Privacy policy

What Orlo collects on myorlo.com, why, who helps us and the choices you have.

The short version

We collect what you give us, like your name and email. If you say yes, we also learn how the site is used.
We use it to run your account and send the emails you choose.
We do not sell your information. We do not use it for targeted ads.
Analytics tools load only if you say yes. They stay off if your browser sends Global Privacy Control.
You can see, fix or delete your information. Delete your account on your account page, or email hello@myorlo.com.
Orlo is not therapy or a medical service. Please do not send us health information.

This policy covers myorlo.com. The site is run by Orlo Platforms, Inc. ("Orlo," "we" or "us").

What we collect and why

When you join the Orlo list

We collect your first name, your email and the emails you choose. One of those choices is taking part in research: tick it and we may email you about studies and surveys you can join. We also record the page you used, when you joined and the consent wording you agreed to.

We use this to send the emails you asked for and to keep a record of your consent. Joining is free, and there is nothing to buy. Saying yes to research emails is not joining a study. Each study explains itself and asks separately, and you can say no.

We do not ask you to confirm your email address before the first email. So if someone types your address into the form, you may get a confirmation email you did not ask for. Every one of our list emails has an unsubscribe link, and you can also email hello@myorlo.com and we will remove the address.

When you create an account

You can sign up with an email and password, or with Continue with Google. Your account stores your first name, your email, when you joined and how you sign in.

If you use a password, we store only a scrambled version, called a hash. No one at Orlo can read your password. If you use Google, Google sends us your name, your email, a link to your profile photo and a Google account ID. We do not get your Google password or contacts.

We use this to sign you in and let you change your emails. We also email you to confirm your address, reset your password and tell you about changes to your account. Links to confirm an account or reset a password work once and expire after 1 hour.

When you contact us as a partner or investor

The Partners page form sends your name, email, company or firm and message to HubSpot, our contact management service. We also record whether you chose partnering or investing, when you sent it and that you agreed to a reply.

Approved Orlo staff use these details to review and answer you. Sending an inquiry does not join the VIP list or sign you up for marketing emails. Please do not send health information, passwords or confidential documents.

When you email us

If you write to hello@myorlo.com, we keep your message and our reply in our Google Workspace mailbox so we can help you.

Site analytics, only if you say yes

On your first visit, we ask if you allow analytics. If you say no, or do not answer, the tools do not load. If your browser sends Global Privacy Control, they do not load and we do not ask.

If you say yes, we use two tools:

Google Analytics 4 counts visits and actions. Examples are pages viewed, buttons clicked, sections viewed, articles read, links to other sites, and reservations started or finished with their tier and amount.
Microsoft Clarity makes heatmaps and session replays. A heatmap shows where people click and scroll. A session replay is a recording of how the page moved during a visit, like scrolls, clicks and taps. We mark every form on this site so Clarity hides what you type into it.

These tools collect details about your device and browser, a rough location based on your network address, and a random ID saved in a cookie. We never send them your name, email, password or messages. We use analytics to learn which pages help people and to fix problems. We do not use them for ads.

You can change your choice at any time with the analytics setting in the site footer. Turning analytics off stops new collection. It does not remove what was already collected. To ask about that, email hello@myorlo.com.

Running and protecting the site

GoDaddy hosts myorlo.com. Like most web hosts, it keeps standard server logs. They include your network (IP) address, the page you asked for, the time and your browser type.

Forms and accounts are handled by our server code at Supabase. To stop abuse, we turn your network address or email into a one-way code, called a hash, and count tries. The code cannot be turned back into your address. These codes expire within an hour and are then deleted. Supabase also keeps short technical logs of requests.

Share buttons open your device's sharing options or copy a public link. Social networks get information only if you choose to visit or share with them.

Cookies and browser storage

Cookies are small files your browser keeps for a website. We use these:

__Host-orlo_at and __Host-orlo_rt keep you signed in, for up to 30 days. They are needed for your account. Page scripts cannot read them.
orlo_signed_in tells the page to show your account menu. It holds no name or email. It lasts up to 30 days.
__Host-orlo_oauth protects Continue with Google. It lasts 10 minutes.
Analytics cookies are set only after you say yes. Google Analytics uses cookies that start with _ga. Microsoft Clarity uses _clck and _clsk, and Microsoft may set its own cookies, such as MUID.

Your browser also saves some settings on your device, like your analytics choice, accessibility settings and an email you started typing. This stays on your device. We do not use advertising cookies or ad pixels.

Health information

Orlo is not therapy and is not a medical service. We do not ask for health information. Please do not send it in forms or emails.

We do not use the pages you read to guess your health, diagnose you or decide whether you are neurodivergent. We do not send what you read on this site to advertisers.

How we use information

To run your account and sign you in safely.
To send the emails you chose, and emails about your account.
To answer partner, investor and support messages.
To learn how the site is used and make it better, only if you allow analytics.
To stop spam, fraud and abuse.
To follow the law, including tax and accounting rules, and to enforce our terms.

Who helps us

We use these companies to run Orlo. They handle your information for us, under their contracts with us.

Supabase stores accounts, sign-in details and the one-way codes used to stop abuse. It also runs our server code. Its servers are in the United States.
HubSpot is our contact management service. It holds your name, email, email choices and consent record. Its servers are in the United States.
Google Workspace sends our emails from hello@myorlo.com and keeps our mailbox.
GoDaddy hosts the website and keeps server logs.
Google Analytics and Microsoft Clarity give us analytics, only if you say yes.

Google and Microsoft also collect some information directly and have their own privacy policies: Google (opens in a new tab) and Microsoft (opens in a new tab).

We may also share information when the law requires it, to protect someone's safety or rights, or with your permission. If Orlo merges with or is sold to another company, your information may move with it. This policy will still apply, and we will tell you first.

What we do not do

We do not sell your personal information.
We do not share it for targeted ads based on your activity across other sites. Laws call this "cross-context behavioral advertising."
We do not use ad pixels or give your information to data brokers.
We have not done any of these things in the past 12 months.

How long we keep it

Accounts: while you have one. When you delete your account, we delete your sign-in details right away, turn off all your list emails and remove your HubSpot contact. HubSpot fully erases removed contacts within about 90 days.
Email choices: until you delete your account or ask us to delete them. If you unsubscribe, we keep a record of that choice so we respect it.
Partner and investor inquiries: while the conversation or business relationship matters, then we delete them.
Abuse-prevention codes: less than one hour.
Analytics: Google Analytics keeps event data for up to 14 months. Microsoft Clarity keeps most session replays for about 30 days and heatmap data for up to 13 months.
Server logs and backups: our providers keep these for their usual, limited periods.

Your choices and rights

Emails: every list email has a link to change your emails or unsubscribe. You can also change them on your account page.
Your account: change your name or password, or delete your account, on your account page.
Analytics: change your choice in the site footer, or turn on Global Privacy Control in your browser.

Depending on where you live, including California and many other US states, you may have the right to:

Know what personal information we have about you, how we use it and who we share it with, and get a copy.
Correct information that is wrong.
Delete your information.
Opt out of the sale of your information, sharing for targeted ads and certain profiling. We do not do these things.
Limit the use of sensitive information. We do not ask for it.
Be treated the same when you use these rights. We will not charge you more or give you worse service.

We honor these requests for anyone in the United States, wherever you live.

How to ask. Email hello@myorlo.com with "Privacy request" in the subject. To protect you, we check that the request comes from you, usually by emailing the address we have on file. We answer within 45 days. If we need more time, we will tell you why, and we may take up to 45 more days. Someone you choose, called an authorized agent, can ask for you with your signed permission. We may still check with you.

If we say no. You can appeal by replying to our answer. We will respond within 45 days. If you still disagree, you can contact your state attorney general.

Some information we must keep, even after you ask us to delete it. An example is a record that you unsubscribed, so we keep respecting it.

How we protect it

The site uses HTTPS. Sign-in cookies cannot be read by page scripts. Our database is locked so only our server can reach it, and our secret keys stay on the server. Passwords are stored as hashes. Only approved Orlo staff can see your details.

No system is perfect. If a security problem affects your information, we will tell you as the law requires.

Children

This website is not for children under 13. If you are under 13, please do not create an account, join the list or send us information. If we learn we have information from a child under 13, we will delete it. Parents or guardians can email hello@myorlo.com.

If you live outside the United States

Orlo is based in the United States, and our providers keep your information in the United States. If you use the site from another country, your information is sent to and kept in the United States. Privacy laws here may be different from where you live.

Video stories

Video submissions are not open yet. The recording preview is for testing only. No video is sent to research from the public site.

Before submissions open, this page will explain private storage, who can see a story, how long it is kept and how to withdraw it. You will be asked for clear consent before sending. Joining the email list will stay separate.

Changes to this policy

When we change this policy, we will post it here and update the date below. If a change is important, we will tell you by email or on the site before it takes effect.

Contact us

Email hello@myorlo.com. You can also write to Orlo Platforms, Inc., Orlo Platforms, Inc. 332 E. 1975 N. Pleasant Grove, Utah 84062.

Effective September 19, 2026. Last updated September 19, 2026.