Privacy Policy
This explains what personal data we collect, why, what we do with it, and the rights you have over it. It covers people who visit blackorchid.ai, people we contact as part of our own or a client's outreach, and the personal data we handle on behalf of clients.
This policy describes how the site and the engine actually work today, not a template. One item is still open: the named visitor-identification provider, which is added to section 6 the moment one is selected. Please have a qualified data-protection lawyer review this before you rely on it.
- Who we are
- Controller and processor: which one we are
- What we collect and why
- Our lawful bases
- Cookies, pixels and visitor identification
- Who we share data with
- International transfers
- How long we keep things
- Your rights
- US state privacy rights
- Security
- Children
- Changes
- How to contact us or complain
1. Who we are
Corvo Security LLC, trading as BlackOrchid.ai, is the controller for the personal data described in this policy unless section 2 says otherwise.
| Legal entity | Corvo Security LLC (BlackOrchid.ai is a registered trading name) |
| Registered address | 200 University Blvd, STE 225-389, Round Rock, TX 78665, United States |
| Privacy contact | privacy@blackorchid.ai |
| Where we operate | The United States. We do not currently offer our services to, or target, people in the EEA or the UK |
Where this applies. We are a United States business serving United States customers. We do not currently market to or target people in the EEA or the UK, so the EU and UK GDPR do not generally apply to us today. We have still built this site and this policy to that standard, because it is the right standard and because we may serve those markets later. If you are in the EEA or the UK, we will honour the rights in section 9 anyway if you ask. Should we begin offering services there, we will appoint the representatives that Article 27 requires and update this page before we do.
2. Controller and processor: which one we are
This matters, because it decides who you go to about your data.
We are the controller
For our own website, our own marketing, our own prospects, and anyone who fills in a form here or books a call with us. We decide why and how that data is used, so we are answerable for it.
We are a processor
When we run the revenue engine for a client, the client is the controller of their leads, customers and prospects. We act on their documented instructions under a data processing agreement. If you were contacted by a campaign we run for a client, the client decides what happens to your data. We will always tell you who that client is if you ask, and we will pass your request to them.
Ask us either way. If you contact us about data we only process for a client, we forward your request to them without delay and confirm to you that we have done so.
3. What we collect and why
When you use this website
- What you type into our booking form: the form on our diagnosis page is hosted by GoHighLevel and served from api.blackorchid.ai, our own subdomain. What you enter goes straight into our CRM. We use it to prepare for and hold one conversation with you.
- Technical data your browser sends: IP address, user agent, and the pages you view. Our host records this to serve the site and defend it from abuse.
- Your privacy choices: stored in your browser so we do not have to ask again.
We do not run analytics, advertising or identification on this site unless you have allowed it. See section 5.
When we build audiences, for ourselves or for a client
This is the core of what we do, so we are being specific about it.
- Business contact data: name, job title, employer, work email, business phone, professional profile links, company size, industry and revenue band.
- Consumer household data, US only: name, postal address, email, phone, age band, income band, net worth band, homeowner status and whether there are children at home.
- Buying-intent signals: topics a business or household has been researching recently, supplied by licensed data providers on a rolling seven-day window.
- Website visitor resolution: matching an anonymous visit to a company or, in the United States only, to a named business contact.
- Data a client already holds: their CRM records, event and conference lists and past customers, which we clean and enrich on their instructions.
We obtain this from licensed third-party data providers who represent that they collected it lawfully and with the necessary permissions. We are not the original collector of most of it. You can ask us where a specific record came from and we will tell you.
AI processing
We use AI systems for scoring, routing, drafting and automation, and AI agents answer inbound enquiries on client platforms. Guardrails are approved by a human before anything goes live, a human can take over any conversation, and conversations are reviewable. We do not make decisions producing legal or similarly significant effects about you by automated means alone. If you would like a human to review anything an automated system did in relation to you, ask us and we will arrange it.
4. Our lawful bases
| What we do | Lawful basis |
|---|---|
| Replying to your enquiry | Steps taken at your request before entering a contract, and our legitimate interest in responding |
| Analytics, advertising and identification cookies | Consent. Nothing loads before you give it, and you can withdraw at any time |
| B2B outreach to a business contact | Legitimate interest in marketing relevant services to a business, balanced against your interests, and only where local law allows. We stop immediately when asked |
| Consumer marketing | Consent, obtained by the data provider or the client, and only in the United States |
| Running the engine for a client | Performance of our contract with the client, on their documented instructions |
| Security, fraud prevention, record keeping | Legitimate interest, and legal obligation where one applies |
Where we rely on legitimate interest, we have weighed it against your rights and you can ask us for that assessment. You can object at any time using the details in section 14.
5. Cookies, pixels and visitor identification
On your first visit we ask. Until you choose, only the strictly necessary items run. Reject is exactly as easy as accept, and you can change your mind whenever you like from the Privacy choices link in the footer. If your browser sends a Global Privacy Control signal we act on it before we ask you anything. See section 10.
| Category | What it does | Runs when |
|---|---|---|
| Strictly necessary | Serves the page, runs the contact form, remembers your privacy choice | Always. No third party involved |
| Analytics | Tells us which pages are read and where people stop | Only with your consent |
| Advertising | Meta and Google cookies used to measure and retarget our own advertising | Only with your consent |
| Business visitor identification | Matches an anonymous visit to a company or a named business contact | United States visitors only, and only with consent. Never for visitors in the UK or EEA, whatever they choose |
A deliberate decision worth stating plainly. Person-level visitor identification is not something we are willing to run on visitors in the UK or the EEA. Our detection defaults to the strict setting whenever we cannot positively place a visitor in the United States, so an unrecognised visitor is never identified.
Fonts are served from our own domain. Loading them from a third-party font service would send your IP address to that provider, so we do not do it.
6. Who we share data with
We do not sell personal data for money. We share it with the following categories of recipient, each under a written contract:
- Hosting: Netlify, which serves this website.
- Booking form and CRM: GoHighLevel, which hosts the form on our diagnosis page and holds the record it creates.
- CRM and automation: the platform running the engine, including GoHighLevel and workflow tooling.
- Communications: email, SMS and voice providers including Google Workspace, Mailgun, Amazon SES and Twilio.
- Data and intent providers: the licensed suppliers of the audience and intent data described in section 3.
- Visitor identification: our identification provider, for US visitors only. [TO CONFIRM: name the provider once selected]
- Advertising platforms: Meta and Google, where you have consented.
- AI providers: the model providers behind our agents and automation, under terms that do not permit training on your data.
- Professional advisers and authorities where we are legally required.
- Clients, where we generated or enriched a record on their instructions.
Under some US state laws, sharing data with advertising and identification partners can count as "selling" or "sharing" even though no money changes hands. Section 10 explains how to opt out.
7. International transfers
We are based in the United States and our data is processed there. Our providers are predominantly US companies. If we later handle personal data of people in the UK or EEA, we will rely on the European Commission's Standard Contractual Clauses with the UK Addendum, or on a provider's EU-US Data Privacy Framework certification where it holds one. Ask us and we will describe the safeguards for a specific transfer.
8. How long we keep things
| Booking form enquiries | 24 months from your last contact with us, then deleted |
| Prospect and audience records | Refreshed weekly. Intent signals expire after 7 days. Records with no engagement are removed at 12 months |
| Client data we process | For the term of the client contract, then returned or deleted within 30 days on their instruction |
| Suppression and do-not-contact lists | Kept indefinitely, because that is the only way to honour your objection |
| Your privacy choice | 12 months, then we ask again |
| Billing and tax records | As long as tax and company law requires |
9. Your rights
These are the rights the UK and EU GDPR grant. As section 1 explains, we are a US business not currently targeting those markets, so they may not apply to us as a matter of law. We give them to everyone who asks anyway, wherever you are.
- Access. Get a copy of the personal data we hold about you.
- Rectification. Have anything inaccurate corrected.
- Erasure. Have your data deleted where there is no overriding reason to keep it.
- Restriction. Have us pause processing while a dispute is resolved.
- Portability. Receive data you gave us in a machine-readable form.
- Object. Object to processing based on legitimate interest. Where you object to direct marketing we stop, always, with no balancing test.
- Withdraw consent at any time, as easily as you gave it, without affecting what happened before.
- Human review of anything automated, as described in section 3.
We answer within one month. Complex requests can take up to two further months and we will tell you if that happens. We do not charge, and we will ask for enough information to be sure it is really you.
10. US state privacy rights
We are a Texas business, so the Texas Data Privacy and Security Act applies to us directly. If you live in Texas, California, Colorado, Connecticut, Virginia or another state with a comprehensive privacy law, you have rights to know, delete, correct and port your data, to opt out of targeted advertising and of the sale or sharing of personal data, and not to be discriminated against for exercising them.
To opt out of sale and sharing, use the Privacy choices link in the footer and switch off Advertising and Business visitor identification, or email privacy@blackorchid.ai. We honour Global Privacy Control. If your browser or extension sends a GPC signal we treat it as a valid opt-out request and switch advertising and business visitor identification off automatically, before anything loads. That happens whatever you click, so GPC overrides an "accept all" on this site rather than being overridden by it. Analytics stays your choice, because GPC addresses the sale and sharing of personal data rather than measurement. We record that the signal was seen alongside your preference, so there is a record of why those categories are off. You may use an authorised agent, and California residents may appeal a refused request by replying to our decision.
We do not knowingly sell or share the personal data of anyone under 16.
11. Security
Access is limited to people who need it, everything is encrypted in transit, and administrative access requires multi-factor authentication. Client systems stay in the client's own accounts wherever possible, so their data remains theirs. No system is perfectly secure, and if a breach affects your rights we will notify you and the relevant regulator as the law requires.
12. Children
Our services are for businesses. We do not direct them at children and we do not knowingly collect data about anyone under 16. Tell us if you believe we have and we will delete it.
13. Changes
When we change this policy we update the date at the top. If a change materially affects your rights we will say so clearly on this page, and we will ask for your consent again where consent is the basis.
14. How to contact us or complain
Email privacy@blackorchid.ai for any request, question or objection. That address reaches a person, not a queue. Write to us at Corvo Security LLC, 200 University Blvd, STE 225-389, Round Rock, TX 78665, United States.
If you are in the EEA you can complain to your national supervisory authority. If you are in the UK you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you came to us first, and we will try to put it right.