Privacy Policy

Waypoint Platform Group, Inc. ("Waypoint Platform Group," "we," "us," or "our") operates ORPIO, an operational readiness platform for hotel openings and renovations (the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect your information when you use the Service. By accessing or using ORPIO, you agree to the practices described in this Privacy Policy. If you do not agree, you should not use the Service.

We collect the following categories of information: • Account information: Your name, email address, company name, and role when you register or are invited to an account. • Profile and team data: Team member assignments, project roles, and collaboration activity. • Project data: Hotel project details including project type, target opening date, room counts, task assignments, gate approvals, evidence uploads, comments, and attachments you or your team create. • Payment information: Billing email, subscription tier, and billing interval. Payment card data is processed by Stripe and is not stored on our servers. • Usage and diagnostic data: IP address, browser type, device identifiers, pages visited, and interaction logs used for security and platform improvement. • Communications: Support tickets, feedback, and correspondence you send to us.

We use your information to: • Provide, maintain, and improve the Service and its features. • Create and manage your account, projects, and team memberships. • Process subscription payments, manage trials, and handle billing. • Send transactional, account-related, and notification emails (e.g., task assignments, gate approvals, due date reminders, weekly reports). • Provide customer support and respond to inquiries. • Detect, prevent, and address fraud, abuse, and security issues. • Comply with legal obligations and enforce our Terms of Service. We do not sell your personal information to third parties.

We may share your information with: • Service providers: Third-party vendors that help us operate the Service, including Stripe (payments), Resend (email delivery), and cloud infrastructure providers. These providers are bound by confidentiality obligations and may only use data to provide services to us. • Team members within your account: Project data, tasks, comments, and activity are visible to other members of your account based on their assigned role. • Legal and compliance: If required by law, court order, or government regulation, or to protect our rights, property, or safety, or those of our users. • Business transfers: In connection with a merger, acquisition, or sale of assets, we may transfer information to the acquiring entity, subject to this Privacy Policy.

We implement industry-standard security measures to protect your data, including AES-256 encryption at rest, TLS 1.2+ encryption in transit, role-based access controls, multi-factor authentication, automated backups, and continuous monitoring. Employee access follows the principle of least privilege. While we strive to protect your information, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We retain your data for the duration of your subscription. Upon account cancellation, customer data is retained for 30 days to allow for export, after which it is permanently deleted from all production systems within 90 days. Encrypted backups are retained for 30 days. Support tickets and related communications may be retained for up to 2 years for quality and legal purposes. Anonymized, aggregated data that cannot identify you may be retained indefinitely.

Depending on your location, you may have the following rights: • Access: Request a copy of the personal information we hold about you. • Rectification: Request correction of inaccurate or incomplete data. • Erasure: Request deletion of your personal data (subject to legal retention requirements). • Data portability: Request your data in a structured, machine-readable format. • Objection: Object to certain processing of your data. • Restriction: Request that we limit processing of your data. • Withdraw consent: Withdraw consent to processing where applicable. To exercise any of these rights, contact us at privacy@orpio.io. We will respond within 30 days. Residents of California (CCPA) and the European Economic Area / UK (GDPR) have additional rights as provided by applicable law.

We use cookies and similar technologies to operate the Service, authenticate sessions, remember preferences, and analyze usage. You can control cookies through your browser settings. Disabling certain cookies may affect functionality. We do not use cookies for cross-site advertising or sell data derived from cookies.

The Service is not directed to children under 16, and we do not knowingly collect personal information from children under 16. If you believe we have collected information from a child, please contact us and we will promptly delete it.

Customer data is stored in the United States by default. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. We take appropriate measures to ensure your data is protected in accordance with this Privacy Policy and applicable law, including standard contractual clauses where required.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and, where appropriate, sending a notification through the Service or via email. The "Last updated" date at the top of this page indicates when the policy was last revised. Continued use of the Service after changes constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or our data practices, contact us at privacy@orpio.io. Our data protection practices are detailed further on our Security page.