Privacy Policy
Effective date: 25 September 2026 · Last updated: 29 September 2026
ORQADOS ("ORQADOS", "we", "us" or "our") provides an AI-assisted business communication, workflow and orchestration platform operated from Singapore and available through orqados.com, app.orqados.com and related services.
This Privacy Policy explains how personal data is collected, used, disclosed, processed, retained and protected in connection with ORQADOS. It applies to:
- visitors to our public websites;
- customers and authorised users of an ORQADOS workspace ("Customers" or "Users"); and
- individuals whose personal data is processed within a Customer's workspace, such as leads, clients, agents, employees and other business contacts ("Contacts").
Where ORQADOS processes personal data solely on behalf of a Customer and for that Customer's purposes, the Customer generally determines the purposes and means of that processing and ORQADOS may act as a data intermediary or equivalent service-provider/processor role. Where ORQADOS processes personal data for its own account administration, security, billing, support, legal compliance or service-operation purposes, ORQADOS may act as the organisation responsible for that processing.
1. What ORQADOS does
ORQADOS helps businesses manage communication, relationships and workflows. Depending on the Customer's configuration, ORQADOS may provide: WhatsApp messaging through Meta's WhatsApp Business Platform; lead and contact management; nurture and outreach workflows; calendar scheduling; business knowledge management; Google Calendar and Google Sheets integrations; AI-assisted message drafting, summaries, classifications and suggestions; workflow approvals; human handover; audit and operational records; and other business-orchestration functionality.
Feature availability depends on the Customer's plan, configuration, connected services and provider availability.
2. Categories of personal data we process
Depending on how the Service is used, we may process the following categories of personal data.
Account and user data
This may include: name; business email address; mobile number; workspace role; organisation or business-unit information; authentication/session information; and account preferences.
Contact and relationship data
Customers may provide or connect data relating to their leads, clients, agents and other business contacts, including: name; mobile number; email address; company or agency; relationship type; business role; lead source; communication preferences; consent and opt-out status; notes; and other Customer-provided relationship information.
Message and conversation data
Where a Customer uses supported communications features, ORQADOS may process: messages sent and received; message timestamps; message identifiers; delivery status; read status; reply status; template information; conversation state; and related communication metadata.
Google-connected data
Where a Customer explicitly connects supported Google services, ORQADOS may process data necessary for the enabled feature, such as: Google Calendar event information; calendar availability; event titles, times, locations and attendees where required for the feature; spreadsheet rows or fields read from Google Sheets spreadsheets selected or nominated by the Customer; and, where the Customer connects their own YouTube channel, the channel identity and the video content the Customer approves for publishing. See section 6 for further detail.
AI processing context
Where AI-assisted features are used, relevant portions of message content, contact context, Customer-provided knowledge, workflow instructions and conversation history may be processed to generate drafts, summaries, classifications, recommendations or conversational responses.
Technical and security data
This may include: timestamps; request identifiers; IP address where captured for security or operational purposes; browser/device information where available; error logs; security events; audit events; performance information; and operational diagnostics.
Cookies
ORQADOS uses cookies or similar technologies that are necessary for authentication, session management and security. ORQADOS does not currently use third-party advertising cookies within the ORQADOS application. If analytics or non-essential cookies are introduced in future, this Policy and any required consent controls will be updated before deployment.
3. How personal data enters ORQADOS
Personal data may be provided to ORQADOS: directly by a workspace user; through manual data entry; through Customer-authorised file or spreadsheet imports; through connected third-party services; through inbound messages; through Customer-authorised WhatsApp integrations; through API/webhook events from connected providers; or through other Customer-authorised integrations.
The Customer is responsible for having the appropriate authority, consent or other lawful basis to provide personal data to ORQADOS. Importing a contact, assigning a relationship category or using AI-assisted classification does not itself establish marketing consent.
4. WhatsApp and Meta platform data
ORQADOS integrates with Meta's official WhatsApp Business Platform. When a Customer connects a supported WhatsApp account or phone number, ORQADOS may process message content, sender and recipient identifiers, phone numbers, timestamps, template information, message delivery and read events, replies, opt-out instructions and related provider metadata to provide messaging and communication features.
Use of WhatsApp functionality is also subject to Meta's applicable terms, policies and privacy practices.
Where WhatsApp policy requires an approved message template for a business-initiated message, ORQADOS uses an eligible provider-approved template through supported workflows.
Recipients may opt out of further messaging by using supported opt-out methods, including clear requests not to be contacted. Valid opt-out and do-not-contact instructions are enforced through ORQADOS's central suppression controls.
5. WhatsApp Business App Coexistence
Where a Customer connects an existing WhatsApp Business App number using Meta's officially supported Coexistence onboarding, ORQADOS may receive additional information made available by Meta through that onboarding or subsequent supported events. This may include, where supported by Meta and authorised by the Customer: synchronised contact information; synchronised conversation information; message-echo or related events for messages sent through the WhatsApp Business App; and other metadata made available through the supported Coexistence integration.
The exact categories and availability of such data depend on Meta's current product capabilities and the permissions selected during onboarding.
Where historical or contact information is imported into ORQADOS for classification or review, ORQADOS holds it in a staging or review state before it is incorporated into active outreach or nurture workflows. Imported or synchronised data does not automatically establish marketing consent and does not automatically enrol a person into outreach or nurture.
6. Google user data
When a Customer connects Google services, ORQADOS accesses only the Google user data required for the specific features the Customer enables and only through the permissions granted by the user.
Google Calendar
ORQADOS may access calendar information required to: read relevant calendar events; determine availability; create, update or manage events where the Customer has authorised those actions; and support scheduling features.
Google Sheets
ORQADOS reads Google Sheets on a read-only basis, limited to spreadsheets the Customer chooses to share with the ORQADOS reader account (in the same way the Customer would share a spreadsheet with a colleague), to: import contact, lead or agent information; or read operational data required for enabled workflows. ORQADOS does not ask users to sign in with Google for Sheets, never edits a shared spreadsheet, and does not access the Customer's Google Drive generally. The Customer can stop access at any time by removing the ORQADOS reader account from the spreadsheet's sharing settings.
YouTube publishing
Where a Customer connects their own YouTube channel, ORQADOS may access the information required to identify that channel and to upload video content the Customer has created and approved to that channel. ORQADOS does not publish to a YouTube channel unless the Customer has first connected the account and authorised access, and, where a workflow includes an approval step, publishing occurs only after the Customer explicitly approves the specific content. ORQADOS does not read a Customer's YouTube viewing history and does not access channels the Customer has not connected.
Limited Use. ORQADOS's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.
Google user data: is used only to provide or improve the Customer-facing features requested by the user; is not used for third-party advertising; is not sold for advertising purposes; is not used to train general-purpose AI models; and is shared only where necessary to provide the requested feature or where required by law.
AI and Google user data
Google user data - whether raw, aggregated, anonymised or derived - is never used by ORQADOS, or by any provider ORQADOS works with, to create, train or improve generalised or foundational artificial-intelligence or machine-learning models.
Where an ORQADOS feature applies AI to Google user data (for example, understanding the notes column of a lead spreadsheet the Customer shared, or checking the user's own calendar availability to arrange an appointment), that data is processed only by OpenAI through the OpenAI API platform, solely to perform the requested feature. Under OpenAI's API business terms, data submitted through the API is not used to train OpenAI's models. No other AI provider receives Google user data.
Customers may revoke Google access through ORQADOS where supported, or through their Google Account permissions.
7. AI processing
ORQADOS uses third-party AI services to provide features such as drafting, summarisation, classification, recommendation, knowledge-assisted responses and conversational assistance.
Only data reasonably relevant to the requested AI function is sent to the applicable AI service. Depending on the feature, this may include message content, conversation context, contact information, Customer-provided business knowledge and workflow instructions.
ORQADOS selects AI providers and service configurations intended for business use and applies contractual and technical controls appropriate to the service. ORQADOS does not intentionally permit Customer Data submitted through the Service to be used by its AI service providers to train general-purpose models where the applicable provider configuration and contractual terms prohibit such training.
8. Purposes for which we use personal data
We may process personal data to:
- provide and operate the Service;
- authenticate users and manage workspaces and permissions;
- provide messaging and workflow functionality and process Customer-authorised communications;
- support calendar and productivity integrations;
- provide AI-assisted features;
- maintain contact, consent and opt-out records and enforce do-not-contact and suppression rules;
- provide human handover and approval workflows;
- maintain audit and operational records;
- provide customer support;
- detect, investigate and prevent security incidents, fraud and abuse;
- maintain service reliability and troubleshoot errors;
- administer billing and subscriptions;
- comply with law and regulatory requirements;
- establish, exercise or defend legal claims; and
- generate aggregate or de-identified operational metrics.
Where ORQADOS processes Customer Data solely on a Customer's behalf, the Customer determines the relevant business purpose.
9. Sale and advertising
ORQADOS does not sell personal data for monetary consideration or use Customer Data for third-party behavioural advertising. ORQADOS does not operate an advertising business based on Customer Data.
This does not prevent: disclosures required by law; disclosures to service providers necessary to operate ORQADOS; corporate restructuring, merger, financing, acquisition or sale transactions subject to appropriate confidentiality and legal protections; or other processing disclosed in this Policy.
10. Disclosure and service providers
ORQADOS may disclose personal data to selected service providers and connected platforms where necessary to operate the Service. Categories may include: Meta / WhatsApp services; Google services connected by the Customer; AI service providers; cloud hosting and infrastructure providers; storage providers; communications providers; security and monitoring providers; payment providers where applicable; professional advisers; and regulators, courts or public authorities where required by law.
The specific providers used may change as ORQADOS develops. Where appropriate, ORQADOS requires service providers to protect personal data and process it in accordance with applicable contractual and legal requirements.
Disclosures to law-enforcement agencies, regulators, courts and other public authorities are governed by a separate documented process covering review of the legality of each request, the challenging of unlawful or overbroad requests, disclosure of the minimum data necessary, and documentation of every request and response. See Requests from public authorities.
11. Workspace isolation
Customer workspaces are logically isolated from one another. Application-level access controls are designed to prevent one Customer from accessing another Customer's workspace data.
12. Data retention
ORQADOS retains personal data only for as long as reasonably necessary for: providing the Service; Customer instructions; the purpose for which the data was collected; security and fraud prevention; audit and operational integrity; backup integrity; legal compliance; dispute resolution; and the establishment, exercise or defence of legal claims.
Retention periods may differ depending on the category of data, the Customer's configuration, the connected provider, legal requirements and operational needs.
When personal data is no longer reasonably required for an authorised business or legal purpose, ORQADOS will delete it, anonymise it or remove the means by which it can reasonably be associated with an individual, subject to applicable law and technical limitations.
Do-not-contact and opt-out records may be retained for longer where necessary to ensure that an individual's request continues to be honoured.
13. Customer deletion and disconnection
Customers may: disconnect supported connected services; revoke provider access; request deletion of workspace data; and request closure of their ORQADOS workspace, in accordance with the applicable account and deletion process. See Data Deletion & Account Removal.
Deletion may not be instantaneous across backups, security logs, legal records, audit records or provider systems outside ORQADOS's direct control. Where limited retention continues after a deletion request, ORQADOS will retain the information only for the applicable permitted purpose and period.
14. Security
ORQADOS maintains technical and organisational safeguards designed to protect personal data against unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks. Currently implemented controls include: TLS for network communications; encrypted storage of sensitive provider credentials and tokens; server-side access controls; tenant/workspace isolation; audit and operational logging; and do-not-contact enforcement.
No online system can guarantee absolute security. Additional information is available at Security & Trust.
15. Data breaches and security incidents
ORQADOS maintains processes for investigating suspected security incidents involving personal data.
Where ORQADOS acts as a data intermediary for a Customer, ORQADOS will notify the relevant Customer of a qualifying data breach without undue delay where required by applicable law or contract. Where ORQADOS is responsible for the affected personal data as an organisation, ORQADOS will assess and make any required notifications to affected individuals or the Personal Data Protection Commission in accordance with applicable law.
16. Individual rights
Individuals may have rights under the Singapore PDPA or other applicable law in relation to their personal data. Depending on the circumstances, these may include rights or requests concerning: access; correction; withdrawal of consent; deletion where applicable; cessation of certain marketing communications; and information about how personal data is used or disclosed.
Workspace Contacts
Where personal data is held within a Customer's workspace and ORQADOS processes that data on the Customer's behalf, the Customer will generally be the appropriate first point of contact for the individual's request. ORQADOS will reasonably assist the Customer in responding to valid requests where required.
ORQADOS account users
Users may contact ORQADOS directly regarding personal data ORQADOS processes for its own account-management or service-administration purposes.
Requests may be subject to identity verification, legal exceptions, applicable retention requirements and reasonable processing time.
17. Withdrawal of marketing consent / do not contact
An individual may withdraw consent to marketing communications or request not to be contacted through supported channels. ORQADOS supports central suppression and do-not-contact controls intended to prevent ordinary nurture and outreach workflows from messaging a person after a valid opt-out is recorded.
A withdrawal of marketing consent does not necessarily require deletion of all personal data where continued retention is required or permitted for: legal obligations; suppression/DNC enforcement; security; dispute resolution; or other lawful purposes.
18. Children
ORQADOS is designed for business use and is not directed at children under 18. ORQADOS does not knowingly offer workspace accounts to individuals under 18. A Customer remains responsible for ensuring that any personal data it places in ORQADOS is collected and processed lawfully.
19. International data transfers
ORQADOS and its service providers may process personal data in Singapore and other countries. Where personal data is transferred outside Singapore, ORQADOS takes reasonable steps to ensure that the recipient provides a standard of protection comparable to that required under the Singapore PDPA, including through contractual or other legally recognised safeguards where appropriate.
The specific processing location may depend on the Customer's connected services and the infrastructure or service providers used.
As at the effective date of this Policy, personal data processed by ORQADOS and its infrastructure and AI service providers may be processed in: Singapore; Malaysia (application hosting); and the United States (content delivery, object storage and AI language-model processing). Where a Customer connects an additional third-party service, that service may process data in further locations determined by that provider.
20. Website and application cookies
ORQADOS uses cookies and similar technologies necessary for authentication, session management, security and essential application functionality. ORQADOS does not currently use third-party advertising trackers in the authenticated application.
If optional analytics, marketing or advertising technologies are introduced, ORQADOS will update this Policy and implement any consent mechanism required by applicable law.
21. Changes to this Privacy Policy
ORQADOS may update this Privacy Policy from time to time. The current version will be published on this page with its effective date. Where a change materially affects how Customer or Contact personal data is handled, ORQADOS will provide reasonable notice through the application, email or another appropriate channel, unless an earlier change is required by law, security or provider requirements.
22. Contact / data protection
Privacy and data-protection enquiries may be sent to [email protected]. This includes: privacy questions; personal-data requests; correction requests; deletion requests; withdrawal-of-consent enquiries; and data-protection concerns.
Data Protection Contact: [email protected]
ORQADOS is a trading name of Orqados Private Limited (UEN 202642713D), a company incorporated in Singapore. A postal address for service may be requested at the address above.