Legal
Privacy Policy
What we collect when you use oryn.surf, why we collect it, and what we do not do with it.
Last updated 11 September 2026
Pending legal review
This document accurately describes how the ORYN website is built and what it does with data. It has not been reviewed by a qualified lawyer, and it is not legal advice. Before relying on it publicly, have counsel confirm it reflects your jurisdiction, your data-processing arrangements and the commitments you have actually made to customers.
In short
- We collect what you type into a form, and nothing more.
- We do not store your IP address. Where we need to detect abuse, we store a one-way keyed hash of it that cannot be reversed.
- We do not sell personal data, and we do not share it with advertisers.
- By default this site loads no third-party analytics and sets no tracking cookies.
- You can ask us for a copy of your data, or ask us to delete it.
Who is responsible
ORYN operates oryn.surf and is the data controller for personal data described in this policy. You can reach us at hello@oryn.surf.
What we collect, and why
We collect personal data only when you choose to send it to us through one of our forms. There is no background collection of profile data.
| Contact form | Name, email address, and optionally company and role, plus the message you write. Used to answer your enquiry. |
|---|---|
| Demo request | Name, business email, company, job title, country, company size, area of interest and your description of the use case. Used to prepare for and arrange the session. |
| Job application | Name, email, optionally location and profile links, your résumé and any message. Used to assess your application. |
| Newsletter | Email address only, and only once you confirm it by clicking the link we send. Used to send occasional updates. |
| Campaign attribution | If you arrive via a campaign link, the utm_* parameters, the referring site and the page you landed on are submitted with the form, so we know which channels are worth continuing. |
| Technical | Your browser’s user-agent string, and a one-way keyed hash of your IP address. Used for rate limiting and spam detection. |
A note on IP addresses
We do not store IP addresses. When a form is submitted we compute a keyed SHA-256 hash of the address and store only that. The hash lets us recognise that several submissions came from the same source — which is what makes rate limiting and abuse detection possible — but it cannot be turned back into an address without a secret key that is never stored alongside it, and even then only by brute force.
This is a deliberate choice. Retaining raw addresses would be simpler to build and harder to justify.
Legal basis
Where the UK GDPR or EU GDPR applies, we rely on:
- Legitimate interests — for responding to enquiries, assessing applications, and protecting the site from abuse. We have considered your rights and consider these uses to be ones you would reasonably expect.
- Consent — for the newsletter, which uses double opt-in. You can withdraw it at any time using the unsubscribe link in any message.
- Contract — where we are taking steps at your request prior to entering into one.
Cookies
The public website sets no cookies at all in its default configuration. There is no cookie banner because there is nothing to consent to.
One strictly necessary cookie is set when a member of the ORYN team signs in to the admin portal. It holds an opaque session token, is marked HttpOnly, Secure and SameSite=Lax, and is deleted on sign-out.
If Cloudflare Turnstile is enabled, it may set a short-lived token in browser storage as part of verifying that a form submission is not automated. Turnstile is designed not to track users across sites.
Who else processes your data
We keep the number of third parties deliberately small. As deployed, they are:
| Hosting | Serves the website and runs the application. |
|---|---|
| Database | Stores form submissions and site content. |
| Email delivery | Delivers notification and confirmation messages. Receives the recipient address and message content. |
| File storage | Stores uploaded résumés in a private, non-public bucket. |
| Cloudflare Turnstile | Verifies that form submissions are made by a person, if enabled. |
Each acts on our instructions under a data-processing agreement. We do not sell personal data, and we do not share it with advertising networks.
How long we keep it
- Enquiries and demo requests: retained while the conversation is live and for a reasonable period afterwards, then deleted.
- Job applications and résumés: retained for the duration of the hiring process. If you are not successful, we delete them unless you have agreed we may keep them on file.
- Newsletter subscriptions: retained until you unsubscribe.
- Rate-limiting records: automatically expire, typically within hours.
- Audit logs of administrative actions: retained for security and accountability.
Your rights
Depending on where you live, you may have the right to access a copy of your data, correct it, delete it, restrict or object to how we use it, receive it in a portable format, or withdraw consent. To exercise any of these, email hello@oryn.surf. We will respond within one month.
If you are in the UK or EU and are not satisfied with our response, you have the right to complain to your local supervisory authority.
Security
We describe our technical measures in detail on the security page. In summary: everything is served over HTTPS, admin access requires authentication and is role-restricted, résumés are stored privately and are never publicly addressable, and administrative actions are logged.
Children
This site is intended for business use and is not directed at children. We do not knowingly collect personal data from anyone under 16.
Changes
If we change this policy materially we will update the date at the top of this page. Continued use of the site after a change means you accept the updated policy.