses and is not meant for children. You must be 18 or older to create an account. We don’t knowingly collect information from children under 16. If you believe a child has given us information, contact us and we’ll delete it.
14. Changes to this policy
We’ll update this policy when the Service or the law changes. The effective date at the top shows when it last changed. If a change materially affects how we use your information, we’ll email you before it takes effect.
15. Contact us
Questions, requests or complaints about privacy: [email protected].