Privacy Policy
1. Who we are and scope
This policy explains how Orfy ("we") handles personal data when you use our platform to discover, book and pay for event & creative services, or to offer them. It covers our website and app. The legal operator responsible for your data is being confirmed and will be published here once finalised.
2. Data we collect
Depending on how you use Orfy, we collect:
- Account & identity: name, email, and (for email sign-up) a password, which is stored only in a securely hashed form.
- Sign-in providers: if you use Google or Apple, we receive your name and email from them (Apple may provide a private-relay email).
- Contact details: for vendors, a phone/WhatsApp number and Instagram handle used for review and contact (not shown publicly).
- Vendor verification: legal name, ID type (e.g. KTP / Passport / driver's licence), ID number and a photo of your ID.
- Bookings: sessions you request or accept, dates, locations and related details.
- Payments & payouts: transaction records such as amounts, status and (for vendors) bank/e-wallet details for withdrawals.
- Communications: messages you send through in-app chat and to support.
- Content you provide: portfolio images, reviews and Explore posts.
- Photo delivery: photos uploaded by vendors for your booking.
- Careers applications: the details and files you submit when applying.
- Referral applications: your social account, follower range, contact and payout information.
- Device & technical data: IP address, browser and device information.
- Cookies & analytics: see our Cookie Policy; analytics runs only with your consent.
3. How we use your data
To create and run your account; to process bookings, payments and payouts; to verify vendor identities and keep the marketplace safe; to enable communication; to provide support; to prevent fraud and abuse; to comply with legal obligations; and, only with your consent, for analytics. We do not sell your personal data.
4. Payment data
Payment information is processed by the payment provider displayed during checkout. Orfy retains transaction records needed to manage bookings, refunds, reconciliation, and payouts, but does not store full card credentials.
5. Vendor identity verification
ID documents are used only to verify vendors. They are stored privately, are accessible only to our review team, and are never shown on public pages.
6. Photo storage & delivery
Photos are stored privately and delivered to the client for their booking. Before full payment, clients see previews and blurred placeholders; original files become available after the booking is completed.
7. Sharing & processors
We share booking-related information between the client and vendor to make a booking work. We also use trusted service providers that process data on our behalf:
| Category | Provider | Purpose |
|---|---|---|
| Payment | Shown at checkout | Payment processing and payouts |
| Database & storage | Supabase | Photo and file storage |
| Resend | Transactional email | |
| Authentication | Sign-in (Google OAuth) | |
| Authentication | Apple | Sign-in (Apple) |
| Currency | api.co.id | Currency exchange rates |
| Hosting | Vercel | Website hosting |
| Hosting | Railway | Application hosting |
| Analytics | Google Analytics | Usage analytics (only after consent) |
8. International transfers
Some of our service providers may process data in countries other than your own. Where we confirm the specific storage region, we will state it here; until then, we rely on providers that apply appropriate safeguards.
9. Cookies & analytics
We use essential cookies to run the site and, only with your consent, Google Analytics to understand usage. You can accept, reject or change this at any time. See the Cookie Policy for the full list.
10. Data retention
We keep personal data for as long as needed to provide the service and to meet legal, accounting and fraud-prevention obligations, then delete or anonymise it. Specific periods marked below as "under review" are being finalised.
| Data category | Retention |
|---|---|
| Account & profile | Kept while your account is active. On deletion the record — including your email — is currently retained for security and fraud prevention; the exact period is under review. |
| Bookings & transactions | Retained as needed for the service and for legal and accounting obligations. Under review. |
| ID verification | Kept private and accessible only to the review team, for as long as needed to verify identity and prevent fraud. |
| Messages | Retained for the booking and for safety and dispute handling. Under review. |
| Delivered photos | Stored to deliver your booking; retention after completion is under review. |
| Careers applications | Kept for the hiring process; you can request deletion at any time. Under review. |
| Referral data | Kept for the referral program and payouts. Under review. |
| Analytics | Only with your consent; standard analytics cookies last up to 2 years and consent can be withdrawn. |
| Support | Kept to handle and follow up your request. Under review. |
11. Account deletion
When you delete your account, it is deactivated and any vendor profile is switched off. For security and to prevent misuse, your account record — including your email — is currently retained rather than erased immediately. If you want your data handled differently, contact us and we will act in line with applicable law. This behaviour, and its retention period, are under legal review.
12. Security
We use appropriate technical and organisational measures to protect your data, including secure storage of sensitive documents and industry-standard protection of accounts and passwords.
13. Your rights
Depending on where you live, you may have rights to access, correct, delete, restrict or object to the processing of your data, and to data portability and withdrawing consent. To make a request, contact us at hello@orfy.io.
14. Children
Orfy is not intended for children under 13 (or the age of majority in your jurisdiction). We do not knowingly collect data from children and will delete it if we learn we have.
15. Changes
We may update this policy. Material changes will be posted here with a new effective date, and where relevant we will ask for your consent again.
16. Contact
Questions or requests about this policy: contact us at hello@orfy.io.
© 2026 Orfy. All rights reserved.