In short: we never receive your datasets, analyses, output or AI conversations. We store your account details and a record of your devices and licences. Paddle handles your payment details. A licence check sends exactly four things: your licence ID, a hashed device ID, the app version and the operating system.
1. Who is responsible
Trifecta Labs LLC, a Delaware limited liability company, makes OrcStat and is responsible for the personal data described here ("we", "us"). Contact us about privacy at [email protected].
Paddle.com, our reseller and merchant of record, is responsible for the payment data it collects when you buy. Its own privacy notice applies to that data.
2. What we never collect
The statistics engine runs on your computer, or inside your browser for the browser version. The AI features talk only to model servers that you configure. So we never receive:
- your datasets, .sav files or projects;
- your analyses, syntax, output or reports;
- your prompts to the AI or its answers, or which AI features you use;
- usage analytics or telemetry about what you do in the app.
3. What a licence check sends
When it's online, the app checks your licence on start-up and about once a day. Each check sends exactly:
- your licence ID;
- a hashed device ID: a one-way hash of hardware details and a random install ID, which can't be turned back into those details and contains nothing personal;
- the app version;
- the operating system.
It sends nothing about your data, your analyses or your AI use. The app works offline for up to 30 days between checks.
When you first activate OrcStat on a device, the app also sends a device name, so you can recognise the device when you manage your devices in your account.
4. What we do collect
| Data | Why |
|---|---|
| Account: name, email address, whether it's verified, sign-in method, when you signed up | To create your account, sign you in and contact you about it |
| Plan: trial start and end, beta place, plan, seats, team memberships and roles | To give you the right access and enforce one trial and one beta place per person |
| Devices and licences: hashed device ID, device name, operating system, app version, when each device last checked in, licences issued | To issue licences and apply the 2-device limit |
| Billing records from Paddle: customer and subscription IDs, price, billing period, status, renewal date, discounts. Not your card details. | To keep your plan in step with your payments |
| Student discount requests: name, university email, institution, course or programme, and our decision | To review the request and issue a code |
| Account history: changes to your account, seats, roles, devices and billing | Security, support, and the audit log shown to team owners and admins |
| Emails we send: which account emails have gone out and when | To avoid sending the same email twice |
| Messages you send us by email | To answer you |
Like any internet service, our servers see the IP address a request comes from. We use it briefly, in memory, to block abuse such as repeated sign-up attempts. Our hosting provider may keep short-lived technical logs that include it.
This website doesn't use advertising or analytics cookies.
5. Legal bases (for people in the UK and EEA)
- Contract: account, plan, device, licence and billing data, to provide what you signed up for.
- Legitimate interests: preventing abuse of trials and offers, keeping our services secure, and the account history.
- Legal obligation: keeping records we are required to keep.
6. Who we share it with
We don't sell personal data or share it for advertising. We use these service providers (subprocessors), each only for the purpose shown:
| Provider | What for |
|---|---|
| Clerk | Sign-in, passwords, Google and Microsoft sign-in, multi-factor authentication |
| Paddle.com | Checkout, payments, tax, invoices and refunds, as merchant of record |
| An email delivery provider | Sending account emails such as trial reminders, receipts and invitations |
| Our hosting provider | Running the account portal and licensing service |
We will list the email and hosting providers by name here once they are chosen. If you are part of a team or institution, its owners and admins can see your name, email, role and devices. We may also disclose data when the law requires it.
7. International transfers
We are based in the United States, and our providers may process data in the United States and other countries. Where the law requires it, we rely on safeguards such as the European Commission's standard contractual clauses.
8. How long we keep it
We keep account data while your account is open. When you close it, we delete or anonymise your personal data within 90 days, except billing and tax records and the records needed to enforce one trial and one beta place per person, which we keep for as long as the law requires or allows. Paddle keeps its own records under its privacy notice.
9. Security
Licences are signed so they can't be forged, passwords are handled by Clerk and never stored by us, app sign-in tokens are stored only as hashes, and access to account data is limited to the people who need it.
10. Your rights
Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict how we use it, and to complain to your data protection authority. You can manage most details in your account. For anything else, email [email protected] and we will reply within 30 days. We won't treat you differently for using these rights.
11. Children
OrcStat isn't meant for children under 16, and we don't knowingly collect their data.
12. Institutions
When an institution provides OrcStat to its members, it may connect its own sign-in and add or remove users. A data processing agreement is available to institutions on request.
13. Changes
We will post any changes here and update the "last updated" date. If a change is significant, we will also tell you by email.
14. Contact
Trifecta Labs LLC, Delaware, USA · [email protected]