Privacy Policy

Last updated: April 5, 2026

GE Labs, LLC (“we”, “us”, “Orva”) operates the orva.build platform. This Privacy Policy explains how we collect, use, and protect your information when you use our service.

1. Information We Collect

Account Information

When you create an account, we collect your name, email address, company name, role, preferred language, and timezone. If you sign in with Google, we receive your name and email from Google.

Project Data

We store the conversations you have with Orva, project blueprints, wireframes, generated code, and related metadata. This data is necessary to provide our service.

Payment Information

Payments are processed by Stripe and PayMongo. We do not store your full credit card number. We receive transaction records including amount, currency, and payment status.

Usage Data

We collect standard web analytics: pages visited, feature usage, browser type, and IP address. This helps us improve the product.

2. How We Use Your Information

  • To provide and maintain the Orva platform
  • To personalize your experience (language, currency, project context)
  • To process payments and manage subscriptions
  • To generate code and blueprints based on your project requirements
  • To send transactional emails (project updates, receipts)
  • To improve our AI models and service quality

3. AI Processing

Your project conversations are processed by third-party AI providers (Anthropic, Google, OpenAI via OpenRouter) to generate responses, blueprints, and code. These providers process your data according to their respective privacy policies. We do not use your project data to train AI models.

4. Data Storage & Security

Your data is stored on Supabase (hosted on AWS) with row-level security policies ensuring you can only access your own data. All data is encrypted in transit (TLS) and at rest. If you use the Bring Your Own Database (BYOD) feature, your database credentials are encrypted using AES-256 before storage.

5. BYOD (Bring Your Own Database)

When you connect your own Supabase project, we store only your project’s public URL and anon key (encrypted). We never store service_role keys. You can disconnect at any time, and we will delete the stored credentials immediately.

6. Custom Domains

If you add a custom domain, we share your domain name with Vercel for DNS configuration and SSL provisioning. Domain billing is handled through Stripe.

7. Data Sharing

We do not sell your personal information. We share data only with:

  • Supabase — database hosting and authentication
  • Stripe / PayMongo — payment processing
  • Vercel — application hosting and deployment
  • AI Providers (Anthropic, Google, OpenRouter) — to process your project conversations

8. Your Rights

You have the right to:

  • Access your personal data
  • Update or correct your information
  • Delete your account and all associated data
  • Export your project data and source code
  • Disconnect third-party integrations (BYOD, Google sign-in)

To exercise these rights, contact us at hello@orva.build.

9. Data Retention

We retain your data for as long as your account is active. If you delete your account, we delete all personal data and project data within 30 days. Payment records may be retained longer for legal and tax compliance.

10. Cookies

We use essential cookies for authentication and session management. We do not use advertising or tracking cookies.

11. Children’s Privacy

Orva is not intended for children under 13. We do not knowingly collect information from children.

12. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes via email or an in-app notification.

13. Contact

For privacy-related questions or concerns:

GE Labs, LLC
Email: hello@orva.build