Privacy Policy

1. Introduction

orppio is software for professional pet relocation agencies. An agency uses it to run a relocation from the first enquiry through quotation, activation, preparation, travel and arrival: enquiries and leads, clients and their pets, quotations and payments, journeys, tasks and documents, a client portal, and the email and WhatsApp conversations that go with all of it.

orppio is operated by orppio ("orppio", "we", "us"). This policy applies to orppio.com, to the orppio application — the staff workspace, the client portal and the partner workspace — and to the public enquiry, quotation and payment pages orppio serves on behalf of an agency.

It does not cover an agency's own website, its own email system, or anything an agency does outside orppio. It also does not cover the separate services an agency may connect to orppio, such as WhatsApp, Stripe or Google Ads, each of which has its own terms and privacy policy.

2. Who this policy is about

Three different kinds of people appear in orppio, and it matters which one you are.

Agency users

The staff of a pet relocation agency, and the staff of a partner agency invited onto a single case. They have an orppio login, and we hold information about them directly.

Agency customers

Pet owners and the people arranging a relocation. Their information is entered by the agency, or supplied by them through the agency's own enquiry form, quotation page or client portal. We hold and process it on that agency's instructions, to provide the agency with the service — see section 7.

Visitors

People who read orppio.com or ask us for access to the platform, and people who open an agency's public pages without signing in.

3. Information we collect

The categories below are the ones the application actually stores. Not every agency or every relocation produces all of them: most of these fields are optional, and what is recorded about a particular customer or pet is decided by the agency handling the case.

Account and profile information

• Name, email address and password (stored only as a one-way hash, never in readable form).
• Preferred time zone and language, and an optional profile picture.
• Which agencies you belong to, your role in each, and the permissions that role carries.
• Sign-in sessions, each recording the IP address and browser user agent they were created from.
• Invitations sent to you, and when you accepted one.

Agency and business information

• Trading name, legal company name, company registration number and tax or VAT number.
• Business address, contact email and phone number, logo, currency, time zone and language.
• Bank account details the agency publishes so its own customers can pay it.
• Invoice and quotation settings, service catalogue, packages and pricing.

Access requests from our website

When an agency asks for access at /request-access, we collect the name, email address, phone number, company name, website, country and city of the person asking, together with their answers about the agency's size, tools, case volume and goals, anything they choose to write in free text, and who referred them. We also record how they arrived — the first page they opened on our site, the referring website, and any campaign parameters in the link.

Client information

• First and last name, email address and phone number.
• WhatsApp number, LINE ID and WeChat ID where a client gives them, and which of these they prefer to be contacted on.
• Home address and, separately, the billing name, company, address and tax identifier an invoice should be made out to.
• Nationality and preferred language.
• Where a journey requires it, travel identity details: full name as it appears on the document, date of birth, gender, passport number, issuing country, and issue and expiry dates.

Pet information

• Name, species, breed, colour, sex, date of birth and whether the animal is neutered.
• Weight and measurements, and the travel crate chosen for the animal.
• Microchip number and the date it was implanted.
• Free-text health notes written by the agency, and a photo of the animal.
• Vaccinations: vaccine type, product name, batch number, the date given, validity, and the veterinarian's name.
• Rabies antibody titer tests: laboratory, sample and result dates, the measured result and whether it passed.
• Veterinary appointments, import permits, flight bookings and ground transport arranged for the animal.

Relocation and commercial records

• Enquiry details: origin and destination country, city and airport, estimated dates and flexibility, travel method, preferred airline, and whatever the client wrote to describe their situation.
• Quotations, including the items, quantities, prices, discounts, taxes, totals, currencies and payment schedule fixed at the time they were issued.
• Acceptance or decline of a quotation, including the name the client signed with and any reason they gave for declining.
• Payments, invoices and payment schedules.
• Journeys, milestones, tasks, staff assignments, notes, and an append-only activity timeline of what happened on a case and who did it.

Files and documents

Files are uploaded by agency staff, by clients through the portal, or received on an agency's behalf as email and WhatsApp attachments. In practice they include vaccination certificates, rabies titer reports, import permits, veterinary and travel paperwork, photos of pets, profile pictures, an agency's own PDF templates and the documents generated and signed from them, drawn signature images, invoices, and any other file somebody chooses to attach to a case or a message.

Communications

orppio keeps the correspondence on a case as part of the business record. For email, in both directions, that means the sender and recipients (to, cc and bcc), the subject, the plain-text and HTML bodies, the RFC message identifiers used for threading, attachments, timestamps, and which staff member sent it. Where our email provider reports them, we also record delivery, open, click, bounce and spam-complaint events for a message. WhatsApp is covered separately in section 4.

Payment information

Where an agency has connected Stripe, its customers can pay by card on orppio-served pages. Card details never reach orppio's servers. They go from the payer's browser directly to Stripe. What we store is the outcome: the amount, currency, status, timestamps, the identifiers Stripe returns, and any billing name and address the payer entered for their invoice. We also record payments an agency marks as received by bank transfer or another method, with the reference the agency enters.

Technical and usage information

• Server logs of requests to the application, including timestamps, request identifiers and error diagnostics. Personal data submitted in forms — names, phone numbers, addresses, message bodies, passport and microchip numbers, attachments and more — is filtered out of these logs by configuration before they are written.
• Visitor activity on an agency's own public pages (its enquiry form, a quotation it sent, the payment page): which registered actions were taken, the page address, the referring address, the IP address, and the browser, operating system and device type parsed from the user agent. Page addresses are reduced to scheme, host, path and campaign parameters before being stored, so a token or an email address in a link is never kept. This is shown to the agency's own staff on the lead and quotation pages and is not used for anything else.
• A one-time lookup of the country, continent and network operator for each IP address seen on those pages, performed by IPinfo. Private and local addresses are never sent out.
• Attribution: campaign parameters, advertising click identifiers, and the landing and referring addresses of the visit a lead came from.
• Visits to orppio's own website — orppio.com's home page, pricing, the access request and these legal pages; not an agency's pages, and nothing behind a sign-in. For each visit: the pages viewed; clicks on links, buttons and calls to action, recorded as the label on them and where they lead; whether the product film was started and how far it was played; the referring address and the campaign parameters of the link that was followed; the IP address; the browser, operating system and device type parsed from the user agent; the screen and window size; and the browser's language and time zone. Nothing typed into a form is recorded. Addresses are reduced to scheme, host and path, plus campaign parameters on our own pages, before being stored. If an access request is sent, it is linked to the visit it was sent from. This is read only by orppio's own operators, to understand where interest in orppio comes from.
• A country, region and city for each of those visits, worked out from the IP address using a database held on our own servers (GeoLite2, created by MaxMind). No address is sent to anyone to do this.

4. WhatsApp Business and Meta Platform data

An agency may connect its own WhatsApp Business Account to orppio through Meta's official WhatsApp Business Platform (Cloud API). Once connected, messages sent to the agency's business number arrive in the agency's orppio inbox, and authorised staff can reply from there. Our Meta application is named orppio.

orppio uses Meta's official APIs and webhooks and nothing else. We do not scrape WhatsApp, we do not automate or read the WhatsApp or WhatsApp Business mobile or desktop applications, and we do not access anyone's personal consumer WhatsApp account. We do not access WhatsApp groups and we do not process group messages. An agency connects its own business account, with its own credentials, and can disconnect it at any time.

What we process

Business account details

The WhatsApp Business Account identifier, the business phone number identifier, the display phone number, the verified business name and the quality rating Meta reports for it, the connection status, and when the connection was made, last synchronised and last used.

Contact details

For each person who messages the connected business number, or whom the business messages: their WhatsApp identifier (their phone number in digits), the phone number itself, and the WhatsApp profile name they have chosen to display.

Message content and metadata

The text of each message, the message type, Meta's message identifier, the direction, whether it came from the customer, from orppio or from the agency's WhatsApp Business app, the identifier of the message being replied to, the timestamps, and — for outbound messages — which staff member sent it.

Delivery status

Whether a message was sent, delivered, read or failed, when each of those happened, and the failure code and reason Meta returns when one fails.

Media

Images, documents, audio and voice messages, videos and other supported WhatsApp media sent to or from the connected number, with the file name and media type. Incoming media is downloaded from Meta's media endpoint and stored in orppio's object storage so the agency can still open it after Meta's own link expires.

Messages from the WhatsApp Business app

Where an agency also uses the WhatsApp Business mobile app on the same number, Meta forwards copies of the messages it sends there. Those are recorded in the same thread so the agency's record of the conversation is complete.

Webhook metadata

The webhook payload of each change Meta delivers, with the field it relates to, when it arrived and whether it was processed. Stored so that a redelivered webhook is recognised and not acted on twice, and so a failed delivery can be diagnosed.

Why we process it

• To deliver the agency's messages to its customers and receive their replies.
• To display the conversation in the agency's orppio WhatsApp inbox.
• To let authorised staff of that agency read and reply to it.
• To reflect delivery, read and failure status so staff know what actually reached the customer.
• To attach a conversation to the client record it belongs to, where the number matches one unambiguously, so a case's communication history is in one place.
• To notify the agency's own team that a new message has arrived.
• To operate, secure and troubleshoot the integration — including verifying that a webhook genuinely came from Meta and recognising duplicate deliveries.

Matching a WhatsApp contact to a client record happens once, when the contact is first seen, and only on an unambiguous phone-number match. The webhook never writes to a client record. Any other linking of a conversation to a client is a deliberate action taken by agency staff.

WhatsApp is a Meta product. Messages sent through it also pass through and are handled by Meta under Meta's own terms and policies, which we do not control — see WhatsApp's Business Policy and Meta's Privacy Policy.

5. Credentials for connected services

Connecting a third-party service to orppio sometimes requires a credential authorised by the agency. Where it does, we store that credential securely and only to operate the connection the agency asked for.

• WhatsApp. The access token an agency's Meta business authorises is the one provider credential orppio stores. It is encrypted at rest in our database, is never shown in full in the interface, is excluded from our logs, and is erased the moment the agency disconnects the integration.
• Stripe. orppio stores no Stripe credential at all. An agency connects an account it already owns, and charges are made against that account using orppio's own key together with the account's identifier.
• Google Ads. The credentials used are orppio's own platform credentials. An agency's record holds only the identifier of its advertising account.

We do not publish the names, formats or locations of any secret, and nothing in this policy should be read as a description of how our systems are configured.

6. How we use information

We use the information described above to:

• provide and operate orppio and the features an agency has chosen to use;
• run the relocation workflow itself — enquiries and leads, clients and pets, quotations, journeys, tasks and documents;
• send, receive, thread and display an agency's communications with its customers, by email, WhatsApp and the client portal;
• generate and sign documents from templates an agency uploads;
• process payments and produce invoices and receipts;
• authenticate users, keep accounts secure, enforce roles and permissions, and prevent abuse;
• notify agency staff about things that need their attention;
• support agencies, investigate problems, and keep the service reliable;
• where an agency has switched it on, measure that agency's own advertising conversions (section 8);
• calculate what an agency owes us for the service;
• and comply with legal obligations, enforce our agreements, and establish or defend legal claims.

We do not use client records, pet records, documents, email content or WhatsApp message content for any purpose unrelated to providing orppio to the agency they belong to.

7. Agencies and their customers' data

Most of the personal information in orppio is not ours and not about our own users. It is information a pet relocation agency holds about its own customers, and the agency decides what it collects, why it collects it, how long it needs it and who it shares it with. orppio's role is to hold and process that information so the agency can do its work, and to act on the agency's instructions.

What this means in practice:

• If you are a pet owner or a client of an agency and you want to know what an agency holds about you, why it holds it, or you want it corrected or deleted, contact the agency you are dealing with first. They control the record and can usually act on it directly.
• If you cannot reach them, or you would rather come to us, write to privacy@orppio.com. We will help, and where the request is properly the agency's to answer we will pass it to them and tell you that we have.
• An agency's data is kept separate from every other agency's. Staff of one agency cannot read another agency's clients, pets, quotations, documents or conversations.

Where an agency and orppio have signed a separate agreement covering data protection, that agreement governs the relationship between us and the agency; this policy describes our practices and does not replace it.

8. Advertising and conversion measurement

orppio offers an optional service that reports an agency's real business conversions — an enquiry submitted, a quotation accepted, a payment completed — to that agency's own Google Ads account, so the agency can see which of its own advertising actually produced work.

• It is off for every agency by default and can only be switched on by an orppio platform operator, at the agency's request. An agency can ask us to switch it off again.
• While it is on for an agency, a Google tag loads on that agency's own public pages only — its enquiry form, its quotation pages, its payment pages. It never loads on orppio.com, on the staff workspace, on the client portal, or on any page rendered for staff.
• Conversions reported from our servers may carry identifiers of the person, hashed with SHA-256 after normalisation — an email address, a phone number, a name or an address — so that Google can match the conversion to an advertising click. The hashes are computed at the moment of sending and are not stored; what we keep is only a record of which kinds of identifier a conversion carried.
• Message content, documents, pet records and health information are never sent to any advertising system.
• On these pages the platform operates with Google's consent signals set to granted, and there is no consent banner. Whether that is appropriate for the markets it sells into is a decision for the agency, which is why the service is off until an agency asks for it.

Separately, and whether or not the service is on, we record how a lead arrived: campaign parameters, advertising click identifiers, and the landing and referring page. That is the agency's own record of where its business comes from and is not sent anywhere.

9. Cookies and similar technologies

orppio uses a small number of first-party cookies. None of them is required to read this page.

Sign-in

A signed cookie identifying your session, so you stay signed in. HttpOnly, restricted to same-site requests, and cleared when you sign out.

Application session

A short-lived cookie carrying the security token that protects forms against cross-site request forgery, one-off messages such as "saved", and — on our own marketing pages — the referring page of your first visit, until an access request is submitted or the session ends.

Visitor activity

On an agency's public pages, a signed, HttpOnly, first-party cookie holding a random identifier that lasts up to a year. It carries no personal information, JavaScript cannot read it, and clearing it makes a new and unconnected visitor.

Website visits

On orppio's own public pages, two HttpOnly, first-party cookies holding random identifiers: one for the browser, which lasts up to a year, and one for the current visit, which lasts thirty minutes after the last activity. They carry no personal information, JavaScript cannot read them, and clearing them makes a new and unconnected visitor. A browser that does not keep them is not measured at all.

Advertising

Where an agency has the optional advertising service switched on (section 8), Google's tag sets its own cookies on that agency's public pages. No advertising cookie is set on orppio.com.

You can block or clear cookies in your browser. Blocking the sign-in and session cookies will stop you from signing in and from submitting forms; blocking the others only means the activity they record is not recorded.

10. How information may be shared

We do not sell information and we do not share it for anyone else's marketing. Information is shared only in the ways described here.

Service providers that operate orppio

Running the service necessarily means these providers handle information on our behalf, under their own contracts and security practices:

DigitalOcean

The cloud servers and databases orppio runs on, and the object storage where uploaded files and attachments are kept.

Mailgun

Sending and receiving email — both orppio's own account emails and the correspondence agencies exchange with their clients.

Meta Platforms

The WhatsApp Business Platform, for agencies that have connected WhatsApp (section 4).

Stripe

Card payments, for agencies that have connected Stripe. Card details go from the payer's browser straight to Stripe and are never held by us.

Google

Google Ads and Google's conversion ingestion API — only for agencies where the optional advertising service is switched on (section 8).

IPinfo

A one-time lookup of the country and network operator behind an IP address seen on an agency's public pages.

Between agencies, when an agency chooses it

An agency can invite another relocation company to collaborate on a single journey. The invited company sees only what has been shared with it on that journey and only what it has been given permission to do. It never sees the host agency's other cases, its quotations, its payments, its margins, its internal notes or its other clients.

Inside orppio

A small number of orppio platform operators can enter an agency's workspace to operate and support the service. What they do while there is recorded, both in a platform audit record and on the record itself, so that it can be reviewed.

Legal and business reasons

• Where we are required to by law, or by a valid legal request from a competent authority.
• Where it is necessary to investigate, prevent or act on suspected fraud, abuse, or a threat to the security or rights of any person.
• To establish, exercise or defend legal claims, or to enforce our agreements.
• In connection with a merger, acquisition, financing or sale of assets, in which case information may transfer to the successor, which would remain bound by a policy at least as protective as this one.

11. Sale of personal information

orppio does not sell personal information. We are paid by the agencies that use the platform, and by nobody else. We do not sell, rent or trade WhatsApp message content, email content, client records, pet records or documents, and we do not make any of it available to data brokers or advertising networks for their own purposes.

The one case where information reaches an advertising platform is described in section 8: where an agency has asked us to switch the conversion-measurement service on, we report that agency's own conversions to that agency's own Google Ads account, with hashed identifiers, so the agency can measure its own advertising. That is done for the agency, not for payment, and never with message content.

12. Where information is processed

orppio runs on cloud infrastructure and stores files in object storage provided by DigitalOcean, in a region we select. The other providers listed in section 10 operate internationally. Information may therefore be processed and stored in a country other than the one you live in, where data protection law may differ from your own.

13. Data retention

We keep information for as long as it is needed to provide orppio to the agency it belongs to, and afterwards only for as long as we need it for legal, accounting, security or dispute reasons.

• Business records — leads, clients, pets, quotations, journeys, tasks, documents, invoices, payments, conversations and the activity timeline — are kept for the life of the agency's relationship with orppio, because they are the agency's operating record of work it has done, and in several cases records it is required to keep.
• Visitor activity recorded on an agency's public pages is deleted automatically after a set period, which is 365 days unless configured otherwise.
• Visits to orppio's own website — the pages viewed, the clicks, the IP address and the rest of what section 3 lists — are deleted automatically after a set period, which is 90 days unless configured otherwise. These are the two automatic retention rules the product currently enforces; neither touches business records.
• WhatsApp messages and media are kept within the agency's records like any other correspondence, until they are deleted at the agency's or the customer's request. Disconnecting WhatsApp erases the stored access token immediately and stops any further messages, but does not delete the conversations already recorded.
• Suspending an agency's account does not delete anything. The records stay as they were, so the account can be restored. Deletion is a separate, explicit act — see section 14.

Where we hold routine system backups, information deleted from the live service may remain in those backups until they expire in the normal course.

We do not promise a fixed retention period for business records, because we do not currently enforce one automatically, and we would rather say so than publish a number that is not true.

14. Data deletion

Data Deletion Instructions is a separate page explaining exactly how to ask for information to be deleted, what happens next, and how long it takes. In short:

• Agency staff can already delete some records themselves from inside orppio — a lead, a quotation, a journey, a generated document, a document template — and the application shows what else each of those deletions takes with it before it happens.
• There is no self-service button that deletes an entire account or an entire client record. Requests of that kind are handled by us, by hand, after we verify who is asking.
• Requests go to privacy@orppio.com, and are subject to verification of identity and authority, and to information we are required to keep.

15. Security

We use administrative, technical and organisational safeguards designed to protect information against loss, misuse and unauthorised access. These include:

• All traffic to the service is served over HTTPS, with strict transport security enabled.
• Passwords are stored only as one-way hashes and are never recoverable in readable form.
• Every record belongs to exactly one agency, and queries are scoped to that agency so one tenant's data cannot be reached from another's session.
• Access within an agency is governed by roles made of individual permissions, so staff see only what their role allows.
• Uploaded files are stored as private objects that are not publicly readable, and are delivered only through access-controlled endpoints — never from a public storage URL.
• The one third-party credential we store, the WhatsApp access token, is encrypted at rest.
• Personal data submitted in forms is filtered out of application logs by configuration.
• Incoming webhooks from Meta, Stripe and our email provider are verified by cryptographic signature before they are processed.
• Sign-in, password reset and other sensitive endpoints are rate limited.
• Actions taken by orppio platform operators inside an agency's workspace are recorded in an audit record.

No system can be guaranteed completely secure, and we do not claim otherwise. We hold no security certification and make no representation of compliance with any certification scheme. If you believe you have found a vulnerability in orppio, please write to privacy@orppio.com so we can look at it.

16. Your choices and requests

If you use orppio

• You can view and change your own name, language, time zone, profile picture and password from your profile.
• Your agency's owners and administrators control your role, your permissions and whether your access continues.
• You can control which notifications your team receives from orppio's notification settings.

If you are a client of an agency

• Ask the agency handling your relocation to see, correct or delete what it holds about you and your pet. It controls the record.
• An agency can stop sending you email through orppio entirely; ask them, or write to us and we will pass it on.
• You can stop receiving WhatsApp messages by telling the agency, or by blocking the number in WhatsApp.

In any case

You can write to privacy@orppio.com to ask what we hold, ask us to correct it, ask us to delete it, or object to how it is used. Depending on where you live you may have rights under local data protection law; we will honour a valid request to the extent the law requires, and we will tell you if we cannot, and why. We may need to verify who you are before acting, and we may need to refer a request about an agency's own record to that agency.

17. Children

orppio is business software sold to companies. It is not directed to children, and we do not knowingly collect personal information from children. If you believe a child's information has reached orppio, write to privacy@orppio.com and we will delete it.

18. Changes to this policy

We may update this policy as orppio changes. When we do, we update the effective date at the top of this page, and the change takes effect when it is posted here. The address of this page (https://orppio.com/privacy) does not change, so a link to it stays current.

19. Contact us

Questions about this policy, about what orppio holds, or about a privacy or deletion request, go to one address: