Privacy Policy

1. Controller

This policy provides information under Art. 13 and 14 of the General Data Protection Regulation (GDPR) and the Estonian Personal Data Protection Act (Isikuandmete kaitse seadus). We have not appointed a data protection officer because the requirements of Art. 37 GDPR are not met. Please send privacy requests to the email address above.

2. Principles

• We only process data needed to run the service.
• No tracking, no analytics tools, no advertising, no sale of data.
• We do not use your inputs or the models' answers to train AI models.
• Your messages and chat titles are encrypted with AES-256-GCM before storage. The key is kept only on our servers, not in the database.
• The database and application run in a data center in the European Union.

3. Data we process

Account

Email address, password (only as a scrypt hash, never in plain text), login times and a session cookie. Legal basis: Art. 6(1)(b) GDPR (contract).

Conversations

Your inputs and the models' answers, stored encrypted so your history stays available. Legal basis: Art. 6(1)(b) GDPR. You can delete individual conversations at any time.

Attachments (images and files)

Before upload, images are resized in your browser and re-created without metadata (for example EXIF and GPS data). They are sent to the provider of the chosen model only for the respective answer and are not stored by us, only the file name and image size are stored. For files (text, code, PDF), the text is extracted and stored encrypted like your messages so the model can access it later in the conversation. The original file is not stored. Uploads are processed only in memory and never written to disk. Legal basis: Art. 6(1)(b) GDPR.

Billing

Credit, top-ups, token usage and cost per request. Legal basis: Art. 6(1)(b) and (c) GDPR (contract, retention under tax and commercial law). For VAT purposes, we also store for each payment the country of your card or bank account and the country Mollie detected at payment, each only as a country code, never IBAN, card number or IP address (Art. 24b and 24f Implementing Regulation (EU) 282/2011). Legal basis: Art. 6(1)(c) GDPR.

Automatic top-up

If you set up the automatic top-up, we store your settings (threshold, amount, currency), the order of your payment methods as Mollie mandate IDs and, for display only, the card brand, last four digits and expiry date or the last four characters of the IBAN. We do not receive card numbers or full IBANs. We also log every automatic charge (amount, status, time) to enforce the safety limits. The data is deleted with your account, payment records after the retention periods below. Legal basis: Art. 6(1)(b) GDPR.

Referral program

If you register with an invite code, we store which account invited you, the status of the referral and the bonus credited. The inviting person only sees counts, never your email address or your usage. To prevent abuse (second accounts), we store an irreversible hash of your IP address at registration, created with a secret key. It is deleted as soon as the referral is completed, at the latest after 90 days. Legal basis: Art. 6(1)(b) GDPR (taking part in the program) and Art. 6(1)(f) GDPR (protection against abuse).

Support requests

If you write to us via the support form, we process your email address, optionally your name, subject, topic and your messages to answer your request. Content is stored encrypted. You receive confirmations and replies by email from noreply@orrevan.com. Legal basis: Art. 6(1)(b) GDPR (requests about the contract) or Art. 6(1)(f) GDPR (general requests). Without an account, the form is protected by the same security check as the login.

Withdrawal

If you withdraw via “Withdraw from contract here”, we store your name, email address, contract details and the date and time like a support request and send you an acknowledgement of receipt by email. Legal basis: Art. 6(1)(c) GDPR (legal obligation to confirm and refund).

Server logs

For technical reasons, IP address, time and requested address are recorded in our host's logs when you access the site. The content of your messages is not logged. Legal basis: Art. 6(1)(f) GDPR (security and abuse prevention).

4. Recipients and processors

• Hostinger International Ltd., Larnaca, Cyprus (hosting of application, database and email). Data center in the EU. Basis: data processing agreement under Art. 28 GDPR.
• Mollie B.V., Amsterdam, Netherlands (payment processing). Mollie processes your payment data as an independent controller. We do not receive card data. For the monthly plan and the automatic top-up, Mollie creates a customer and payment mandates for you (for example IBAN or card reference) so later charges work without entering details again. For this we only send an internal customer ID, neither name nor email address. When you delete your account, we also delete this customer at Mollie. Legal basis: Art. 6(1)(b) GDPR.
• abliteration.ai (AI provider). To answer, your inputs including the conversation history are sent directly to abliteration.ai. The provider may be based outside the EU and, according to its own statement, does not store inputs or answers. We send neither your email address nor your name. Please do not enter particularly sensitive personal data of third parties.
• FEYA s.r.o. (Heabsy), Bratislava, Slovakia (AI provider, processor). For the Heabsy models, your inputs including history are sent to Heabsy and processed on GPU servers operated by Heabsy. These may be located in the European Economic Area or in the USA. According to the provider, inputs and answers are not stored.
• Web search (only if you turn it on for a message). In that case only the text of that message is sent to the search service as a query, without your email address, IP address or previous history. The default is the Wikipedia interface of the Wikimedia Foundation, San Francisco, USA. Alternatively, a paid search service can be used: Linkup (Paris, France, processor) or Brave Software (USA). The sources found are stored encrypted together with the answer.

Transfers to third countries

With the AI providers and the web search, data may be processed outside the European Economic Area, in particular in the USA. We base such transfers on an adequacy decision of the EU Commission (for certified US recipients the EU-US Data Privacy Framework) or on EU Standard Contractual Clauses (Art. 45 and 46 GDPR). For the web search and for providers without such safeguards, the transfer takes place because it is necessary to perform the contract you requested (Art. 49(1)(b) GDPR). Information on the safeguards is available on request.

5. Cookies and local storage

We only use technically necessary cookies for your login and your chosen language, and local storage for your settings (color scheme, chosen model, notice read). Under Art. 5(3) of the ePrivacy Directive 2002/58/EC (implemented in Estonia in the Elektroonilise side seadus), these are allowed without consent because they are strictly necessary for the service you requested. Fonts are served from our own server, there is no connection to Google Fonts.

6. Retention

• Account and conversations: until you delete them or close your account.
• Usage data: until the account is deleted.
• Support requests: 12 months after the last message once the request is closed, otherwise at the latest after 24 months. Requests from an account are deleted with the account.
• Payment and accounting records: 7 years under the Estonian Accounting Act (Raamatupidamise seadus, § 12). After an account is deleted, they are kept separately from your person.

7. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). You can export and delete your data directly in your account. You can withdraw any consent given at any time with effect for the future.

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Estonian Data Protection Inspectorate, Andmekaitse Inspektsioon (AKI), Tatari 39, 10134 Tallinn, www.aki.ee. You can also contact the supervisory authority where you live.

8. Security

Transmission only via TLS, encrypted storage of content, strict access rules, rate limiting and restrictive security headers. Login, registration and the support form are protected by a self-hosted security check (proof of work): your browser solves a short computing task. No cookies are set, no third-party services are involved and no personal data is stored. Legal basis: Art. 6(1)(f) GDPR (abuse prevention).

9. No automated decision-making

There is no automated decision-making or profiling within the meaning of Art. 22 GDPR.