Data Processing Agreement

Version 2026-10-30 · Effective 30 October 2026

This Data Processing Agreement ("DPA") is between Consolidated Technologies LLC, doing business as Orrery by Arok.AI ("Orrery by Arok.AI", "we", "us") and the business that accepts it when creating or using an Orrery account ("you"). It forms part of the Orrery Terms of Service ("Terms") and applies whenever we process Client Personal Data for you. You accept it by ticking the box at sign-up or in Setup; the account records the version, the time and the person who accepted.

"Client Personal Data" means personal data about your clients, and about the staff you add, that we process to provide Orrery. "Data Protection Law" means the laws that apply to that processing, including the EU GDPR, the UK GDPR, the Swiss Federal Act on Data Protection and the California Consumer Privacy Act as amended (CCPA), together with similar US state laws. Other terms such as "controller", "processor", "personal data breach" and "service provider" have the meanings those laws give them.

1. Scope and roles

For Client Personal Data you are the controller (or the business, under the CCPA) and we are your processor (or service provider). Annex 1 describes the processing. We are a separate controller only of account details for you and your staff, which our Privacy policy covers.

Stripe, Google, Twilio and your own website are not our subprocessors. You connect them to your own Stripe account, your staff's own Google Calendars, your own Twilio account and, to send email from your own address, your own WordPress site or mail provider, under your agreements with those companies, and Orrery passes data to them on your instruction.

2. Instructions

We process Client Personal Data only on your documented instructions, unless the law requires otherwise, in which case we tell you first unless the law forbids it. Your instructions are this DPA, the Terms, and the settings and actions you take in Orrery. We will tell you if we believe an instruction breaks Data Protection Law.

3. Confidentiality

Everyone we authorize to process Client Personal Data is bound by confidentiality, and has access only as far as their role needs.

4. Security

We keep the technical and organizational measures in Annex 2, appropriate to the risk. We may improve them over time but will not reduce the overall level of protection.

5. Subprocessors

• You give us general authorization to use the subprocessors in Annex 3.
• We impose data protection terms on each subprocessor that are at least as protective as this DPA, and we remain responsible to you for their work.
• We will give at least 30 days' notice, by email to the account owner and on this page, before adding or replacing a subprocessor. You may object on reasonable data protection grounds within that time. If we cannot address the objection, you may close your account and we will refund any prepaid fees for the unused period.

6. Requests from individuals

Orrery gives you tools to answer requests to access, export, correct or delete Client Personal Data: in Setup you can find a client, download their data, correct their name or email, or delete them.

You also instruct us to offer your clients the self-service Your data page linked from your booking pages, where a client who proves control of their email address can download their own data or delete it. We tell you when a client deletes their data through it.

If a request reaches us directly about your clients, we will not answer it ourselves beyond pointing the person to you or to that page, and we will help you respond as far as reasonably possible.

7. Personal data breaches

We will notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Client Personal Data. The notice will describe, as far as then known, what happened, the data and people affected, likely consequences, and what we have done and will do. We will add details as we learn them, take reasonable steps to contain the breach, and help you meet your own duties to notify authorities and clients.

8. Assessments and authorities

Taking into account the information available to us, we will reasonably help you with data protection impact assessments and prior consultations with supervisory authorities about Orrery.

9. Deletion and return

• You can download all your business's data at any time from Setup.
• When you close your account in Setup, we delete all Client Personal Data at once, except where the law requires us to keep it. Backups age out within 30 days.
• While the account is open, client details are deleted automatically 3 years after a client's last appointment, or 30 days after a booking that was never completed. Booking and payment amounts are kept without any personal details.

10. Information and audits

We will make available the information reasonably needed to show we meet this DPA, starting with written answers to your security questions. If that is not enough, or a supervisory authority requires it, you may audit our compliance once in any 12 months, on at least 30 days' written notice, during business hours, at your cost, through an independent auditor bound by confidentiality, and without access to other customers' data.

11. International transfers

Orrery stores Client Personal Data in the United States. Where Data Protection Law restricts a transfer from the European Economic Area, the UK or Switzerland to us:

• EEA: the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), are incorporated into this DPA. Clause 7 (docking) applies; in Clause 9 Option 2 (general authorization) applies with the notice period in section 5; the optional wording in Clause 11 does not apply; in Clauses 17 and 18 the law and courts are those of Ireland. Annexes I and II of the Clauses are completed by Annexes 1 and 2 of this DPA, and the supervisory authority is the one competent for you.
• UK: the International Data Transfer Addendum issued by the UK Information Commissioner applies on top of those Clauses, with the tables completed from this DPA and either party able to end it as its Section 19 allows.
• Switzerland: the Clauses apply with references to the GDPR read as the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner as the competent authority for transfers under that Act.

If we certify to the EU-US Data Privacy Framework or a successor, we may rely on it instead while it remains valid.

12. US state privacy laws

Where the CCPA or a similar US state law applies, we act as your service provider (or processor) and:

1. Process Client Personal Data only for the limited and specified business purpose of providing Orrery as described in Annex 1.
2. Do not sell or share it, as those terms are defined in the CCPA.
3. Do not retain, use or disclose it for any purpose other than that business purpose, including any commercial purpose, or outside our direct business relationship with you, except as the CCPA permits.
4. Do not combine it with personal information we receive from or on behalf of anyone else, or collect ourselves, except as the CCPA permits.
5. Comply with the CCPA and give the personal information the same level of privacy protection the CCPA requires of you.
6. Will notify you if we can no longer meet our obligations under the CCPA.
7. Allow you to take reasonable and appropriate steps to make sure we use the personal information consistently with your CCPA obligations, through section 10.
8. Allow you, on notice, to take reasonable and appropriate steps to stop and remediate unauthorized use, including by deleting data with the tools in Setup or closing the account.
9. Will help you respond to consumer requests as described in section 6.

We certify that we understand and will comply with these restrictions.

13. Your responsibilities

• You have a lawful basis for the processing, tell your clients about it (for example in your own privacy notice), and link it from your site.
• You do not use Orrery to collect special categories of personal data, such as health information, in booking questions, fields or notes. Orrery is not designed for that data.
• Where you book children's programs, you obtain any consent the law requires and ask only for what you need about each child.
• You keep your staff's sign-in emails secure and remove people who no longer work with you.

14. Liability and order of precedence

Each party's liability under this DPA is subject to the limits in the Terms, except where Data Protection Law or the Standard Contractual Clauses forbid such limits. If this DPA conflicts with the Terms, this DPA wins on data protection matters; if it conflicts with the Standard Contractual Clauses, the Clauses win.

15. Term

This DPA lasts as long as we process Client Personal Data for you. We may update it to reflect changes in law or in Orrery, with 30 days' notice for any change that reduces your protection. The version you accepted, and when, is recorded in your account.

Contact for this DPA: [email protected], Consolidated Technologies LLC, 425 S 1000 E, 512C, Salt Lake City, UT 84102.

Annex 1: Processing details

Annex 2: Security measures

• Encryption in transit: every page, API call and connection to subprocessors and connected services uses HTTPS.
• Encryption at rest: the hosting provider encrypts the database at rest with AES-256-GCM. Google Calendar tokens are additionally sealed with AES-256-GCM using a key held only as a secret in the hosting environment.
• Access for staff: sign-in uses single-use links emailed to the staff member that expire after 20 minutes; there are no passwords to steal. Sessions use a signed cookie marked HttpOnly, Secure and SameSite=Lax, valid for 30 days.
• Access for clients: booking management and data links are signed, and data links expire after one hour.
• Least privilege: owner-only actions (exports, deletion, account closure, money rules) are checked on the server. Every database query is scoped to the signed-in business.
• Request protection: state-changing requests must come from Orrery's own origin. Staff and data pages refuse to be framed by other sites.
• Payments: card details are entered only on Stripe Checkout and never reach Orrery. Orrery's Stripe key is restricted to the permissions it needs.
• Phone and text: Twilio credentials are sealed with AES-256-GCM like calendar tokens. Every call webhook must carry a valid Twilio signature and, for a session, a signed token tied to that booking. Calls are connected, not recorded.
• Calendar access: Orrery asks Google only for permission to manage events it creates, to read free/busy times, and to create and manage the one "open for bookings" calendar a staff member may choose to use. Busy and open times are not stored. Tokens are revoked when a staff member is removed or the account closes.
• Minimization: no tracking or advertising cookies; booking pages load nothing from third parties. Records of privacy requests store a one-way hash of the email, not the email.
• Resilience: the database keeps point-in-time recovery for 30 days, which also bounds how long deleted data survives in backups.
• Testing: automated tests cover booking, payment, export, deletion, retention and account closure before each release.
• People: production access is limited to named personnel under confidentiality, with multi-factor sign-in to the hosting, email and payment dashboards.

Annex 3: Subprocessors

Not subprocessors: Stripe, Google, Twilio and your own website, which you connect under your own agreements with them (section 1).