Privacy Policy

How Orrumai collects, uses and protects your data, and the choices you have over it.

Effective date: 1 September 2026
Last updated: 23 October 2026

1. About this policy

This policy explains what personal data Neelabh Suhas Katte, trading as Hiranyavarna (“Orrumai”, “we”, “us”) collects when you use the Orrumai project management software and this website; why we collect it; who we share it with; and the rights you have over it.

This policy covers Orrumai only. The same proprietor operates other products under other names, each with its own privacy notice.

“Personal data” means information that identifies you or can be linked to you: your name, email address, role, hourly rate, the hours you log, your IP address, and your support correspondence. Anonymised data that cannot be linked back to you is outside this policy.

Contact us anytime:
Neelabh Suhas Katte, trading as Hiranyavarna
7, Tara Apt, Sharanpur Road, Tilakwadi, Nashik - 422002, Maharashtra, India
contact@orrumai.com
www.hiranyavarna.com

2. Two different roles: your data, and your organization’s data

When we handle data about you as our customer (the account your organization holds with us, its billing, its support requests) we are the controller, and this policy governs it.
When we handle the data an organization puts into Orrumai (its people, their rates, timesheets and time off, its customers, projects, tasks, expenses and files) the organization is the controller and we are its processor. We hold and process it only to provide the service to that organization. We never sell it and never use it to market to anyone.

If you are a member of an organization’s workspace and have a question about the data held about you there (your hours, your rate, your time off), your organization is the one to ask first, because it decides what is recorded. We will direct requests to it, and help it answer them.

A Data Processing Agreement is available on request from contact@orrumai.com.

3. What we collect

Data you or your organization give us

Account and identity: name, email address, password (stored hashed, never in plain text), and your role in each organization you belong to.
Organization settings: organization name, currency, logo, holidays, expense categories, task statuses, and each member’s cost rate and weekly hours.
Work records: customers, projects, phases, tasks, assignments, dependencies, baselines, timesheets and their approvals, time off, expenses and notes.
Invitations: the name and email address of people your admins invite.
Billing: the billing contact, address and invoices for your organization’s contract. We do not take card payments in Orrumai and never see or store card numbers or bank credentials.
Support and enquiries: the content of the emails you send us and anything you attach.

Our terms ask you not to enter payment card numbers, personal identity numbers, health information or biometric data into any field.

Data we collect automatically

IP address, browser and device type
Sign-in attempts (successful and failed), with time, IP address and browser
The session cookie that keeps you signed in, and the security token that protects forms
Application and error logs, and our web server’s access logs
On our public website only (the home, contact, privacy and terms pages): Google Analytics records the pages you visit, how you arrived (for example from a search or a link), your approximate location, and your device and browser; the Meta Pixel tells Meta that your browser visited a page; Microsoft Clarity records how you scroll, click and move around the page. See section 6.

Data from third parties

Cloudflare Turnstile tells us whether the registration or password-reset form was filled in by a person rather than a bot. We receive the result, not a profile of you.

4. Why we use it, and our legal bases

Providing the service, hosting your organization’s data, signing you in: performance of a contract.
Notifications (a task assigned to you, or a change of status on a task you are on), in the app or by email as you choose: performance of a contract.
Billing under your organization’s contract: performance of a contract; legal obligation.
Support and answering your enquiries: performance of a contract; legitimate interests.
Security: rate limits, bot checks, sign-in records, abuse prevention: legitimate interests.
Website analytics on our public pages, to see how people find Orrumai and which pages help them: legitimate interests.
Seeing how people use our website (Microsoft Clarity's heatmaps and session replays), to find what's confusing or broken on our public pages: legitimate interests.
Measuring and targeting our advertising on Meta (Facebook, Instagram), from visits to our public pages: legitimate interests. You can opt out at any time (section 6).
Service email (verification codes, invitations, password resets, security and policy notices): performance of a contract; legal obligation.
Keeping billing records for tax and accounting: legal obligation.

What we never do with your data

We never use your data to train a model that benefits us or another customer. If Orrumai gains AI features, we may run your data through a model, sometimes one run by a third-party provider on our behalf, to give you a result. Your data never trains a model that serves anyone but you, and changing that would take a policy change, fresh notice and your opt-in.
We never sell the contents of your workspace, never use them for advertising, and never share them with an advertising platform.
Nothing inside Orrumai is tracked. The app, every page you see once signed in, loads no analytics, advertising pixels or session recording. Our public website uses Google Analytics, the Meta Pixel and Microsoft Clarity (section 6).

5. Who we share it with

We do not sell personal data. These providers process it on our behalf:

Linode (Akamai Technologies): application and database hosting; holds all customer data. Los Angeles, California, USA.
Amazon Web Services (Amazon SES): delivery of service and notification email. Oregon, USA.
Cloudflare (Turnstile): bot protection on the registration and password-reset forms. US and global.
Google (Google Tag Manager and Google Analytics): Tag Manager loads the analytics and advertising tags below; Analytics gives us visit statistics for our public website, public pages only, never inside the app. US and global.
Microsoft (Clarity): heatmaps and session replays of our public website, public pages only, never inside the app. US and global.
Meta (Meta Pixel): measuring our advertising and showing our ads to people who visited our public website, public pages only, never inside the app. US and global.

Client share links. When someone in your organization creates a share link, anyone with that link (and the passcode, if one is set) can see that project’s plan: phases, tasks, the people on them, milestones and what is waiting on the client. Share pages never show budgets, costs, rates or hours. Your organization decides who gets a link and can revoke it at any time.

We also share data with professional advisers under confidentiality; with authorities where legally required, telling you unless we are prohibited from doing so; with an acquirer if the business is sold, merged or restructured, subject to this policy continuing to apply; and with anyone else only with your consent.

6. Cookies

Inside Orrumai (once you are signed in) we set only strictly necessary cookies: the session cookie that keeps you signed in, and, if you tick “Remember me”, a cookie that keeps you signed in on that browser. Cloudflare Turnstile, on the registration and password-reset forms, may set cookies of its own to tell people from bots.

On our public website (the home, contact, privacy and terms pages) Google Tag Manager loads the three tags described below; Tag Manager itself sets no cookies. We use Google Analytics to count visits and see how people find us. It sets cookies (named _ga and _ga_…) that recognise a returning browser for up to two years, and sends Google the page, the referring site, and your browser, device and approximate location. We use the results only in aggregate, to improve the website; we do not use them to identify you or for advertising. You can block these cookies in your browser’s settings, or with Google’s opt-out add-on, and the website works the same. Google’s own use of the data is described at policies.google.com.

The same public pages load the Meta Pixel. It tells Meta (the company behind Facebook and Instagram) that your browser visited a page of our website, so we can measure whether our ads work and show our ads to people who have visited us. It sets a cookie (named _fbp) for up to 90 days, and Meta may link the visit to a Facebook or Instagram account you are signed in to.

We also use Microsoft Clarity on the same public pages. It records how visitors scroll, click and move around a page, which we see as heatmaps and as replays of individual visits, so we can find what is confusing or broken. Clarity masks text you type into fields, and it never runs inside the app. It sets cookies (named _clck and _clsk) that recognise a returning browser for up to a year. Microsoft’s use of the data is described in its privacy statement.

We do not sell your personal data for money. We should be plain about one thing, though: the Meta Pixel sends your visits to our public pages to Meta, and Meta may combine them with what it already knows about you. Some US state privacy laws call that “sharing” for advertising, even though no money changes hands. It never touches anything inside your Orrumai workspace.

How to opt out: turn on Global Privacy Control in your browser (built into Firefox, Brave and DuckDuckGo, and available as an extension for others) and our website will not load the Meta Pixel at all. You can also block third-party cookies in your browser, or change how Meta uses this data in your Facebook or Instagram ad preferences. Opting out costs you nothing: every page works the same.

7. Security

We protect personal data with:

Encryption in transit: HTTPS/TLS across the site, and TLS to our email provider
Hashed passwords, never stored in plain text
Email verification for new accounts, and sign-up by invitation
Organization-scoped access, so a member sees only the organizations they belong to, and roles, so only managers and above see costs and rates
Rate limits and bot checks on sign-in, registration, password resets and invitations
Limited production access: the server accepts key-based logins only, from the people who run it

We describe what we actually do rather than list reassuring measures we have not put in place. To be specific: the database is not separately encrypted at rest, and two-factor sign-in is not available yet. Use a strong, unique password.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach affects your personal data, we will tell you and notify the relevant authorities as the law requires.

8. Where your data lives, and international transfers

Your data is stored in the United States, on Linode (Akamai Technologies) infrastructure in Los Angeles, California. Our email is delivered through Amazon SES in Oregon.

We operate from India. We are based in Nashik, Maharashtra, and we access those systems from India to run, support and maintain the service. That access is itself an international transfer of your personal data, and we would rather state it plainly than leave it implied.

Where personal data protected by European or UK law is transferred, we rely on the European Commission’s Standard Contractual Clauses and the UK Addendum, and on the equivalent terms in our providers’ own data processing agreements.

9. How long we keep data

Account and organization data: for as long as the organization’s account is open.
Work records (projects, tasks, timesheets, expenses): for as long as the account is open; after it ends, kept and available for export for 90 days, then deleted.
When one person deletes their own account: their sign-in is removed and their name is erased at once. The hours and expenses they logged stay with the organization, without their name, because they are the organization’s records of work done.
Billing records: 8 years, the longer of the two periods Indian law requires: 8 years (income tax) and 6 years / 72 months (GST).
Support correspondence: 2 years after the conversation ends.
Sign-in records, server and error logs: 12 months.

10. Deletion

You can delete your own account at any time from your profile (Delete my account). An organization can ask us to delete all of its data by emailing contact@orrumai.com from an admin’s address. We will delete it from our live systems within 30 days, keeping only the records the law requires (section 9).

Deletion is permanent and cannot be reversed. Export what you need first.

We verify who is asking. Before we act on a request to export or delete an organization’s data, we confirm it comes from that organization’s admin, usually by requiring it to come from, or be confirmed at, the admin’s email address.

11. Your rights, wherever you live

We give the same rights to everyone who uses Orrumai, regardless of country or state. You may ask us to:

Access the personal data we hold about you, and receive a copy
Export it in a machine-readable format (we will send it within 30 days)
Correct anything inaccurate or incomplete; you can change your name and email yourself in your profile
Delete your data
Restrict or object to how we process it
Choose your notifications: in the app, by email, or not at all, per event, in Profile → Notifications
Complain to a data protection authority in your country

For data your organization holds about you, we will pass the request to your organization and help it answer. Otherwise email contact@orrumai.com. We will acknowledge promptly and respond within 30 days. We do not charge for these requests, and we will never treat you differently for making one.

If you are in the EEA, the UK or Switzerland

The GDPR applies to you, and the rights above are your rights under Articles 15–22. Our legal bases are in section 4; international transfers are in section 8; the controller is named at the top of this policy. We make no decisions about you by automated means alone that have legal or similarly significant effects. You may complain to your local supervisory authority, or to the UK Information Commissioner’s Office.

If you are in the United States

Several US states give residents rights over their personal data. We extend the rights above to everyone, including the right to know what we hold, to have it deleted or corrected, and to receive a copy. We do not sell personal data. Our public website shares visit data with Meta for advertising, which you can stop with Global Privacy Control as described in section 6; we honour that signal automatically.

12. Children

Orrumai is for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 16. If we learn that we have, we will delete it.

13. Changes to this policy

We may update this policy. If we make significant changes we will notify your organization’s admins by email at least 30 days before they take effect.

14. Contact

Neelabh Suhas Katte, trading as Hiranyavarna
7, Tara Apt, Sharanpur Road, Tilakwadi, Nashik - 422002, Maharashtra, India
contact@orrumai.com
www.hiranyavarna.com