Privacy Policy
Effective Date: August 28, 2026
Last Updated: September 11, 2026
1. Overview
This Privacy Policy explains how Novapco Holdings LLC, a Wyoming limited liability company doing business as ORABUENA (“ORABUENA,” “we,” “us,” or “our”), collects, uses, discloses, retains, and protects personal information in connection with orabuena.com, the ORABUENA platform, and related account, commerce, waitlist, email, support, and booking services (together, the “Service”).
This Policy applies to website visitors, waitlist subscribers, prospects, account holders, customers, booking participants, and anyone who contacts us. It also explains how we process the Content customers submit to AI Features. When Customer Content contains information about another person, the Customer is responsible for having the rights and lawful basis needed to submit it.
By using the Service, you acknowledge that your personal information will be handled as described in this Policy. If you do not agree, do not use the Service.
2. Personal Information We Collect
| Category | Examples | Source | Purpose |
|---|---|---|---|
| Account information | Name, email, password hash, company, role, authentication and account status | You and the Service | Create and operate an account, authenticate you, enforce access controls, and provide support |
| Waitlist and marketing preferences | Name, email, consent choice, source, tags, confirmation and unsubscribe status | You, through ORABUENA forms and emails | Manage the launch waitlist and send communications you requested |
| Booking information | Name, email, selected time, time zone, intake answers, confirmation and attendance status | You, through the booking service | Schedule and manage discovery or support meetings and related messages |
| Billing and subscription information | Billing contact, billing address, plan, order, subscription, payment status, tax and transaction identifiers; Stripe holds full payment-card details | You, Stripe, and FluentCart | Process purchases, renewals, cancellations, refunds, tax, receipts, and customer-portal functions |
| Customer Content | Prompts, instructions, files, URLs, briefs, and Outputs submitted to or generated through AI Features | You and Authorized Users | Provide the Service and the requested AI or Agent workflow |
| Usage, device, and security data | IP address, browser, device, pages or features used, timestamps, session and error logs, security events | Automatically from your use | Operate, secure, troubleshoot, measure, and improve the Service |
| Cookies and similar technologies | Session, preference, authentication, cart, consent, and measurement identifiers | Automatically, subject to configuration and choices | Maintain sessions and preferences, provide site and cart functions, and understand Service use |
| Support communications | Messages, attachments, and account or technical information you provide | You | Respond to questions, resolve issues, and maintain support records |
| Connected-service credentials | API keys or authorization tokens for a third-party model or integration you choose to connect, if that capability is enabled | You or the connected provider | Make the connection and perform the requests you authorize |
We do not intentionally collect health information, government identification numbers, precise biometric identifiers, or other sensitive categories unless a specific feature clearly requests them and provides an appropriate notice. Do not place sensitive personal information in free-text forms, prompts, booking answers, or support messages unless it is necessary and you are authorized to provide it.
3. How We Use Personal Information
We use personal information to:
- provide, operate, personalize, and secure the Service;
- create and authenticate accounts and enforce permissions;
- manage waitlist registration, consent, confirmation, and unsubscribe choices;
- schedule and administer meetings;
- process orders, subscriptions, receipts, taxes, renewals, cancellations, refunds, disputes, and failed payments through Stripe and FluentCart;
- perform AI and Agent workflows that you request;
- send transactional, account, security, booking, and consented marketing emails through our configured email systems;
- respond to support and privacy-rights requests;
- detect and prevent abuse, fraud, malware, unauthorized access, and violations of our Terms of Service;
- analyze and improve the reliability and usability of the Service; and
- comply with legal, tax, accounting, and regulatory obligations.
We do not sell personal information for money. We do not use payment-card data for advertising, and ORABUENA does not store full payment-card numbers.
4. AI Features and Customer Content
4.1 Bring Your Own Model
ORABUENA does not include an AI model, model subscription, token allowance, or model usage credit. To use AI Features, a Customer must connect and maintain its own supported Model Provider account and credential. When the Customer directs an AI request, ORABUENA transmits the Content and technical context needed to perform that request to the Customer-selected Model Provider and receives the resulting response or status.
4.2 Model Providers and Connected Integrations
The Customer-selected Model Provider or connected integration processes information under the Customer’s agreement with that provider and under the provider’s own terms and privacy practices. We store a connected credential only as needed to maintain the connection and perform requests the Customer authorizes, and we do not use it to access the connected account for unrelated purposes.
4.3 No Training on Customer Content
ORABUENA does not use Customer Content to train or fine-tune a general-purpose AI model. We may use aggregated or de-identified usage information to operate, secure, debug, and improve the Service in a form that does not reasonably identify a Customer or its Content.
4.4 Customer Responsibility
You are responsible for the Content you submit and for reviewing Outputs and Agent actions before publishing, implementing, or relying on them. Do not submit information you lack the right or lawful basis to process.
5. How We Disclose Information
We disclose personal information only as reasonably necessary for the purposes described in this Policy:
| Recipient or category | Purpose |
|---|---|
| Stripe | Payment processing, tax functions when enabled, customer portal, subscriptions, refunds, disputes, and fraud controls |
| Hostinger | Hosting, database, backups, caching, security scanning, and related infrastructure for the WordPress site |
| Cloudflare | DNS, security and delivery services, and Email Sending for configured transactional or marketing messages |
| WPManageNinja / Fluent software | Self-hosted WordPress functions for forms, CRM, email routing, commerce, booking, authentication, and affiliate administration; vendor support access may occur when separately authorized |
| A Model Provider or connected integration you select | Process Content and connection data only to perform the connection or request you authorize, under your agreement with that provider |
| Search Console and other measurement or administrative services that ORABUENA actually enables; each service is subject to its configuration | |
| Professional advisors and service providers | Legal, accounting, security, compliance, insurance, or technical support subject to appropriate obligations |
| Law enforcement, courts, or regulators | When reasonably necessary to comply with valid legal process or protect rights and safety |
| A buyer, successor, or transaction participant | In connection with a merger, financing, acquisition, reorganization, or sale, subject to appropriate confidentiality and applicable law |
The Fluent plugins listed above operate within our WordPress environment; they are software components, not a statement that the vendor independently receives every record processed by those components.
We do not share personal information for cross-context behavioral advertising. If that practice changes, we will update this Policy and provide any legally required choice before beginning it.
6. Legal Bases and International Processing
Depending on the context and applicable law, we process personal information to perform a contract, take steps at your request, pursue legitimate interests such as operating and securing the Service, comply with law, or act on consent. Where we rely on consent, you may withdraw it without affecting processing that already occurred lawfully.
ORABUENA and its providers primarily process information in the United States. If you access the Service from another country, your information may be transferred to the United States or another location where a provider operates. Where required, we will use an appropriate transfer mechanism and provide additional disclosures.
7. Data Retention
We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including to provide the Service, maintain security and business records, comply with tax and legal duties, resolve disputes, and enforce agreements.
Retention depends on the type of information and the status of the relationship:
- account and subscription records are retained while the account is active and afterward as needed for legal, tax, accounting, security, or dispute purposes;
- waitlist and marketing records are retained until consent is withdrawn, communications are no longer reasonably relevant, or a shorter legal limit applies; suppression data may be retained to honor an opt-out;
- booking and support records are retained for the operational and dispute period reasonably associated with the interaction;
- Customer Content is available for self-service JSON export through Account > Customer Content while service access is active and for 30 calendar days after service access ends. At the end of that window, Customer Content is deleted from the primary service store by a scheduled retention process. Payment, tax, security, dispute, and legally required transaction records are governed separately and are not part of that Customer Content export;
- connected-service credentials are deleted or disabled when the connection is removed, subject to limited security logs and backups; and
- financial records and transaction identifiers may be retained as required by tax, accounting, anti-fraud, and payment rules.
Deletion from active systems may not immediately remove an item from a rolling backup. Backup copies are isolated and expire or are overwritten according to the applicable backup schedule, unless a legal hold requires longer retention.
8. Security
We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. Measures may include access controls, authentication, scoped credentials, encryption provided by our platforms, backups, monitoring, change records, and vendor review. No system is completely secure, and we cannot guarantee absolute security.
If we become aware of a security incident affecting personal information, we will investigate and provide notifications when required by applicable law.
9. Your Privacy Rights and Choices
Depending on where you live, you may have rights to request access to personal information, correction, deletion, portability, or information about our processing; to withdraw consent; to opt out of certain uses; or to appeal a decision. We do not discriminate against a person for exercising a privacy right.
To make a request, email [email protected]. We may need to verify your identity and authority before fulfilling it. An authorized agent may submit a request where permitted by law, subject to verification.
You may unsubscribe from marketing messages using the link in the email or by contacting us. You may still receive necessary transactional, account, security, subscription, or booking messages.
You may manage non-essential cookies through any consent controls we provide and through your browser settings. Blocking essential cookies may prevent account, cart, or checkout functions from working.
10. Cookies and Measurement
ORABUENA uses cookies and similar technologies necessary for WordPress sessions, security, preferences, forms, accounts, cart, checkout, and customer-portal functions. We may also use measurement tools that are disclosed through our cookie interface or site settings when enabled.
We will not intentionally enable cross-context behavioral advertising or non-essential marketing pixels without updating this Policy and providing any choice required by law.
11. Children’s Privacy
The Service is not directed to individuals under 18, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided information, contact [email protected] so we can investigate and delete it as appropriate.
12. Third-Party Sites and Services
The Service may link to or integrate with third-party services. Except where we act as a controller or processor under applicable law, we are not responsible for a third party’s independent privacy practices. Review its privacy policy before providing information or connecting an account.
13. Changes to This Policy
We may update this Policy from time to time. The “Last Updated” date on the published version will reflect the most recent change. For a material change, we will provide notice through the Service, by email, or as otherwise required by law before the change takes effect.
14. Contact Us
For questions or privacy-rights requests, contact:
Novapco Holdings LLC (d/b/a ORABUENA)
30 N Gould St
Sheridan, WY 82801