# Privacy Policy – Orshot - **URL**: https://orshot.com/privacy --- Legal # Privacy Policy Last updated October 9, 2026. ## Who we are Orshot is operated by [DaSkrad Ltd.](https://daskrad.com), a company registered in England and Wales (company number 16328476). We are the data controller for the personal data described here. Contact us about privacy at [hi@orshot.com](mailto:hi@orshot.com). ## What we don't do * Sell your data * Use your data to promote other products to you * Claim ownership of any content you generate (including AI-generated visuals, Orshot API generated images, PDFs, or videos) * Use your templates, uploads, renders or workspace data to train AI models ## What we collect * **Account data:** your name, email, sign-in details, workspace and team information. * **Billing data:** plan, invoices and payment status. Card details are handled by our payment provider and never stored by us. * **Your content:** templates, uploaded assets, brand kits, data you send to render, and the files you generate. * **Usage data:** API requests, render logs, errors, device and browser information, and how you use the app and website, including session recordings of the app and website. * **Connected accounts:** access tokens and the data you choose to use from integrations such as Google, social networks and storage providers. * **Support data:** messages you send us by chat or email. ## Why we use it * To provide the Services you signed up for, including rendering, workflows, integrations and AI features (performance of a contract). * To bill you, prevent fraud and abuse, and keep the Services secure (contract and legitimate interests). * To understand how Orshot is used and improve it, using analytics and anonymized usage data (legitimate interests, or consent where required). * To send account, billing and product emails. You can unsubscribe from non-essential emails at any time (legitimate interests or consent). * To meet legal, tax and accounting obligations. When you use Orshot through agent integrations (like our MCP server), basic account and usage information is shared with our team internally to improve reliability and the product, never for advertising. ## Public website information When you enter a website address, we read that public website and store brand information from it: the name, logos, colors, fonts, public images, page screenshots and a short business description. This comes from the public website, not from your account, and it is shared across workspaces so the same site is read once. We record which workspace asked for a read to apply usage limits. Brand owners can ask for their information to be corrected or removed at [hi@orshot.com](mailto:hi@orshot.com). ## Embedded editor When a customer puts the Orshot editor inside their own product (Orshot Embed), we record usage data about how their users use the editor, so the customer can see it in their analytics. For this data the customer is the controller and Orshot is the processor. It is deleted when the customer deletes it or closes their account. ## AI features When you use an AI feature, the prompt and any inputs it needs (such as an image, text or a voice script) are sent to the AI model provider that runs that feature, only to produce your result. We do not use your content to train AI models. ## Who we share data with We do not sell your data, rent it, or share it with third parties for advertising. We share it only in these cases: * With service providers that help us run Orshot, in these categories: hosting and infrastructure, payments, email, support and operations, analytics, ai model providers, social publishing. They process data on our behalf, under contract, only to provide their service to us. The current list is on our [sub-processors page](https://orshot.com/subprocessors). * With destinations you explicitly configure. If you set up a workflow or integration that sends a rendered file to your own storage, spreadsheet, social account or another connected app, we transfer that file to the destination you chose. * If required by law, legal process, or to protect the rights, safety, or security of Orshot and its users. * With a buyer or successor if our business is merged, acquired or sold, under the same protections. No category of your data is shared with data brokers or advertising networks. ## Google user data Orshot offers optional integrations with Google Drive, Google Sheets, and Google Forms. If you connect a Google account, we access only the data needed to run the features you configure: * **Google Drive:** we list the folders and files you select so your workflows can use them as a content source, read files from folders you choose (including new files added to those folders, when you set up a folder trigger), and upload rendered outputs to folders you pick. * **Google Sheets:** we read rows from spreadsheets you select to feed your workflows, and write results (such as render URLs) back to those spreadsheets when you configure it. * **Google Forms:** we read form questions and new responses from forms you select to trigger your workflows. Google user data is used solely to provide these user-facing features. Files read from Google Drive for rendering are stored temporarily in our Cloudflare R2 storage and deleted automatically within 3 days. We do not use Google user data for advertising, do not sell it, do not use it to train AI or machine learning models, and no human at Orshot reads it except with your permission for support, for security purposes, or where required by law. Google user data is shared, transferred, or disclosed only as described in the "Who we share data with" section above, and never with any other party. You can disconnect a Google integration at any time from your workspace settings, which revokes Orshot's access with Google and deletes the stored access tokens. You can also revoke access yourself from your [Google Account security settings](https://myaccount.google.com/permissions). Orshot's use and transfer of information received from Google APIs adheres to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. ## Shopify store data If you install the Orshot app from the Shopify App Store, we access only what the app needs to render files for your products: * **Products:** titles, descriptions, prices, variants, photos, tags, collections, vendor and type, to fill your templates, and product media and fields we add, to save the files you render. * **Files:** to upload rendered files to Shopify Files. * **Reviews and stock:** product review entries and inventory levels, when a template shows a rating or a stock label. * **Store details:** the store's domain, name, contact email and owner name, and the plan you pick through Shopify billing. Orshot does not access your orders or your customers' data. Access tokens are stored encrypted. When you uninstall the app, Orshot deletes the store's access tokens and pauses its workflows straight away. When Shopify asks us to erase a store's data (48 hours after uninstall), we delete the connection and the store's personal details, and keep only aggregate figures such as the Shopify plan and country. Files you rendered stay in your Orshot account and in your store until you delete them. ## Cookies and similar technologies We use cookies and similar technologies for three purposes: * **Essential:** keeping you signed in, security and remembering your settings. These are always on. * **Analytics:** understanding how the website and app are used, including session recordings, so we can fix problems and improve Orshot. * **Support and referrals:** the support chat, and tracking which partner or affiliate referred you. You can block or delete cookies in your browser settings. Blocking essential cookies will stop parts of Orshot from working. ## How long we keep data * Account data and your content are kept until you ask us to delete your account. Cancelling a subscription does not delete your data. * To delete your account and data, email us at [hi@orshot.com](mailto:hi@orshot.com). We handle deletion requests within the time the law requires, except for what we must keep for legal, tax or accounting reasons, or to resolve disputes and prevent abuse. * Logs and analytics are kept only as long as they are useful for running and securing the Services, then deleted or anonymized. * Temporary copies of files processed for rendering are deleted automatically on a short schedule (3 days for files fetched from connected sources). ## How we protect your data * All data is encrypted in transit using TLS (HTTPS) between your browser, our servers, and every connected service. * OAuth access tokens for connected integrations (including Google) are encrypted at rest with authenticated encryption before being stored, and are decrypted only at the moment a workflow or integration you configured needs them. * Sensitive data is accessible only to the systems that need it to run your workflows. Production database access is restricted and protected by row-level security, so each workspace can only access its own data. * When you disconnect an integration, the associated tokens are deleted. ## International transfers Some of our service providers process data outside the UK and the European Economic Area, mainly in the United States. Where that happens, we rely on adequacy decisions or on safeguards such as the UK International Data Transfer Agreement and the EU Standard Contractual Clauses. ## Your rights Under the UK GDPR and EU GDPR, you have the right to: * Access the personal data we hold about you * Rectify inaccurate personal data * Request erasure of your personal data * Restrict or object to processing of your data * Data portability * Withdraw consent at any time * Lodge a complaint with a supervisory authority To exercise these rights, contact us at [hi@orshot.com](mailto:hi@orshot.com). In the UK you can complain to the Information Commissioner's Office (ICO). **Data Processing Agreement:** where we process personal data on behalf of a customer, for example data inside templates or render requests, the customer is the controller and our [Data Processing Agreement](https://orshot.com/dpa) applies. ## Changes to this policy We may update this policy as Orshot changes. The date at the top shows the latest version. For material changes, we will email the account owner before they take effect.