Privacy Policy

Last updated: 25 August 2026

This Privacy Policy explains how ORLA Technologies Pty Ltd (ABN 31 701 433 169), trading as ORLA Legal Hub (“ORLA”, “we”, “us”), collects, uses, discloses and protects personal information when you use the ORLA Legal Hub platform and the website at orlalegalhub.com. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. Who we are and our role

ORLA provides legal-technology software to law firms. When a law firm uses ORLA to manage its clients and matters, the firm is the controller of that client and matter data and ORLA acts as the firm’s processor, handling the data on the firm’s instructions to provide the service.

2. Information we collect

Account information — names, work email addresses, phone numbers and role for the staff who use the platform.
Firm and client data — information a firm enters about its clients and matters. The firm controls this data; ORLA processes it to provide the service.
Usage and device data — first-party analytics about how the platform and website are used. We do not use third-party advertising trackers.
Google account data — where a user chooses to connect their Google Calendar, we receive their Google email address and calendar availability (free/busy) and event information, used only to provide the calendar features described below.
Payment data — payments are processed by our payment providers (Square, Stripe); we do not store full card numbers.

3. Google user data — Limited Use

ORLA Legal Hub’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

When a user connects their Google Calendar, ORLA requests only the scopes it needs:

openid and userinfo.email — to read the email address of the Google account being connected. It is shown in ORLA’s settings as “Connected as…” so the user can confirm which account is linked and disconnect it. ORLA does not use Google to sign in.
calendar.freebusy — to read the user’s busy times so ORLA can prevent double-booking a consultation.
calendar.events — to write ORLA-created appointments back into the user’s calendar so their diary stays in sync.

ORLA stores no calendar content. freeBusy returns only start and end times — never event titles, attendees, locations or descriptions — and those intervals are used in memory to filter the times offered to a client, then discarded. The only events ORLA creates or deletes are the appointments it made itself; it never lists, searches or reads a user’s existing events.

In relation to data received from Google APIs, ORLA affirms that we:

use it only to provide and improve the calendar features requested by the user;
do not transfer or sell it to third parties, except as necessary to provide the feature, for security, to comply with law, or with the user’s consent;
do not use it for advertising;
do not allow humans to read it, except with the user’s consent, for security or to comply with applicable law; and
do not use it to develop, improve or train generalised artificial-intelligence or machine-learning models.

A user can disconnect Google Calendar at any time in ORLA’s settings (which revokes ORLA’s access and deletes the stored tokens), or via their Google Account permissions.

4. How we use personal information

To provide, maintain and secure the platform; to deliver the features a firm and its users choose (including calendar sync, messaging, bookings and payments); to provide support; to administer billing; and to comply with our legal obligations.

5. Service providers (sub-processors)

We use trusted providers to deliver the service, each processing data only to provide their function: Cloudflare (hosting and storage), Twilio (telephony and SMS), Resend (transactional email), Square and Stripe (payments), Xero (accounting sync, where a firm connects it), and Google (calendar, where a user connects it).

6. Storage and security

Data is hosted on Cloudflare infrastructure and transmitted over encrypted connections. We apply reasonable technical and organisational measures to protect personal information, and restrict access to authorised personnel.

7. Retention and deletion

We retain personal information for as long as an account is active or as needed to provide the service and meet legal obligations. A firm may export and delete its data on exit; a user may disconnect connected services (such as Google Calendar) at any time, which deletes the associated access tokens.

8. Your rights

Subject to the Privacy Act 1988 (Cth), you may request access to, or correction of, the personal information we hold about you. If your data was provided to a firm through the platform, we will direct such requests to that firm as the controller. To make a request or raise a concern, contact us using the details below.

9. Contact us

ORLA Technologies Pty Ltd (t/a ORLA Legal Hub), Melbourne, Victoria, Australia.
Privacy enquiries: privacy@orlalegalhub.com.

10. Changes to this policy

We may update this Privacy Policy from time to time. The “last updated” date above shows when it was last revised; material changes will be notified through the platform or website.