Last updated:February 6, 2026
1. INTRODUCTION
Orsana respects your privacy and is committed to protecting your personal data. This Privacy Notice explains how we collect, use, and safeguard your information when you visit our website and use our AI-powered content generation services for LinkedIn.
2. DATA ROLES & SCOPE
- Orsana as Data Controller: we are the Controller for your Account Data, including email, billing, and site usage. We decide how this data is used to provide the service.
- Orsana as Data Processor: we are the Processor for User Content, including your prompts, inputs, and data pulled from LinkedIn. You are the Controller of this data; we only process it to follow your instructions. Our processing of User Content is governed by our Data Processing Agreement (DPA).
3. DATA WE COLLECT
We collect several types of information to provide and improve our Services:
- Identity & Contact Data: name, email address, and account credentials.
- Social Media Data: when you link your LinkedIn account, we access public profile information and content. We read public data only and never ask for your LinkedIn password or session cookies.
- User Content: the text, prompts, and ideas you input into our AI to generate posts.
- Usage & Technical Data: IP address, browser type, time zone, and how you interact with our platform, collected via cookies.
- Billing Data: for paid subscriptions, our third-party processor Stripe collects your payment details. Orsana does not store your full credit card information.
4. HOW WE USE YOUR DATA
Under GDPR, we only process your data when we have a legal basis:
- Performance of a Contract: to create your account, process payments, and generate AI content.
- Legitimate Interest: to improve our AI models, ensure platform security, and prevent fraud.
- Consent: for marketing communications, such as newsletters, and the use of non-essential cookies.
5. SUB-PROCESSORS
To provide our AI features, we share User Content with third-party sub-processors, including AI model providers. Unless otherwise stated, these providers are contractually prohibited from using your data to train their global models and must maintain security standards equivalent to ours.
6. INTERNATIONAL DATA TRANSFERS
Your data privacy is our priority. Orsana processes and stores your personal data exclusively on secure servers located within the European Economic Area (EEA), primarily in France. At this stage, we do not transfer your personal data to countries outside the EEA. Should our infrastructure requirements change in the future to maintain the quality and innovation of our AI services, we will update this policy and ensure all necessary legal safeguards are in place to protect your information.
7. DATA RETENTION
We keep your data only as long as necessary:
- Account Data: retained for the duration of your active subscription.
- AI Inputs/Outputs: retained for 30 days to allow you to retrieve your work, unless you choose to delete it sooner.
- Legal Obligation: some billing data is kept for 10 years to comply with French tax laws.
8. YOUR RIGHTS
As a user, and in accordance with GDPR, you possess certain rights regarding your personal data. These rights are subject to specific legal conditions and limitations.
- Exercise of Rights: to the extent provided by applicable law, you may request access to, correction of, or deletion of your personal data. You may also have the right to object to or restrict certain processing activities, or request the portability of your data to another service.
- Procedure: any such request should be sent to hello@useorsana.com. To protect your privacy and security, we may take reasonable steps to verify your identity before granting access or making corrections.
- Legal Framework: these rights are not absolute; we may be required to retain certain information to fulfill our legal or contractual obligations, such as billing records for French tax authorities.