1. 适用范围与负责人
本政策说明 Orrio 网站、账号及邮件助理如何处理个人信息，包括用户提交的资料和与助理通信的其他人员的信息。Orrio 的经营者负责本服务中的个人信息处理；具体身份、所在地区与隐私联系邮箱须在正式开放前公布。
本政策不把你的邮件内容变成公开资料。Paddle 的交易处理及其他服务商自身的处理活动，还受各自政策和实际合同约束。
2. 我们处理的信息
- 账号信息：登录邮箱、认证标识、助理邮箱、发件人白名单及设置。
- 任务资料：邮件正文、主题、收发地址、附件、历史对话、指令、偏好、记忆、生成文件及任务状态。
- 支付信息：订单编号、商品、币种、金额、付款与退款状态、会员期限；核查时可能访问付款邮箱及账单地址。支付验证资料由收银台处理，我们不收集完整银行卡号或安全码。
- 运行与支持记录：请求时间、网络地址、错误和安全日志，以及你主动发送的支持沟通。
3. 处理目的与依据
这些信息用于验证登录、接收和执行任务、保留对话上下文、发送结果、维护会员与账单、处理支持请求，以及保障安全和处理争议。拒绝提供必要信息可能导致相关功能不可用。
在适用法律允许的范围内，处理依据包括履行服务合同、履行法定义务，以及保障安全的合法利益；依法需要同意的处理应另行取得有效同意。本政策本身不代替跨境传输、敏感信息或其他依法要求的单独同意。
4. 服务商与信息分享
- 腾讯云 CloudBase：账号认证与验证码相关处理。
- AgentMail：接收、保存和发送邮件及附件。
- 阿里云百炼：处理任务所需的提示词、上下文及相关材料，生成回复；研究功能还会发送检索关键词。
- Paddle：处理收银台、付款、税务、收据和退款，其隐私政策说明其处理活动。
- 运行与存储服务商：保存任务状态、文件及运行记录。正式部署的具体服务商与地区尚待确认。
按你的任务指令参与协作的收件人会获得完成协作所需的信息。依法要求披露或调查安全事件时，也可能披露必要信息。请避免在任务中包含无关第三方的个人资料。
5. 模型训练与跨境处理
目前 Orrio 代码未包含将用户资料用于自有模型训练的流程，但不能据此承诺所有服务商均不训练。AgentMail 的公开隐私政策允许在没有另行书面约定时使用邮件内容训练模型。当前尚未确认 Orrio 账号有排除此用途的协议。
现有接入包含境外邮件服务和境内模型服务，不能承诺资料只在中国境内或只在欧洲处理。实际存储地区、传输依据及合同保障须在正式开放前核实并补充。请勿将本草案理解为已经完成跨境合规或获得你的同意。
6. 保存、删除与安全
账号、邮件和任务上下文会为持续服务而保存；会员到期不会自动删除这些资料。当前未设定统一自动删除周期，具体日志、文件、邮件、备份与账单保存期限须在上线前明确。法定留存或争议处理可能需要保留部分记录。
删除请求需要核实身份并分别处理本服务及相关服务商保存的资料，不代表已送达他人的邮件可以被收回。我们采用访问控制和账号隔离降低风险，但不能承诺绝对安全、端到端加密或即时清除所有备份。
7. Cookie、权利与联系
网站使用必要的登录 Cookie 维持会话。当前页面代码没有广告或访问分析追踪器；进入 Paddle 收银台后，其必要支付与风控技术按其政策运行。清除或禁用登录 Cookie 会影响登录。
依据适用法律，你可能享有查询、复制、更正、删除、限制或反对处理、数据可携带及撤回同意的权利，并可向主管机构投诉。撤回同意不影响撤回前合法处理。我们不会仅因你依法行使权利而歧视你。
Orrio 的隐私请求邮箱尚未公布，正式开放前必须补齐。目前没有自助一键注销或数据导出入口。Paddle 自身的数据请求可使用其隐私请求页面。
8. 未成年人和政策更新
本服务面向成年人，不主动向未满 18 周岁者提供服务。发现未成年人资料后应通过正式公布的隐私渠道申请核查。政策更新将标注日期；涉及重大变化时，按适用要求通知并取得必要同意。
English · Privacy Policy
1. Scope and responsibility
This policy covers personal information handled through Orrio’s website, accounts and email assistant, including information about people who communicate with the assistant. Orrio’s operator is responsible for processing within this service. Operator identity, location and a privacy contact must be published before launch.
This policy does not make email content public. Paddle’s transaction processing and providers’ own activities are also governed by their policies and actual agreements.
2. Information we process
- Account data: login email, authentication identifiers, assistant address, authorized senders and settings.
- Task material: email bodies, subjects, addresses, attachments, conversation history, instructions, preferences, memory, generated files and task status.
- Billing data: order IDs, products, currency, amount, payment/refund status and membership dates. Reconciliation may access payment email and billing address. Checkout handles payment authentication; we do not collect full card numbers or security codes.
- Operational and support records: request times, network addresses, error/security logs and support communications you send.
3. Purposes and legal bases
We use this information to authenticate users, execute tasks, retain context, deliver results, administer membership and billing, handle support, protect security and resolve disputes. Missing necessary data may prevent the related feature from working.
Where applicable law permits, legal bases include contract performance, legal obligations and legitimate interests in security. Processing requiring consent needs valid consent. This policy alone does not replace separate consent required for transfers, sensitive data or other regulated processing.
4. Providers and sharing
- Tencent Cloud CloudBase: authentication and verification-code processing.
- AgentMail: receiving, storing and sending email and attachments.
- Alibaba Cloud Model Studio: processing prompts, context and relevant material to generate results. Research features also send search keywords.
- Paddle: checkout, payments, tax, receipts and refunds under its Privacy Policy.
- Hosting and storage providers: task state, files and operational records. Production providers and regions remain to be confirmed.
Recipients involved in collaboration you request receive information needed for that collaboration. Necessary disclosures may also occur for legal requirements or security investigations. Avoid including unrelated third parties’ personal information.
5. Model training and international processing
Current Orrio code has no workflow for training its own models on user data. This is not a promise that every provider excludes training. AgentMail’s public policy permits model training on email content unless separately agreed in writing. An agreement excluding that use for Orrio has not been confirmed.
The integration includes overseas email services and a mainland-China model endpoint. We cannot promise China-only or Europe-only processing. Actual storage regions, transfer grounds and contractual safeguards must be verified before launch. This draft does not establish transfer compliance or obtain your consent.
6. Retention, deletion and security
Account, email and task context are retained for continuing service. Membership expiry does not automatically delete them. No uniform automatic deletion period is currently configured. Retention periods for logs, files, email, backups and billing must be defined before launch. Legal obligations or disputes may require some records to be retained.
Deletion requests require identity verification and handling across Orrio and relevant providers; they cannot recall delivered recipients’ copies. Access controls and account isolation reduce risk, but do not guarantee absolute security, end-to-end encryption or immediate removal of every backup.
7. Cookies, rights and contact
The site uses necessary login cookies to maintain sessions. Current page code includes no advertising or analytics trackers. Paddle checkout uses its own necessary payment and fraud-prevention technologies under its policy. Blocking login cookies affects sign-in.
Depending on applicable law, rights may include access, copies, correction, deletion, restriction, objection, portability, withdrawal of consent and complaints to a supervisory authority. Withdrawal does not affect prior lawful processing. We will not discriminate solely for exercising applicable rights.
Orrio’s privacy-request email must be added before launch. There is currently no self-service account-deletion or data-export control. For Paddle’s own processing, use its privacy request page.
8. Children and updates
The service is intended for adults and is not directed to people under 18. Concerns about a minor’s data should be submitted through the privacy contact when published. Updates will carry a date; material changes require notice and consent where applicable.