Privacy policy

1. Who is responsible for your information

OrkenFlow is a brand of Levanta Payments LLC. This policy distinguishes our website and business relationship activities from the services we provide to PSPs, Admins and their authorized users.

We act as a controller where we determine the purposes and means of processing website or business contact information. For platform personal data processed on documented lawful PSP/Admin instructions, we generally act as a processor or service provider under the applicable service agreement and DPA. The relevant law and actual processing activity determine each party’s role; a payment partner may have its own responsibilities and privacy notice.

2. Information we handle

Depending on how you interact with us, information may include:

• Contact and company details you provide directly, account and authorized-user information, correspondence, integration requirements and support records.
• Technical hosting and security logs, which may include IP addresses, request information, browser/device details, timestamps and error events.
• Platform merchant, user, broker and end-customer identification and contact details; token references, transaction records and applicable limited transaction/payment metadata routed under the service agreement and lawful client instructions.

Only provide information you are authorized to share. Do not send passwords, API secrets or full card data through website inquiries or ordinary email. Payment data handling depends on the configured partners and agreed service scope.

OrkenFlow uses PCI Vault for payment-card tokenization. Card details are stored in PCI Vault and represented by token references for the configured payment workflows. PCI Vault is a third-party service provider involved in card-data tokenization and storage. OrkenFlow handles token references and applicable limited transaction/payment metadata under lawful client instructions. Access and usage are subject to configured permissions and service agreements.

3. Website forms, cookies and browser storage

The demo inquiry form on this website prepares a downloadable summary locally in your browser. It does not transmit the form to OrkenFlow, book a meeting or submit a privacy request. Form values are kept in the current page’s memory while it is open, and the downloaded file is stored wherever you choose on your device. The form does not save its values in cookies, local storage or session storage.

If you separately email that summary or other information to us, the email and attachments become correspondence we receive and handle for the relevant business purpose. You control whether to send them.

The site’s application code does not install advertising trackers or analytics tools and does not set tracking cookies. Hosting services may process technical and security logs when delivering the site. The website loads its fonts from Google Fonts, so your browser sends request information, such as an IP address and browser details, to that service. Your browser and hosting environment can have their own storage or processing behavior; this statement concerns the website’s implemented application functionality, not all client platform deployments.

4. Why information is used

We use information as appropriate to provide and administer services, accounts and integrations; support risk and reporting functions within the agreed scope; respond to inquiries and support requests; maintain security, prevent misuse, manage billing and meet legal obligations. We may use deidentified aggregate information to understand and improve service operation, with safeguards against identification.

Where we act as controller, the lawful basis depends on the purpose and applicable law: taking requested steps before a contract, performing a contract, complying with legal obligations, pursuing legitimate business and security interests where permitted, or consent where required. Where we act as processor, processing follows documented lawful instructions and the DPA rather than an independent decision to use client data for unrelated purposes.

5. Sharing and service providers

Information is shared only as needed for the relevant purpose with infrastructure and support service providers under confidentiality and appropriate data-protection commitments; authorized payment partners under client instructions; recipients where disclosure is legally required; or participants in a protected business transition, subject to appropriate safeguards.

Where required, clients receive DPA and subprocessor information or notice, including applicable contractual procedures for changes. PCI Vault provides third-party card-data tokenization and storage for configured payment workflows. Applicable service agreements, client instructions and configured permissions govern the relevant access and use. Payment partners may handle information under their direct agreements and independent legal duties. OrkenFlow does not receive, hold, control or settle merchant or end-customer funds at any point. Acquiring, payment processing, fund handling and settlement are the responsibility of the relevant PSP or payment provider under its direct agreement.

6. Security, confidentiality and international processing

We use appropriate technical and organizational safeguards proportionate to the service, information and risks, and maintain client confidentiality obligations. Clients remain responsible for authorized access, secure credentials and the controls allocated to them by contract. No internet-based service can promise absolute security.

Information may be processed in countries other than where a client or individual is located. Where applicable law requires safeguards for an international transfer, we apply the required safeguards and contractual arrangements. Contact us for information relevant to your service and jurisdiction.

7. Retention and service transition

Retention is based on the processing purpose, applicable law, contractual requirements and legitimate security or dispute needs. Retention periods vary by information category and these requirements.

On termination, return or deletion of platform data follows the signed agreement and DPA, subject to lawful retention and agreed backup handling. Information retained for a permitted purpose remains subject to applicable confidentiality and protection obligations. A locally downloaded inquiry file remains under your control on your device.

8. Your rights and requests

Depending on applicable law, you may have rights of access, correction, deletion, restriction, objection, portability and withdrawal of consent, and a right to complain to a competent data-protection regulator. Withdrawal does not invalidate processing lawfully carried out before withdrawal. Rights can be subject to verification, legal exceptions and the rights of others.

Platform end-customers should usually direct requests to their merchant or PSP controller. OrkenFlow assists that controller under the DPA and applicable law. For information we handle as controller, or to identify the appropriate channel, contact support@orkenflow.com or your agreed account support/contact channel. We may request proportionate information to verify your identity and understand the request; do not send credentials or full card data.

The local-download form at Request a demo does not send rights requests. Use the email or agreed support channel above.

9. Business audience and policy updates

OrkenFlow is a business service and is not directed at children. If you believe inappropriate personal information has been supplied, contact us so it can be reviewed.

This policy may be updated to reflect service or legal changes, with notice where required. The effective and updated date appears above. Your applicable signed client agreement, order and data processing agreement (DPA) control specifically agreed matters. Applicable mandatory legal rights remain protected. Website policy updates do not retroactively rewrite signed contracts or rates.