Privacy Policy

1. Introduction

This Privacy Policy describes how Orika, Inc., a Delaware corporation (“Orika,” “we,” “us,” or “our”), collects, uses, shares, and protects information in connection with the Orika platform and related services (the “Service”). The Service is an AI-powered phone intake and receptionist agent designed for law firms.

This policy applies to two categories of individuals:

• Customers — law firms and their authorized users who subscribe to and manage the Service through the Orika dashboard.
• Callers — individuals who interact with the Orika AI agent by phone on behalf of a subscribing law firm.

2. Information We Collect

Account and firm information. When a law firm subscribes to the Service, we collect the information provided during account setup and configuration, including firm name, office address, timezone, staff member names, staff phone numbers, practice area details, and authentication credentials.

Call data. When a caller interacts with the Orika agent, we collect information related to the call, including the caller’s phone number, the phone number called, call start and end times, call duration, and call status.

Call recordings and transcripts. Calls handled by the Orika agent may be recorded and transcribed. Recordings are stored by our voice infrastructure provider. Transcripts may be generated and stored within the Service.

Lead and intake information. During calls, the AI agent may collect information from callers on behalf of the subscribing firm, such as the caller’s name, contact information, description of their legal matter, and responses to firm-specific intake questions. This information is stored as lead records within the Service.

Consultation booking data. When automated consultation scheduling is enabled, we collect and store information related to bookings, including the scheduled date and time, assigned staff member, consultation location or format (phone, video, or in-person), booking status, and the calendar event identifier from the connected calendar provider.

Calendar connection data. When firm staff members connect a calendar account (such as Google Calendar or Microsoft Outlook) to enable consultation scheduling, we collect and store information about the connection, including the calendar provider, account email address, selected calendar name, and encrypted authentication credentials (OAuth access and refresh tokens).

Messages. When a caller leaves a message for a firm staff member through the Orika agent, we store the message content, the caller’s phone number, and the intended recipient.

Usage and analytics data. We collect standard analytics data when you use the Orika dashboard, including page views, browser type, device information, and general usage patterns. This data is collected through our hosting provider’s analytics tools and is used to understand how the dashboard is used and to improve the Service.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service, including answering calls, qualifying leads, transferring calls, delivering messages, scheduling consultations, and sending email notifications on the firm’s behalf.
• Process and store lead and intake information as directed by the subscribing firm’s configuration.
• Query connected third-party calendar accounts for staff availability, create calendar events for scheduled consultations, and send booking confirmation email messages to callers.
• Authenticate users and manage account access.
• Communicate with customers about their account, billing, service updates, and support requests.
• Monitor, analyze, and improve the performance, reliability, and security of the Service.
• Comply with legal obligations and enforce our Terms of Service.

4. AI and Automated Processing

The Service uses artificial intelligence to interact with callers, including speech recognition, natural language understanding, and text-to-speech technology. Caller audio is processed in real time by AI models to generate conversational responses, extract intake information, and determine call routing.

When automated consultation scheduling is enabled, the AI agent also performs automated processing to assess caller qualification against firm-configured rules, determine available consultation time slots based on connected staff calendars, present scheduling options to callers, and book consultations. These scheduling decisions are made automatically during the call without prior human review.

Orika does not use customer data or caller data to train, fine-tune, or improve any artificial intelligence or machine learning models. Caller data is processed exclusively to deliver the Service to the subscribing law firm.

5. Call Recording and Transcription

Calls handled by the Orika agent may be recorded and transcribed as part of the Service. Subscribing law firms are solely responsible for complying with all applicable federal, state, and local laws governing call recording and transcription, including any requirements to notify callers or obtain their consent. Orika does not independently provide notice to callers regarding recording or transcription.

Firms should configure appropriate caller disclosures based on the recording and consent laws applicable to their jurisdiction and their callers’ jurisdictions.

6. How We Share Your Information

We do not sell personal information. We will not share or sell caller mobile information, including phone numbers, with third parties for promotional or marketing purposes. We may share information in the following limited circumstances:

Service providers. We use third-party service providers to help operate the Service, including providers of voice infrastructure, telephony and delivery, email delivery, speech recognition, language models, text-to-speech, calendar integration, authentication, database hosting, web hosting, and analytics. These providers process data on our behalf and are subject to contractual obligations to protect the confidentiality and security of the data they handle. For details on our data processing commitments, please refer to our Data Processing Agreement.

Subscribing law firm. Caller data and intake information collected during calls is made available to the subscribing law firm that the caller contacted. The firm controls how that data is used within the scope of their legal practice.

Calendar providers. When automated consultation scheduling is enabled and a staff member has connected a calendar account, we transmit caller information to the connected calendar provider (Google Calendar or Microsoft Outlook) in order to create consultation events. Information included in calendar events may include the caller’s name, phone number, practice area, a summary of the caller’s legal matter, and responses to firm-specific intake questions. This information is transmitted via encrypted connections and is stored within the staff member’s calendar account, which is controlled by the subscribing firm.

Notifications. When enabled by the subscribing firm, we send email notifications to firm staff members to alert them of new leads, messages, or call transfers. When automated consultation scheduling is enabled, callers may also request booking confirmation emails, which may include the scheduled date and time, assigned staff member name, consultation location or format, and related scheduling details. Staff notification emails and caller confirmation emails are delivered through a third-party email provider.

Legal requirements. We may disclose information if required to do so by law, legal process, or government request, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others, investigate fraud, or respond to a government request.

7. Google API Services User Data

Orika’s use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

When a firm staff member connects their Google Calendar account to the Service, Orika accesses the following Google user data:

• Calendar free/busy information, used to determine available consultation time slots
• Calendar metadata, including the names and identifiers of calendars associated with the connected account
• OAuth authentication credentials (access and refresh tokens), used to maintain the calendar connection

Orika uses Google Calendar data solely to check staff member availability and to create, modify, and delete calendar events for booked consultations on behalf of the subscribing law firm. Orika does not use Google user data for any purpose other than providing the consultation scheduling functionality of the Service. Orika does not use Google user data to serve advertisements or for any purpose unrelated to the Service.

Google Calendar data is not sold, shared with, or transferred to third parties except as necessary to provide the Service. Specifically, calendar event data created by Orika is accessible to the subscribing firm’s staff members who have access to the connected calendar account. No Google user data is shared with or transferred to third parties for advertising, data brokerage, or any purpose other than providing the Service’s consultation scheduling feature.

Google Calendar OAuth credentials are stored in encrypted form in our database. Calendar free/busy data is queried in real time during scheduling and is not persistently stored beyond the duration of the scheduling request. Calendar events created by the Service remain in the connected Google Calendar account and can be managed or deleted by the staff member at any time. When a calendar connection is disconnected or the subscribing firm’s account is terminated, Orika deletes the stored OAuth credentials and calendar connection metadata from its systems.

8. Data Retention

We retain customer account data, call data, lead records, consultation booking records, calendar connection data, messages, and related information for as long as the firm’s account is active or as needed to provide the Service. Call recordings are retained by our voice infrastructure provider in accordance with their retention policies. Calendar events created in third-party calendar accounts are controlled by those accounts and are not deleted by Orika upon account termination.

Following account termination, we will retain customer data for a reasonable period to allow retrieval upon request, after which it may be deleted in accordance with our data retention practices. We may retain certain data as necessary to comply with legal obligations, resolve disputes, or enforce our agreements.

9. Data Security

We implement appropriate technical and organizational measures to protect the information we collect and store. Data is encrypted in transit using TLS and at rest using industry-standard encryption. Access to customer data is restricted to authorized personnel and scoped to the subscribing firm. While we take reasonable steps to safeguard your data, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Your Rights

For customers. You may access, update, or delete your firm’s account information at any time through the Orika dashboard. You may also request a complete export or deletion of your data by contacting us. Upon account cancellation, you may request retrieval of your data before it is deleted.

For callers. If you are a caller and wish to access, correct, or delete personal information collected during a call, you may contact the law firm you called directly, or contact Orika at the address listed below. We will work with the subscribing firm to address your request.

California residents. If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to request deletion, and the right to opt out of the sale of personal information. As noted above, we do not sell personal information. To exercise your rights, contact us using the information below.

11. Cookies and Tracking Technologies

The Orika dashboard uses cookies and similar technologies for authentication and session management. We also use analytics tools provided by our hosting provider to collect anonymized usage data about how the dashboard is accessed and used. We do not use third-party advertising cookies or cross-site tracking technologies.

12. Children’s Privacy

The Orika dashboard is intended for use by authorized representatives of law firms and is not directed at individuals under the age of 18. We do not knowingly collect personal information from children under 13 through the dashboard. If you believe that a child under 13 has provided personal information to us, please contact us so that we can take appropriate action.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, notify customers through the dashboard or by email. Your continued use of the Service after changes are posted constitutes your acceptance of the updated policy.

14. Contact

If you have questions about this Privacy Policy or wish to exercise any of your rights described above, please contact us at support@withorika.com.