Privacy Policy

1. What we collect

We do not require your name, phone number, physical address, or government ID to create an ORION account. ORION collects portfolio information only when you deliberately upload it; it does not connect to your broker or infer missing position values. Company analysis output is generated from the same research workflow for users running the same query and is not personalized financial advice, while the portfolio dashboard organizes the positions and values you supplied.

2. Who we share it with

We do not sell your data. ORION public research pages use the first-party page measurement described below. The separate beehiiv newsletter service may process email engagement and technical information as described in the Weekly notice. We do not use beehiiv's Ad Network or Enhanced Data Offerings for ORION Weekly. Data is shared with the service providers required to run the product:

When this separate waitlist is enabled, Supabase processes its registration information and consent/security records for database storage and the administration of the one-time notice request. If the form is served by Vercel or Render, that host processes form requests and standard network/request metadata. If the separate one-time notice workflow is enabled through Resend, Resend processes the recipient email address and opening-notice message to deliver that requested email. Registration and one-time sending for this waitlist are currently inactive.

ORION also queries public data sources (ClinicalTrials.gov, Yahoo Finance, Financial Modeling Prep, SEC EDGAR, FDA public disclosures) to build reports — these calls concern the company you searched for, not you personally, and do not send your account information to those sources.

We may disclose data if legally required to (subpoena, court order) or to investigate fraud/abuse of the service.

3. Cookies & local storage

ORION uses browser session storage for the Supabase sign-in session in the current tab. Local storage is used for on-device preferences, onboarding progress and a signed-out watchlist fallback. Public page analytics uses a temporary page identifier and limited campaign tags rather than a persistent browser analytics identifier. A short-lived signup context can connect your requested account creation with its confirmation. Allowlisted events go to ORION's own backend; search text, report content, email addresses and authentication tokens are not analytics properties. Local storage is not trusted as proof of a paid tier. When you sign in, eligible watchlist items are synchronized to the account's server-side watchlist. No advertising or cross-site tracking cookies are set by this site.

Daily visitor count: when a public page is opened, ORION's server computes a one-way hash (SHA-256) of the visitor's IP address and browser user-agent together with a secret value that changes every day. ORION stores only that hash, the Korea Standard Time (KST) day and a referrer class (Reddit, Hacker News, search, AI answer engine, direct or other); it never stores the raw IP address, the user-agent or the full referring address. The purpose is counting daily visitors. No cookie is set for this count. Hashes are deleted after 400 days; daily totals are kept. The site owner's own visits are excluded, as are known bots and browsers that send Global Privacy Control or Do Not Track. For each page load counted this way, ORION also adds 1 to that KST day’s total of page views; it keeps no list of the pages a visitor opened.

This browser-storage description concerns ORION pages. A separate beehiiv signup page and newsletter emails use the provider's processing arrangements described in the Weekly notice; email engagement is not included in ORION's anonymous page-view totals.

One-time API and team access notice

Registration and one-time sending for this separate waitlist are currently inactive. The following terms apply when its separate signup workflow becomes available.

Joining this waitlist is optional. We use your registration only to send you one email when ORION's API and team access opens, and to administer that request. Joining does not subscribe you to the Weekly newsletter or research alerts.

We collect your email address and selected role (required), and your description of what you would like to access (optional). We also record your consent and its wording version, the stated purpose, registration time, registration and request identifiers, a submission fingerprint, and a daily keyed fingerprint derived from the request IP address. These records document the request and consent, prevent duplicate handling, and limit abuse of this waitlist. The waitlist database does not store the raw IP address. Hosting providers may receive standard network and request metadata while handling the form.

We delete your waitlist personal data after sending the one-time opening notice, or no later than 12 months from registration, whichever occurs first. You may withdraw your request and ask us to delete your waitlist data by emailing hello@orionbiotechai.com. We complete a deletion request within 7 days of receiving it. If you do not consent, you cannot join this waitlist; you can still use ORION's public research pages.

ORION does not sell waitlist data or provide it to third parties for their own purposes. Service providers that store the list, host the form, or deliver the requested notice process information for those tasks on ORION's behalf. This service-provider processing is described in the provider disclosures.

This dedicated policy governs only the API and team access waitlist. Its stated retention and deletion periods take precedence over the general account and research-record retention rules.

Optional ORION Weekly

Subscriptions are processed by beehiiv, our newsletter service provider. Subscribing is optional and does not require an ORION account. We use your email address to send the confirmation you request and, after you confirm, the free weekly note.

This consent is only for ORION Weekly. It does not enroll you in company alerts, study-specific research alerts, the API/team opening-notice list or another newsletter. Existing contact lists are not automatically enrolled or imported. Stopping Weekly does not delete your saved research or change another consent.

beehiiv processes your subscription and confirmation status, delivery and unsubscribe records, and relevant technical and source information to operate the service and prevent abuse. Depending on the publication's settings, it may also process email opens and link clicks. These email statistics are separate from ORION's public-page visitor counts; they do not prove that someone read a message. Email addresses and confirmation links are not sent to ORION's page analytics.

Your newsletter information is processed outside Korea, including in the United States. The provider's Privacy Policy and Data Protection Addendum describe its processing arrangements. ORION Weekly does not use beehiiv's Ad Network or Enhanced Data Offerings.

You can stop future Weekly messages using the unsubscribe link in each email. Unsubscribing stops delivery; it is not the same operation as deleting the provider's subscriber profile. To request access, correction or deletion of your Weekly data, email hello@orionbiotechai.com.

Weekly retention and manual deletion

ORION's operator manually removes unconfirmed requests within 14 days. Confirmed subscription details are kept while your Weekly subscription is active, then deleted within 7 days of a Weekly unsubscribe or deletion request. A minimal non-public consent or suppression record may be retained for up to 12 months solely to document the request and prevent unwanted email; it is not used for outreach.

These are ORION's manual retention duties, not a claim that beehiiv automatically deletes pending requests or profiles after unsubscribe. The operator must perform and check the separate deletion action. The provider may retain separate backup, security or suppression copies under its own applicable requirements. The exact retention of those copies has not been independently verified; ORION does not claim that its deletion action immediately erases every provider copy.

This policy governs ORION Weekly only. It does not change existing account, saved-research, company/study-alert or API/team notice retention rules. The previous self-hosted Weekly signup and sending route remains inactive; existing confirmation and unsubscribe handling is kept for prior requests.

Watch requests and company or data requests

A Watch form, on a program page or on /watch, stores your email address, the program or ticker, the role you choose (optional), the time you gave consent, the date and the page's source tag (for example ?src=card). No Watch form is shown. ORION collects no email address for Watch and sends no Watch email. Your email and ticker list are used only for these Watch emails and are not sold.

“Request this company” and “Request a data sample” store the ticker or your note, the date and the source tag, and your email address and consent time if you give an email. The founder reads each request by hand and replies when you leave an email.

Against automated posts, each form has a hidden field and the server limits how many posts one network address can send in a minute. That address is held in server memory for that minute and is not stored. These entries carry no IP address and no browser identifier (User-Agent).

ORION also keeps daily totals of card downloads, link copies and Watch submissions, by page and source tag. They are counts per day, not records about a person: no cookie, identifier, IP address or browser string is stored with them.

When you explicitly submit a ticker search that has no coverage, ORION may also count that public ticker by UTC day to plan future coverage. Only known SEC ticker symbols are accepted. These totals contain no search text, account, visitor identifier, cookie, IP address or referrer. Global Privacy Control, Do Not Track and recognized automated browsers suppress this count.

The entries are stored in ORION's Supabase database. The public site can add an entry but cannot read one; the founder reads them with the database's administrative access. They are not published, sold or given to anyone else.

ORION has not set an automatic deletion period for these entries. To stop a Watch or have an entry deleted, email hello@orionbiotechai.com from the address you used; the founder deletes it by hand.

4. Retention

The Watch and request section governs Watch requests, company and data-sample requests and the daily totals.

The dedicated API and team access waitlist policy governs that waitlist's personal data and its stated retention and deletion periods.

The Weekly retention and manual-deletion policy governs the separate newsletter subscription.

Account and editable watchlist data are retained while the account is active. Reports, source snapshots, change events, and evidence-record versions are append-only product records: corrections are recorded as later versions rather than silently overwriting history. If you request account deletion, access is deactivated after review; records required for security, billing, or legal obligations may be retained only for those purposes. ORION has not yet published fixed deletion windows for every record class; those windows require privacy-counsel approval before a production retention policy is finalized.

5. Your rights

For feedback submitted without an account, email hello@orionbiotechai.com with the receipt shown after submission to request access, correction or deletion. Feedback is accessible to the ORION operator for review and is not published or counted as a customer. We have not set an automatic deletion period for feedback.

You can submit an authenticated access, export, correction, objection, or account-deletion request through the Account data request form. A deletion request is reviewed before processing and does not itself cancel an active subscription. Depending on your jurisdiction, you may have additional rights under applicable law; licensed privacy counsel must review how those laws apply to ORION.

6. Security

Authentication tokens are verified server-side on protected requests and paid tier state is read from the server rather than browser storage. If live Toss billing is activated, payment card data is handled by Toss Payments rather than ORION's servers. Service-role database credentials and third-party API keys remain server-side. Notification-channel encryption exists in backend code, but outbound email and Slack are not represented as operational until their separate capability flags are enabled and delivery is validated.

7. Children's privacy

ORION is not directed at, and is not intended for use by, anyone under 18. We do not knowingly collect data from children.

8. Changes to this policy

If this policy changes materially, we will update the date above and provide notice or request consent where required by applicable law.

9. Contact

Privacy inquiries are handled by ORION's representative, Seong Jiwoo (성지우): hello@orionbiotechai.com. A dedicated public business telephone is being prepared.

Change history

• October 20, 2026: Watch email alerts are paused while they are upgraded; no Watch form is shown and no Watch email address is collected meanwhile (section 3). Previous version: October 19, 2026.
• October 19, 2026: the daily visitor count also adds counted page loads to a daily page-view total, with no per-visitor page list (section 3). Previous version: October 18, 2026.
• October 18, 2026: the visitor count's referrer classes include AI answer engines (section 3). Previous version: October 17, 2026.
• October 17, 2026: added anonymous daily counts of submitted, known ticker searches with no coverage, and the daily visitor count (section 3). Previous version: October 13, 2026.
• October 13, 2026: operator name and service name changed (ORION Biotech Observatory → ORION). Previous version: October 12, 2026.