Privacy Policy

Last updated: 6 November 2026

This policy describes what GM Core Ltd. ("we") collects when you visit https://orcraft.app and when you use an Orcraft account from the website or from the Orcraft controller, and what we do with it.

In short: we collect limited personal information necessary to operate Orcraft accounts, manage licenses, provide support, and maintain the security of our services. We do not use advertising trackers, and the page counter we use does not follow individual visitors. However, our hosting, content delivery and page-counting providers may automatically receive technical information, including IP addresses and request information, when delivering the website, as the next section says. Creating an account involves processing your name, email address, and related authentication information. Using Orcraft account services also involves recording information concerning connected controllers and licensed endpoint machines. Your test suites, test results, and logs ordinarily remain within your own environment and are not transmitted to GM Core Ltd. through the normal operation of the software. We do not sell personal information or use it for targeted advertising.

Browsing the website

The website is a static site with no advertising and no tracking cookies. Search runs entirely in your browser.

The site is hosted on GitHub Pages. GitHub receives your IP address and the pages you request, as any web host does, under GitHub's privacy statement.
Code highlighting is loaded from the jsDelivr content delivery network, which receives your IP address for that request.
Page views are counted with Cloudflare Web Analytics, which sets no cookies, stores nothing in your browser and does not follow individual visitors. For each page you open, Cloudflare receives your IP address, the page's address, the page that linked to it, your browser and how long the page took to load, under Cloudflare's privacy policy. We see only totals: page views, visits, referring sites, countries and browsers.
After you sign in, your browser keeps your name, email address, profile photo address and plan in its local storage so the navigation can show who is signed in. This stays in your browser and is removed when you sign out.

Your account

Sign-in is provided by Clerk, which loads only on the sign-in and account pages. You can create an account with your email address, which you confirm with a one-time code sent to it at every sign-in, or with your GitHub account. There is no password.

Clerk stores your email address, your name, the link to your GitHub account when you sign in with it, and the session cookies that keep you signed in. Signing in with GitHub gives us the name, email address and profile photo of your GitHub profile.
We keep a copy of your Clerk user identifier, your email address and your name in our own database, so that licenses, teams and machines can be tied to you.

Teams

Starting the trial creates a team. For a team we record its name, who owns it, who its members are and when each joined. When a team owner invites someone by email, Clerk sends the invitation and we keep the invited address until the invitation is accepted or revoked. A team owner sees the names and email addresses of the team's members.

Controllers signed in to your account

When you sign an Orcraft controller in to your account, the controller sends us a random controller identifier, the computer's host name and its operating system. We record them with the time of the sign-in and of the controller's last contact with us, so that you can see and sign out every controller from your account page. The sign-in itself happens on the website; the controller receives only a token issued by us and never sees your sign-in code or your GitHub account. The controller's requests reach us through Supabase, whose request logs hold the controller computer's IP address for a limited time, as the Processors section says. The endpoint machines never contact us; an endpoint machine's address reaches us only in the case the next section names.

Endpoint machines

When a controller activates an endpoint machine for your account or team, we record what is needed to license that machine and to count it against your plan:

the public key the endpoint application generates at its first start,
a fingerprint of the machine, which is a hash of its operating system, its processor architecture and the operating system's own machine identifier (the identifier itself is never sent to us),
the machine's host name and operating system; when the endpoint reports no host name, the controller sends the name or address it was given for that machine instead,
when the machine was activated and when each license was issued, renewed or revoked.

The controller contacts us once a day to renew the licenses of its machines. It sends nothing about what those machines do.

Automation credentials

A team owner can create credentials for CI runners and AI agents. We store the name you give a credential, a hash of its secret, who created it, and when it was created, last used and revoked. The secret itself is shown once and not kept.

What we do not collect

The Orcraft controller and the Orcraft endpoint talk to each other directly, on your own network. Your test suites, test results, logs, source code, screenshots and anything else produced by running tests stay on your machines. The only traffic between the controller and us concerns your account and licenses, as described above. The endpoint application never contacts us.

Payments

Paid plans are sold through Paddle, which acts as the merchant of record. When you buy from your account page, the page loads Paddle's checkout script from Paddle's servers, which receive your IP address, and the checkout opens in a Paddle window that sets Paddle's own cookies. Paddle collects your name, email address, country and postal code for tax, your billing details and your payment method; we never see the card. We receive from Paddle the subscription and customer identifiers, the plan, the number of machines bought and the payment status, and we keep the events Paddle sends us about your subscription. Invoices, the payment method and cancellation are handled in Paddle's customer portal, under Paddle's privacy policy. Purchase is not available yet; this section applies once it is.

A quote request or an order sent from the quote page or the order page carries the company's legal name, billing address and tax identifier, the purchase order number if given, the number of machines and the period, the email address of the person who will own the team, the address of the person sending the request, and anything written in the message field. We keep the request in our database, and a copy goes by email to the sender and to our support mailbox. To prepare the quote and issue the invoice we pass the company's details to Paddle, which keeps them as the customer's business and billing address under its privacy policy and emails the invoice to the owner. The Retention section says how long the request is kept.

Support

Mail to support@orcraft.app is handled in Zoho Desk, our ticket system, where your address, your name as you sign it and what you write are kept with the conversation. The mail arrives in our mailbox, hosted by Namecheap, which passes support mail on to Zoho Desk. Support conversations are kept while your account exists and deleted with it, or earlier when you ask.

How we use information

To provide the account service: signing you in, issuing licenses to your machines, counting machines against your plan, running the trial and teams.
To show you, on your account page, the controllers and machines connected to your account, so that you can revoke them.
To answer support requests and to notify you about your account, your trial or your subscription.
To prepare the quotes and issue the invoices you ask for, and to tell the people a request names where it stands.
To keep the service secure and to detect abuse of licenses or credentials.

We do not use your information for advertising, we do not profile you, and we do not sell or rent it to anyone.

Legal bases for processing

Where the EU GDPR or UK GDPR applies, we process personal data on the following legal bases, as appropriate to the particular processing activity.

Performance of a contract, Article 6(1)(b): We process personal data where necessary to establish and administer accounts, provide licensed services, manage subscriptions, prepare the quotes and issue the invoices you ask for, and respond to contractual support requests where the relevant individual is a party to the applicable contract.

Legitimate interests, Article 6(1)(f): We process personal data where necessary for legitimate business purposes, including administering corporate user accounts, managing authorized team members, maintaining service security, preventing fraud and licensing abuse, providing appropriate customer support, counting in aggregate how the website is visited, maintaining necessary operational records, and establishing, exercising, or defending legal claims. We assess these interests against the rights and freedoms of the individuals concerned.

Compliance with legal obligations, Article 6(1)(c): We process personal data where necessary to comply with legal obligations that qualify under the applicable data protection legislation.

Certain financial and accounting records are also retained to comply with obligations imposed by Israeli law. Where those obligations do not independently establish a lawful basis under the applicable GDPR framework, we assess and rely upon another appropriate legal basis, where available. We do not ordinarily rely on consent for processing necessary to provide Orcraft's core account and licensing services. Information required to establish an account or administer a subscription is necessary to provide the relevant service. If the required information is not provided, we may be unable to create an account, issue licenses, or provide the requested functionality.

Who processes the data

GM Core Ltd. uses third-party providers to operate Orcraft and provide related services. Depending on the nature of the processing activity and the applicable contractual arrangements, these providers may act as processors on our behalf or as independent data controllers.

Clerk: Provides user authentication, session management, and team invitation services.
Supabase: Provides database hosting, application functions, and related infrastructure for the Orcraft account service. Supabase may process technical request logs, including IP addresses, as part of the services it provides.
GitHub: Hosts the Orcraft website and provides optional authentication through GitHub accounts. GitHub may independently process certain information in accordance with its applicable privacy terms.
jsDelivr: Delivers the code-highlighting script used by the website and may receive technical request information, including IP addresses.
Cloudflare: Counts the website's page views through Cloudflare Web Analytics and receives the technical request information described under Browsing the website.
Paddle: Acts as merchant of record for paid purchases. Paddle is generally an independent data controller for its payment, billing, taxation, fraud prevention, and related transactional activities. Paddle processes this information in accordance with its own privacy policy.
Zoho Desk: Provides customer support and ticket management services and processes information contained in support communications.
Namecheap: Hosts our mailbox, which receives the mail sent to our addresses and sends the mail the account service sends you, and may process email addresses, message content, and related transmission information in connection with those services.

We disclose personal information to these providers only to the extent reasonably necessary for their respective services and in accordance with applicable data protection requirements. We may also disclose personal information where required by applicable law, lawful regulatory requests, or valid judicial proceedings. We share information with nobody else.

International data transfers

GM Core Ltd. is established in Israel, which the European Commission recognises as providing adequate protection for personal data transferred from the European Union. The core Orcraft account database and associated application functions are configured to operate in Supabase's Frankfurt region within the European Union. Certain service providers may process or access personal data from other jurisdictions: Clerk, Cloudflare, GitHub, Zoho and Namecheap are companies of the United States and process data there; Paddle is a company of the United Kingdom; jsDelivr serves its script from a worldwide content network. These providers include authentication, website hosting, page counting, payment, customer support, email and content delivery services. Where the GDPR or UK GDPR applies, international transfers of personal data are carried out in accordance with the relevant data protection requirements. Where an applicable adequacy decision covers the relevant transfer, we may rely on that decision. Where an adequacy decision does not apply, we use appropriate safeguards where required, including applicable Standard Contractual Clauses or other legally recognized transfer mechanisms. Where a service provider is certified under the EU-US Data Privacy Framework, that certification may be relied upon for transfers within its applicable scope, subject to the validity of the certification and the requirements of applicable law. Information concerning the safeguards applicable to a particular international transfer, including how to obtain a copy of relevant safeguards where required, may be requested by contacting support@orcraft.app.

Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, subject to applicable legal obligations and legitimate business requirements. Account and licensing records are generally retained while the relevant account or contractual relationship remains active. Records concerning controllers, endpoint machines, activations, and automation credentials are kept while the account or team they belong to exists, including after they are revoked, so that machine counts and license history stay correct, and may be retained for the period reasonably necessary to administer licenses, prevent abuse, maintain appropriate security records, and establish or defend legal claims. Pending controller sign-in requests ordinarily expire after ten minutes. Support correspondence is generally retained while the relevant account or support relationship remains active, subject to applicable legal retention obligations and legitimate requirements concerning dispute resolution. A copy of each email we send you is kept while your account exists, so that support can see what you were sent.

When you delete your account from your account page, or ask us to by mail, we delete it from Clerk and from our database, together with the team you own and its records; a subscription is cancelled at once, and the machines lose their licenses when their current ones run out. Associated personal information is deleted or anonymized in accordance with our retention procedures, except where continued retention is required by law or reasonably necessary for another lawful purpose. Information held in backup systems may remain for a limited period in accordance with applicable backup retention cycles.

A quote request or an order sent from the quote page or the order page, with the company details it carries, is kept while the purchase is open. A request that was never quoted, or quoted and never approved, is deleted ninety days after the quote's validity ended, together with the emails sent for it, unless a longer retention period is legally required. Once an invoice has been issued for a request, the request is kept as the record of the sale for as long as accounting law requires, even after the account is deleted; the free text of the request is removed then. Accounting records subject to Israeli bookkeeping requirements are generally retained for seven years from the end of the relevant tax year or six years from submission of the relevant annual tax return, whichever is later. Personal information retained for legal compliance or dispute resolution will not be used for unrelated purposes.

Your rights

Depending on the data protection law applicable to the processing of your personal information, you may have the right to request access to your personal data, correction of inaccurate information, erasure, restriction of processing, data portability, and objection to processing based on legitimate interests. Where processing is based on consent, you may have the right to withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal. You may also have the right to lodge a complaint with the competent data protection supervisory authority.

You can see and change your name, email address and sign-in methods from your account, see and revoke every controller, machine and credential from your account page, and delete your account, with everything it holds, from your account page. To exercise applicable privacy rights, request a copy of your information, or request correction or deletion, please contact support@orcraft.app. We will assess and respond to requests in accordance with applicable law, subject to legally permitted exceptions and retention obligations. Where required by applicable law, we will provide information concerning the relevant supervisory authority and any available rights of appeal or complaint.

Information for individuals under Israeli privacy law

GM Core Ltd., company number 517377164, Yitzhak Shamir 16, Tirat Carmel 3907017, Israel, is responsible for the processing of personal information described in this Privacy Policy, except where an identified third party acts as an independent controller. We collect personal information for the purposes described in this Policy, including account administration, software licensing, team management, customer support, service security, payment administration, and compliance with applicable legal obligations. Providing information for account registration is generally voluntary. However, certain information is necessary to establish an account or provide account-dependent services. Failure to provide required information may prevent us from providing the relevant functionality. Personal information may be disclosed to the service providers and other recipients identified in this Policy for the purposes described above. Individuals may exercise applicable rights of access and correction under Israeli law by contacting support@orcraft.app. Requests will be handled in accordance with the Protection of Privacy Law, 1981, and applicable regulations.

Security

Sign-in tokens, controller tokens and credential secrets are stored only as hashes. Licenses and controller tokens are signed by us and verified by the controller and the endpoint. The database is not reachable from the browser; only our own functions can read or write it, and every call from the website or a controller is authenticated. To limit abuse, the account service counts the requests of each client address and keeps those counts for a day.

We implement technical and organizational measures appropriate to the nature of the information processed and the risks associated with the relevant processing activities. These measures are reviewed periodically and may include access controls, authentication, logging, security monitoring, and procedures for responding to information security incidents. No method of electronic storage or transmission can guarantee absolute security.

Children

Orcraft accounts are for professional use and are not intended for children under 16. We do not knowingly collect information from them.

Changes

We may update this Privacy Policy to reflect changes in our processing activities, applicable law, or the services we provide. The effective date of the current version is identified at the beginning of the Policy. Where changes materially affect the processing of personal information, we will provide appropriate notice in accordance with applicable law.

Contact

Questions about this policy: support@orcraft.app