The short version. Your uploaded figures are used to draw your dashboards and for nothing else. They are not sold, not shared with advertisers, and not used to train anything. We set two cookies, both of which are needed to sign you in safely, and no trackers at all. You can delete a dataset yourself at any time, and you can have the whole workspace erased by asking.
Who we are
Orkestar is operated by Beehive Reporting d.o.o. (OIB 76667399187), registered at Savski gaj III. 15, Zagreb, Croatia, entered in the register of the Commercial Court in Zagreb under number 081604474. For anything on this page — a question, a copy of your data, a deletion — write to support@orkestar.eu and a person will read it.
Which of us is responsible for what
Two different things happen here, and they carry different responsibilities.
Your account, and the waitlist. We decide what to collect and why, so we are the controller of it. That is the subject of this page.
The data you upload. You decide what is in the file. If it contains personal data — a customer who is a named individual, a sales representative, a sole trader — you remain the controller and we act only on your instruction as your processor. What that means in practice is set out in the data processing statement.
What we collect
This list was written by reading the code, not by copying another company’s policy.
Your account
To create your workspace, sign you in, and let you back in when you forget your password.
| What | Detail |
|---|---|
| Email address | You type it into the signup form. It is stored as both your username and your email address. |
| Password | Stored only as a salted hash (PBKDF2-SHA256), never as text. Nobody, including us, can read it back. |
| Company name (optional) | If you give one it names your workspace and forms its URL slug. Leave it blank and the workspace is named after your email. |
| Workspace record | Your plan, your trial end date, the email the signup came from, and the date you were last active (stamped at most once a day). |
| Seat | Whether you are a builder, contributor or viewer in your workspace. |
The data you upload
To parse your file into figures and draw your dashboards. Nothing else.
| What | Detail |
|---|---|
| The file itself | Kept as uploaded so a column mapping can be re-applied without a re-upload. Up to 64 MB per file, up to 100 datasets per workspace. |
| The column names we detected | The headers found in your file and the canonical field each was mapped to. |
| The parsed figures | The rows the dashboards read: period, product, brand, category, customer, market, channel, promotion flag, volume, gross sales, discounts, off-invoice spend, net sales, cost of goods, pack size. |
| Whatever else your export contains | You choose the file. If a column such as "customer" names an individual — a sole trader, a named contact — then that is personal data, you remain in control of it, and we process it only to build your dashboards. |
Security and activity records
So an account owner can see who did what, and so abuse can be investigated.
| What | Detail |
|---|---|
| Audit trail | Significant actions: timestamp, username, the action, what it affected, a structured before/after payload, and the IP address the request came from. |
| Sessions | A server-side session row per signed-in browser. |
| In-app notifications | Messages addressed to you — mentions, sign-off hand-offs, scheduled reports, inactivity warnings. |
If you write to us through the contact form
To answer you. No account is created and none is needed.
| What | Detail |
|---|---|
| Email address | The one you type into the contact form. |
| What you are asking about | A question about the analytics, early access to the planning modules, or something else. |
| An optional note | Free text, only if you write one. |
| Up to ten short context values | Such as the page or campaign you arrived from. Each is capped at 200 characters and stored as text. |
If your organisation uses single sign-on
To match you to the right account without trusting an email address alone.
| What | Detail |
|---|---|
| Your identity at your provider | The issuer and subject your identity provider asserts. That pair, not your email address, is what identifies the account — which is what stops someone taking an account over by claiming the same email elsewhere. |
| The link record | Your username and email address at the moment the account was linked, when you last signed in through the provider, and a minimised snapshot of the claims it sent. None of this is collected unless an administrator in your organisation configures a provider. |
What we do not collect
There is no analytics script, no tag manager, no advertising pixel and no third-party font on this site or in the app, so nothing is collected about you as you browse. See the cookie notice, which is short for that reason.
Why we are allowed to hold it
| What | Basis | Because |
|---|---|---|
| Your account and the data you upload | Performance of a contract | We cannot give you a workspace, or dashboards, without them. |
| Security records, rate limits and the audit trail | Legitimate interests | Keeping other people out of your workspace, and being able to show who changed what. |
| Service emails — password resets, inactivity warnings, reports you scheduled | Performance of a contract | They are part of running the account. They are not marketing and cannot be switched off while the account is open. |
| Your waitlist entry | Consent | You typed your address in to hear from us. Ask and it goes, with no consequence. |
| Records kept for legal reasons | Legal obligation | Where a law requires us to keep something, such as billing records. |
What we never do
- We do not sell personal data, and we do not share it with advertisers or data brokers.
- We do not use the contents of your uploads to train models, build benchmarks, or produce anything anyone else sees.
- We do not run advertising, analytics or social-media trackers on the marketing site or in the app.
- We do not profile you or make automated decisions with a legal or similarly significant effect.
- We do not require a payment card to try the product, so we never see your card details.
Who else touches it
Running a service means engaging a small number of suppliers: somewhere for the application to run, somewhere for the database to live, something to deliver a password-reset email. Each one is named, with what it can see, on the sub-processors page. None is an advertising or analytics provider.
Beyond those, we disclose personal data only where a law or a valid legal order requires it, and in the event the business is sold or merged — in which case the buyer is bound by this policy until you are told otherwise and given the chance to leave.
Where it is held
The application, the database and the copies of your uploaded files are hosted in Paris, France (EU). If that ever changes, this page changes before the data moves.
How long we keep it
Where a line below promises an automatic clean-up, a scheduled job runs it — not someone remembering to tidy up. Where deletion happens on your request instead, the line says so.
| What | Kept for | Detail |
|---|---|---|
| The raw file you uploaded | Until you delete the dataset, and at most 30 days | Deleting the dataset erases the stored file with it. Even if you keep the dataset, the file copy is discarded 30 days after upload — whether or not you ever finished mapping its columns — and only the figures already read out of it remain; re-mapping after that needs a re-upload. |
| Your parsed figures and datasets | Until you delete them | Delete a dataset in the app and the dataset, its column mapping, every figure derived from it and the stored file all go together — the deletion either completes fully or fails and leaves the dataset in place, never half-done. |
| Uploaded data in a free workspace nobody signs into | Around 330 days, then 30 days’ notice | We email a warning, and if nobody signs in during the grace period the uploaded data is cleared. The account itself is kept — sign in and you can upload again. Signing in at any point before the clear-out cancels it. |
| Exports you generate (board packs, workbooks) | 30 days after the export finishes | The file is deleted; the record that the export ran is kept. |
| Single sign-on handshake records | Until used, or 5 minutes | Single-use records created while an SSO login is in flight. |
| Audit trail | For the life of the account — longer where a legal or accountability reason requires | It is the record of who changed what, so it outlives the objects it describes. No automatic deletion runs against it today. |
| Waitlist entries | Until you ask us to remove yours | There is no automatic expiry. One entry per address — submitting again updates it rather than adding another. |
| Your account | Until you ask us to close it | See “Deleting your data”. |
Deleting your data
A dataset. Delete it in the app and the dataset, the columns we detected, every figure derived from it and the stored copy of the file you uploaded all go together. If the file cannot be erased for any reason the whole deletion fails and tells you, rather than reporting success and leaving the file behind. Nothing about that needs us.
Everything. Write to support@orkestar.eu from the address on the account and ask for the workspace to be closed. We complete it within 30 days and confirm when it is done. Erasure covers:
- Every dataset in your workspace, the parsed figures built from them, and the stored copies of the files you uploaded.
- Every export artifact generated for your workspace.
- The workspace record itself, including the plan and trial history attached to it.
- Every user account bound to that workspace, and the sessions and notifications belonging to them.
- Your entry on the waitlist, if the same address is on it.
Three things are deliberately outside that, and it is better that you know now:
| What survives | Why |
|---|---|
| The audit trail | Entries record that an action happened and by which username. They are what makes the workspace auditable, and are retained where there is a legal or accountability reason to keep them. |
| Backups | A restorable backup can hold a copy until that backup rolls off its own cycle. It is not returned to live service. |
| Records we must keep | Anything a law requires us to retain, such as billing records for a paid subscription, for as long as that law requires. |
Your rights
You can ask us to give you a copy of what we hold about you, correct it, delete it, restrict what we do with it, or object to it. You can ask for your data in a portable form — for the figures you uploaded, the file you gave us is that form. Where we rely on your consent, such as the waitlist, you can withdraw it at any time without having to explain.
Write to support@orkestar.eu. We answer within one month. We do not charge for it, and we do not ask for more identification than we need to be sure you are you.
If we get it wrong, you can complain to a data protection supervisory authority — Agencija za zaštitu osobnih podataka (AZOP), Zagreb, Croatia — or to the authority where you live or work.
How it is protected
Only measures that exist in the running system are listed. Encryption at rest, backup regimes and physical security are properties of the hosting providers named on the sub-processors page, and are not claimed here as though they were ours.
| Measure | What it means |
|---|---|
| Separation between customers | Every signup gets its own workspace, and records carry the workspace they belong to. Queries are scoped to the signed-in user’s workspace by default rather than by each screen remembering to filter. |
| Password storage | Salted PBKDF2-SHA256 hashes. Passwords are checked against a minimum length, similarity to your own details, a list of common passwords, and being all-numeric. |
| Session and form protection | Session cookies are HttpOnly; over HTTPS both cookies are Secure. Every state-changing request carries a CSRF token. |
| Rate limiting | Signup, password reset, waitlist submission and file upload are rate-limited. Password reset is additionally limited per target address, so varying a source address does not lift the ceiling on any one inbox. |
| Password reset | Links are single-use and time-limited: spending one changes the password, which invalidates the link that produced it. |
| Audit trail | Significant actions are recorded with actor, target, timestamp and IP. |
No system is perfect. If you find a weakness, write to support@orkestar.eu and you will get a real answer rather than a legal one.
Children
This is a tool for finance teams. It is not offered to anyone under 16, and we do not knowingly collect their data.
Changes
If this policy changes in a way that affects what we do with data you have already given us, we will tell account holders by email before it takes effect, not after. The date at the top always reflects the version you are reading.