Privacy policy

1. Who is responsible for what

There are two different relationships in this policy, and it matters which one applies.

• For the people who sign up to ORA Commerce — merchants, their staff, and visitors to this website — we are the controller of that personal data.
• For the shoppers and trade buyers whose details sit inside a merchant's store, the merchant is the controller and we are a processor acting on their instructions. If you are a shopper asking about your data, contact the store you bought from.

2. What we collect

As controller, we collect only what the platform needs to work:

• Account data — your name, email address, business name, and optionally a phone number.
• Authentication data — one-time sign-in codes and the sessions they create.
• Store configuration — the settings, catalogue and rules you enter, which we hold on your behalf.
• Billing data — plan, billing period and invoices. Card details are handled by our payment provider and do not reach our servers.
• Usage and technical data — pages requested, approximate location from IP address, browser and device type, and error logs.
• Ora usage records — for each AI call, the feature, model, token counts, latency and the account that made it.
• Enquiries — what you send us through the contact form or by email.

3. Why we hold it

• To provide the platform and your store — performance of our contract with you.
• To bill you and keep accounting records — contract and legal obligation.
• To keep the platform secure and investigate abuse — our legitimate interest.
• To answer your enquiries and provide support — contract and legitimate interest.
• To send service messages about your account. Marketing email is sent only with your consent and every message can be unsubscribed.

4. Ora and your data

Ora gathers context from your own store when you ask it something, and only from sources the asking user is permitted to read. It has no access to any other merchant's data.

Ora's action log is restricted by design to public identifiers and counts. It does not record a customer's name, address, email or the contents of an order.

Where you connect your own AI provider key, the question and the context assembled for it are sent to that provider under your agreement with them. If no key is connected, the digest and the attention list still work, because they are computed rather than generated.

5. Who else processes it

We use a small number of providers, each under a data processing agreement and each limited to what their function requires:

• Cloud hosting and database infrastructure.
• Transactional email delivery, for sign-in codes and store notifications.
• Payment processing, for subscription billing.
• Error monitoring and platform logging.
• An AI provider, where you have connected a key.

We do not sell personal data, and we do not share it for anyone else's advertising.

6. International transfers

Some providers operate outside the country you are in. Where personal data moves across borders we rely on an approved transfer mechanism, such as standard contractual clauses, and we keep the transfer limited to what the service needs.

7. How long we keep it

• Account and store data — for as long as the account is open, then 30 days so you can export, then deletion.
• Billing and tax records — for the period the applicable tax law requires, typically several years.
• Security and access logs — up to 12 months.
• Ora action logs — for the window your plan includes, from 30 days to 24 months.
• Contact enquiries — up to 24 months from the last message.

8. How we protect it

• Every store's data is isolated at the database, not by application code remembering to filter.
• Access by our staff to a merchant's store requires a request with a named scope, your approval, and it expires by itself. Each session is logged where you can read it.
• Sign-in is by one-time code, so there is no reusable password for us to lose.
• Data is encrypted in transit, and at rest by our infrastructure provider.

9. Your rights

Subject to the law that applies to you, you may ask us to:

• give you a copy of the personal data we hold about you;
• correct it if it is wrong;
• delete it, where we have no continuing obligation to keep it;
• restrict or object to a particular use;
• provide it in a portable format;
• withdraw a consent you previously gave.

Write to privacy@oracommerce.ai and we will respond within 30 days. If you are unhappy with our answer you may complain to your local data protection authority.

10. Children

The platform is for businesses. We do not knowingly collect personal data from children. If you believe a child's data has reached us, tell us and we will remove it.

11. Changes

If we change this policy materially we will email the address on your account before the change takes effect. The date at the top always shows the current version.