Privacy Policy
Last updated: 15 July 2026
This policy explains what personal data Orphinder collects, why, and what rights you have over it.
Orphinder is operated by LGC LTDA., CNPJ 52.042.963/0001-51, Rua Jussara 496, Sobrado 01, Sítio Cercado, Curitiba/PR, CEP 81.925-552, Brazil. We are the controller of the personal data described here.
Contact: help@orphinder.com
We process personal data under the Brazilian General Data Protection Law (LGPD, Law No. 13.709/2018) and, where it applies, the EU General Data Protection Regulation (GDPR).
1. What we collect
Account data
When you create an account: your name, email address, and a hashed password. We never store your password in readable form.
Usage data
The URLs you submit for scanning and the results of those scans (page lists, link counts, scores)
Which suggestions you open
Timestamps of scans and activity
Your plan, and for Starter, the single domain your purchase is tied to
Crawled website content
When you run a scan, we fetch pages from the site you submitted. We store the page URLs and their internal link counts. Page text is fetched at the moment you request a suggestion, sent to our AI provider, and used to produce that suggestion. We do not store the page text itself.
If the site you scan contains personal data in its public pages, that data may pass through this process. Only scan sites you own or are authorised to audit.
Analytics
We use analytics to understand how the product is used: pages viewed, features used, approximate location derived from IP, browser and device type.
Payment data
We never see or store your card details. Payments are handled by Paddle, which collects and processes payment information directly. We receive only confirmation of the purchase, your plan, and a customer reference.
Support email
If you email us, we keep the correspondence.
2. Why we process it, and our legal basis
Purpose Data Legal basis Provide the Service Account, usage, scan results Performance of a contract Process payments Purchase confirmation from Paddle Performance of a contract Generate AI suggestions Page content, URLs Performance of a contract Improve the product Analytics Legitimate interest Prevent abuse and secure the Service Account, usage, logs Legitimate interest Respond to support requests Email correspondence Legitimate interest Meet legal and tax obligations Transaction records Legal obligation
Under the LGPD, the corresponding bases are execution of a contract (Art. 7, V), legitimate interest (Art. 7, IX), and compliance with a legal obligation (Art. 7, II).
We do not sell your data. We do not show ads. We do not use your scan data to train AI models.
3. Who we share it with
We use the following processors to run the Service. Each receives only what it needs.
Provider Purpose Location Xano Backend, database, account storage US Netlify Frontend hosting Global CDN Apify Website crawling EU/US Anthropic AI suggestion generation US Paddle Payment processing (Merchant of Record) UK/EU PostHog Product analytics EU (eu.i.posthog.com) Google Analytics Website analytics US Cloudflare DNS and email routing Global Resend Transactional and support email US/EU Framer Marketing site hosting (orphinder.com) Global CDN
We may also disclose data where legally required, or to protect our rights or the safety of others.
AI processing note: page content and URLs are sent to Anthropic to generate suggestions. Anthropic processes this to return a result and does not use it to train their models under their commercial API terms.
4. International transfers
We are based in Brazil. Our primary database and backend (Xano) are hosted in the United States, and several other processors are located outside Brazil and outside the EU/EEA. This means your account data, the URLs you scan, and your scan results are stored in the US.
Where personal data is transferred internationally, we rely on the safeguards our processors have in place, which typically include Standard Contractual Clauses and equivalent mechanisms permitted under GDPR Chapter V and LGPD Art. 33.
5. How long we keep it
Account data: while your account is active, then deleted or anonymised within 90 days of account deletion
Scan results: while your account is active, so you can revisit past audits
Crawled page text: not retained beyond the request that used it
Analytics: up to 24 months
Transaction records: as required by Brazilian tax and commercial law, typically 5 years
Support email: up to 24 months
6. Your rights
Under the LGPD you have the right to:
Confirm whether we process your data, and access it
Correct incomplete or inaccurate data
Anonymise, block, or delete unnecessary or excessive data
Port your data to another provider
Delete data processed on the basis of consent
Know who we share your data with
Object to processing based on legitimate interest
Withdraw consent, where consent is the basis
If you are in the EU/EEA or UK, you have equivalent rights under the GDPR, including the right to lodge a complaint with your local supervisory authority. In Brazil you may complain to the ANPD (Autoridade Nacional de Proteção de Dados).
To exercise any of these, email help@orphinder.com. We respond within 15 days as required by the LGPD, or within one month under the GDPR.
7. Cookies and tracking
We use:
Essential storage — your login token and last scanned URL are stored in your browser's local storage so the Service works. These cannot be disabled.
Analytics — PostHog and Google Analytics set cookies or identifiers to measure usage.
You can block cookies in your browser, though parts of the Service may stop working.
8. Security
We use HTTPS throughout, hash passwords, and restrict access to production data. Authentication tokens expire after 24 hours.
No system is perfectly secure. If a breach occurs that presents a relevant risk to you, we will notify you and the ANPD as required by LGPD Art. 48.
9. Children
The Service is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, email us and we will delete it.
10. Changes
We may update this policy. Material changes will be notified by email or in-app at least 14 days before taking effect. The date at the top reflects the current version.
11. Contact
LGC LTDA. CNPJ 52.042.963/0001-51 Rua Jussara 496, Sobrado 01 Sítio Cercado, Curitiba/PR CEP 81.925-552, Brazil
Email: help@orphinder.com