OrphicOS ← Back
Your data

Privacy Policy

Last updated: 11 July 2026

The short version

OrphicOS is deployed and runs on infrastructure you own or control. The workflows it performs, the screen data it reads, the documents and systems it touches, and the AI engine itself all stay on your machines — they are processed locally, without needing an internet connection, and are never sent to us. The only personal data we handle is what you send us directly: for example, the contact details you provide when you book a consultation or correspond with us, plus the basic technical data every website unavoidably processes to be delivered to your browser.

1. Who is responsible (controller)

The controller for the processing described here is:

THREE DOT SOLUTIONS - FZCO (Free Zone Company)
IFZA Business Park, Building A1, Dubai Digital Park · Dubai Silicon Oasis, Dubai · United Arab Emirates
Trade Licence No. 49631 (Dubai Integrated Economic Zones Authority / IFZA)
Telegram: t.me/OrphicOS · Phone: +971 58 205 2608

Full provider details are on the imprint page. For data that OrphicOS processes while running inside your organisation, your organisation is the controller, not us.

Controller outside the EU (Art. 3(2) GDPR). The controller is established in the United Arab Emirates. We process the personal data of individuals in the EU/EEA only in connection with delivering this website and responding to enquiries you send us. Because this processing is occasional and unlikely to result in a risk to your rights and freedoms, and involves no special categories of data, we rely on the exemption in Art. 27(2) GDPR and have not appointed an EU representative. For any privacy matter you can reach us directly at t.me/OrphicOS.

We are not legally required to appoint a Data Protection Officer, and have not appointed one, because our processing does not meet the thresholds in Art. 37 GDPR / § 38 BDSG (no large-scale or high-risk processing).

2. What we process, and why

Consultation and contact data. When you message us or request a consultation, we process the details you choose to share — such as your name, contact details, company, and the content of your message — to respond and to scope a possible engagement. Legal basis: steps taken at your request prior to a contract, and our legitimate interest in business correspondence (Art. 6(1)(b) and (f) GDPR). Providing this data is voluntary, but without at least a return address we cannot reply.

Data OrphicOS processes on your infrastructure. When OrphicOS runs, it operates on machines you own or control. The commands it carries out, the on-screen data it reads, the files and applications it works in, and the AI models it uses all remain within your own environment. OrphicOS does not require an internet connection to perform this work, and we do not receive, transmit, or store this operational data. Within your organisation you are the controller of it, and it is governed by your own policies and your deployment agreement with us.

Support data. If you ask us for support, we process the information you choose to share with us for that purpose. We do not require, and do not ask for, your operational data to provide it.

Website access data. When you open this website, our hosting provider's server necessarily processes technical data your browser transmits — in particular your IP address, the requested file, and the time of the request — for the sole purpose of delivering the page and maintaining the technical security and stability of the site. Legal basis: our legitimate interest in providing and securing the website (Art. 6(1)(f) GDPR). This site is configured not to keep persistent access logs; any transient processing of the IP address at the server is limited to what is technically necessary to deliver the request and is not used to identify you.

3. What we do not do

4. Local storage on your device

If you switch language, this site stores a single value ("orphic_lang") in your browser's local storage so it can remember your choice on your next visit. This value stays on your device, is not personal data, and is never transmitted to us or to anyone else. It is strictly necessary to provide the function you requested, so no consent is required (§ 25 (2) no. 2 TDDDG). You can clear it at any time in your browser settings. Because this site uses no non-essential cookies or tracking, there is no cookie banner.

5. Hosting

This website is hosted by Hostinger International Ltd. (61 Lordou Vironos, 6023 Larnaca, Cyprus) as our processor under a data-processing agreement (Art. 28 GDPR). The server currently used to serve this site is located in the United States. Because this involves processing in a country outside the EU/EEA, the transfer is safeguarded by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) contained in the provider's data-processing agreement; a copy of the safeguards can be requested from us.

6. Recipients and third-country transfers

We keep the number of recipients to a minimum. The following processors may handle personal data on our behalf:

Because the operational data handled by OrphicOS stays on your own infrastructure, it is never disclosed to us or to any of these processors. All transmission to and from this site is encrypted in transit (TLS).

7. How long we keep data

We keep consultation and contact correspondence only as long as needed to deal with your enquiry and any resulting business relationship, and then delete it. Where correspondence is subject to statutory retention duties — for example commercial or tax records under §§ 257 HGB, 147 AO — we retain it for the required period (generally 6 or 10 years, calculated from the end of the relevant calendar year) and restrict its use to that purpose in the meantime.

8. Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). To exercise any of these rights in respect of the data we hold — for example your consultation correspondence — message us on Telegram at t.me/OrphicOS.

You also have the right to lodge a complaint with a data-protection supervisory authority (Art. 77 GDPR). As the controller is based outside the EU, you may contact the supervisory authority of the EU/EEA member state where you are habitually resident, where you work, or where the matter arose. A current list of the German supervisory authorities is published by the Federal Commissioner at bfdi.bund.de.

9. Security

All traffic between this site and your browser is encrypted with TLS. The design principle behind the product is that the most sensitive data — the work OrphicOS does and everything it reads to do it — never leaves your own security perimeter, because it is processed on your infrastructure rather than ours.

10. Changes

We will update this policy as the product evolves and change the date above. Material changes will be reflected here.