1. Parties, acceptance and scope
The parties are the customer identified during contracting, which determines processing purposes, and Oruka's operator identified on this page. This agreement forms part of the hosted contract when the customer expressly accepts it or both parties agree in writing. Publishing this document or visiting the site does not establish acceptance.
The customer is the controller and Oruka the processor. A customer acting as another controller's processor must be authorized to engage Oruka and communicate that controller's instructions. Data Oruka processes for its own contracting, billing, security and compliance purposes is governed by the privacy policy. For Enterprise, this agreement only covers expressly agreed additional services giving Oruka access to data; it does not turn a self-hosted installation into a hosted service.
2. Subject matter, operations and duration
Processing supports the purchased AI agent, messaging and voice, CRM, knowledge, forms, scheduling and automation features. Operations include receiving, recording, organizing, storing, consulting, retrieving, generating responses, transmitting to authorized recipients and deleting data, exclusively for those features and instructions.
Processing may be continuous while features are active. This agreement lasts for as long as Oruka holds customer data, including return, deletion or legally required retention periods. The terms define the plan and this page's operations record describes the installation's infrastructure, retention and backups.
3. People and data covered
Data subjects may include the business's customers, prospects, suppliers, employees, contractors and other contacts. Data includes identifiers and contact details, profiles, messages and files, knowledge documents and indexes, agent instructions and memory, forms, appointments, transactions and technical records. Audio and transcripts apply only to enabled voice features. Specific categories depend on what the customer chooses to process.
This agreement does not authorize unrestricted processing of sensitive data, children's data or regulated medical information. Before using those categories, the customer must establish lawful grounds, inform individuals, obtain required authorizations and agree any necessary additional safeguards with Oruka. This document is not a HIPAA Business Associate Agreement and does not certify HIPAA compliance.
4. Instructions and customer duties
Documented instructions comprise this agreement, the accepted offer, configured features, permissions and automations, and written instructions consistent with the service. The customer ensures lawful data and purposes, provides necessary notices and authorizations, keeps contact details current and grants access only to authorized people and accounts.
Oruka processes data only on those instructions, including international transmissions. If an instruction appears unlawful, Oruka will inform the customer and suspend that operation pending clarification. If law requires other processing, Oruka will inform the customer beforehand unless legally prohibited. Agent actions require customer-configured permissions, limits and appropriate human oversight.
5. Confidentiality and use restrictions
Oruka limits access to people who need it to deliver and protect the service and are bound by confidentiality or an equivalent legal duty. Customer data is not sold, used for Oruka's advertising or disclosed for purposes unrelated to this processing. Technical permissions over content do not transfer ownership.
Responses and embeddings require sending necessary context to the configured provider. This agreement does not authorize Oruka to train general-purpose models on customer data. Compatible APIs, settings and contracts must be selected before sending data. Google-derived information remains subject to the additional Limited Use restrictions in the privacy policy.
6. Security measures
Oruka will maintain technical and organizational measures proportionate to risk: session and access controls, salted hashes for local passwords, HTTPS communications for the hosted service, separate customer installations and databases, and integration verification. Support access is limited to what is necessary; credentials must be protected and unnecessary permissions revoked.
The operations record identifies hosting, storage, regions and recovery arrangements. The customer manages its users' permissions, devices and connected services. No promise is made of encryption of every field, zero retention, security certifications or backups beyond those described. Measures will be reviewed according to risk and will not be reduced in a way that breaches this agreement or law.
7. Providers and subprocessors
For the hosted service, the customer authorizes Vercel (application and execution) and Neon (database and application storage), in the regions stated in the operations record. AI, embedding, voice, email and channel providers participate only as necessary for enabled features. The privacy policy's recipients section distinguishes possible services from those actually configured; it does not by itself authorize all providers.
Oruka must maintain written subprocessor contracts with protections consistent with this agreement and remains responsible for the processing it delegates. Accounts contracted directly by the customer may operate under their own relationship with it; roles and terms must be established before disclosing data.
Before adding or replacing an Oruka subprocessor, Oruka will notify the customer's contact in writing of its identity, function and location at least fifteen days in advance, except for a justified security emergency communicated without delay. The customer may object on reasonable data protection grounds. The parties will seek an alternative; if none exists, they may end the affected feature and settle unused prepaid fees as required by law and their agreement.
8. International processing
The service operates from Colombia and uses infrastructure in the United States and enabled integrations' locations. Where applicable, this agreement documents the scope, activities, security and confidentiality of processing transmissions under Decree 1074 of 2015. Transfers to another controller require their own grounds and are distinct from transmissions to a processor.
Where the GDPR, UK regime or another law requires additional transfer safeguards, the parties must identify exporters, importers and destinations and establish a valid mechanism before a restricted transfer. This text does not automatically incorporate EU standard contractual clauses, a UK addendum or an adequacy certification. Necessary annexes and supplementary measures must be agreed; processing must not begin if these requirements cannot be met.
9. Individual rights and assistance
The customer decides on requests concerning data it controls. Oruka will forward requests it receives without undue delay and assist, taking account of the processing and available information, with locating, correcting, restricting, returning or deleting data and meeting legal deadlines. Oruka will not respond on the customer's behalf without authorization or a legal duty.
Oruka will provide reasonably necessary information and assistance for risk assessments, security measures, impact assessments and regulatory consultations where required. The public privacy-rights procedure also provides a way to contact Oruka; it does not replace the channel each business must provide to individuals.
10. Personal data incidents
On becoming aware of an incident affecting entrusted data, Oruka will notify the customer's contact without undue delay. Information will include the incident's nature, known categories and scope, likely consequences, measures taken or proposed and a contact point. Details may be supplied progressively as the investigation proceeds.
Oruka will assist with containment, recovery and documentation. The customer assesses its duties to notify individuals and authorities; each party retains its own legal obligations. Notification does not by itself establish liability or replace applicable statutory deadlines.
11. Return, deletion and evidence
When the hosted service ends, active processing stops and the operations record's deletion cycle applies. The customer must promptly request return or deletion through the published contact, at its choice where required by applicable law. Required returns are handled securely through support; the application has no business-data export tool. Legal retention requirements will be explained and retained data restricted to that purpose.
Backups and recovery windows expire under the disclosed cycles and are not used for new purposes. Oruka will provide deletion confirmation on request. Ending the service does not remove individuals' rights or permit indefinite retention for convenience.
12. Information, audits and precedence
Oruka will provide reasonable information to demonstrate compliance and permit legally required audits or inspections, with agreed scope, confidentiality, security and proportionate scheduling. Protecting other customers must not prevent a mandatory oversight right.
For entrusted customer data, this agreement prevails over conflicting general terms. Specific agreements may supplement it without reducing statutory safeguards. Colombian law and applicable mandatory rules govern; competent authorities and non-waivable rights remain available. Accepting this agreement is not an authorization from individuals and does not itself establish correct provider configuration or contracting.