Privacy Policy
This Privacy Policy (“Policy”) explains how Adverio OÜ (“Ori”, “we”, “us”, “our”) collects, uses, discloses, transfers, retains, and protects personal data when you use the Ori mobile application, our website, and related services (together, the “Service”), and the rights and choices available to you. It applies to all users of the Service. Capitalized terms not defined here have the meaning given in our Terms of Use.
If you do not agree with this Policy, please do not use the Service. If you have questions or requests, contact help@ori-app.chat.
1. Who we are (Controller)
Adverio OÜ, located at Harju maakond, Tallinn, Kesklinna linnaosa, Tuukri tn 19-315, 10120, is the “controller” (and “business” under US law) responsible for your personal data. When we process content solely to generate your results, the AI providers in §6 act as our processors (service providers) under our instructions.
2. Summary
- You can use Ori anonymously; an account (email, Apple, or Google) is optional.
- To answer you, we send your prompts and attachments to named third-party AI providers (§6) — only after you agree in the app; some processing occurs in the United States and, for certain video, voice and music generation, China.
- Neither we nor our AI providers will use your chats, prompts, files or generated content to train AI models (§6).
- We use a limited set of analytics, attribution, crash-reporting, and subscription tools (§8).
- We do not sell your personal data for money, and we do not use it to build advertising profiles about you beyond measuring our own campaigns (with your consent).
- You can access, delete, and control your data (§13–§14) and delete your account at any time (in-app or via our deletion page).
3. Personal data we collect
We collect the categories below. We minimize what we collect and do not require an account to use core features.
| Category | Examples | Source |
|---|---|---|
| Account & identity | Email address, name (if provided by your sign-in), authentication provider, app-assigned user id, and (if you sign in with Apple/Google) the identifier they return | You / your sign-in provider |
| Content you submit | Chat messages and prompts, attached photos and files, and the notes Ori remembers about you to personalize answers (“memory”) | You |
| Generated content | Text, images, video, and audio produced in response to your prompts; feedback you give (e.g. a thumbs rating or a report) | Created in the Service |
| Purchases | Subscription status, plan, trial state, and purchase history (we do not receive your full card number) | Apple / Google / RevenueCat |
| Usage & interactions | Features used, screens viewed, actions taken, in-app search activity, session and diagnostic events | Automatic |
| Device & technical | Device model, operating system, app version, language, time zone, coarse region (not precise GPS), and network information | Automatic |
| Identifiers | An installation id and, only with your consent, an advertising identifier (IDFA on iOS / Advertising ID on Android) | Automatic (consent-gated) |
| Diagnostics | Crash reports, error logs, and performance data | Automatic |
| Communications | Support requests and the contents of messages you send us; a push token if you enable notifications | You / Automatic |
We do not intentionally collect special-category / sensitive data (e.g. health, biometrics, precise location). Please do not submit such data unless necessary; if you do, you consent to our processing it to provide the Service.
4. How and why we use your data (purposes & legal bases)
Where the GDPR/UK GDPR applies, we rely on the legal bases below.
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Provide the Service — run chats, generate images/video/voice, AI apps, discover, and memory | Contract (Art. 6(1)(b)) |
| Send your prompts/content to third-party AI providers to produce results (§6) | Contract (Art. 6(1)(b)) — and only after you agree in the app |
| Operate accounts, subscriptions, trials, entitlements, and usage limits | Contract |
| Send notifications you enable | Consent |
| Security, abuse/fraud prevention, and content-safety moderation (incl. handling reports) | Legitimate interests; legal obligation |
| Measure performance, diagnose crashes, and improve the Service | Legitimate interests |
| Measure marketing/campaign performance and attribution | Consent (via App Tracking Transparency / equivalent) |
| Comply with law and enforce our Terms | Legal obligation; legitimate interests |
You may withdraw consent at any time (e.g. by changing tracking or notification settings); this does not affect processing carried out before withdrawal. To stop AI processing, close your account in Settings → Close my account.
5. Content-safety moderation
To keep the Service safe and comply with app-store and legal requirements, we and our providers apply automated and manual safeguards to detect and act on prohibited content. If you report an AI response (for example by tapping “Unsafe or harmful”), we process that report and the referenced content to review and improve safety. We may retain records of violations and reports as needed for safety, legal, and enforcement purposes.
6. AI processing and third-party AI providers
We ask before we share. Before any of your content is sent to a third-party AI provider, the app shows a screen (“Welcome to Ori — How your data is used”) that names each provider below, what it receives and why, and asks you to tap Agree and continue or Not now. Nothing is sent until you agree. If you don’t, the app’s AI features stay off and you can still browse the app. You can review this and allow it later from the card that replaces the message box. Because Ori’s features depend on it, sharing stays on once allowed; to stop it, close your account (Settings → Close my account), which deletes your data (§9).
Once you agree, we send your content to two AI providers that act as our processors: Anthropic and fal.ai. fal.ai hosts the image, video and audio models below; for some of them it passes your request on to the company that makes the model. The table shows who receives what, and why:
| Provider | What it receives | Why |
|---|---|---|
| Anthropic (Claude), US | Your messages, the conversation they are part of, any files or photos you attach, and the notes Ori remembers about you (“memory”) | To write answers, run web searches you ask for, and title your chats |
| fal.ai, US | Everything in the three rows below | To run, or pass on, your image, video and audio requests and return the result |
| Black Forest Labs (FLUX), via fal.ai | Your description of a picture, and the photo you want changed if you attach one | To make or edit the picture you asked for |
| Kuaishou (Kling), via fal.ai | Your description of a video, and the photo you start from if you use one | To make the video you asked for |
| MiniMax, via fal.ai | The text you ask to be read aloud, or your description of the music you want | To make the voice or music track you asked for |
All image, video and audio requests are sent to fal.ai (US), which returns the result to us; the model makers above receive them only through fal.ai. We do not send these providers your account email, sign-in details or payment details, or your other conversations. Speech-to-text (dictation) runs on your device using Apple (iOS) or Google (Android); that audio may be processed by Apple or Google under their own terms and is not sent to the AI providers above.
Equal protection. Anthropic and fal.ai process your content only on our instructions and under written agreements with Ori that require them to protect your personal data with the same or equal protection as described in this Policy — including confidentiality, security, and not using your content to train their models. fal.ai is in turn required to hold the model providers it uses to data protection terms no less protective than its agreement with Ori. Processing may occur outside your country (see §10). Ori is independent: it is not affiliated with, endorsed or sponsored by any of these providers, and reaches their models only through Anthropic’s API and fal.ai. AI output can be inaccurate or inappropriate and is not professional advice — see our Terms of Use.
How long providers keep your content. Anthropic deletes it within 30 days, unless it is flagged for a violation of Anthropic’s usage policies, in which case it may be kept for up to 2 years for safety review. fal.ai stores request data for up to 30 days and keeps generated files only temporarily, until they are delivered to Ori; Ori then keeps its own copy for you (§9). The model providers reached through fal.ai process your content under fal.ai’s agreements with them and keep it only as long as needed to provide the service, for safety and abuse prevention, or as required by law.
7. When we disclose your data
We share personal data only as described here:
- Service providers / processors: cloud hosting and storage, the AI providers in §6, and the analytics/attribution/subscription/crash vendors in §8, each acting on our instructions.
- App stores & payment processors: Apple and Google process purchases and provide subscription status.
- Legal, safety & compliance: to comply with law, respond to lawful requests, enforce our Terms, or protect the rights, property, and safety of users, the public, or us.
- Corporate transactions: in a merger, acquisition, financing, or sale of assets, subject to this Policy.
- With your direction or consent: for example, when you share generated content.
We do not sell your personal data for money.
8. Analytics, attribution & tracking technologies
The mobile app does not use browser cookies, but it uses software development kits (SDKs) and device identifiers that function similarly:
- Firebase (Google) — analytics, crash reporting, push messaging, authentication.
- PostHog — product analytics and feature flags.
- AppsFlyer — install attribution and marketing measurement (may use device/advertising identifiers).
- RevenueCat — subscription management.
- Sentry — error and performance monitoring.
App Tracking Transparency & advertising IDs. On iOS we request permission before accessing the advertising identifier for cross-app measurement; if you decline, we do not use it. On Android you can reset or delete your Advertising ID, or opt out of personalization, in system settings. We honor recognized opt-out preference signals (such as Global Privacy Control) where required by law.
9. Retention
We keep personal data only as long as necessary for the purposes above, then delete or de-identify it. Indicative periods:
| Data | Retention |
|---|---|
| Account & profile | Until you delete your account |
| Chats, prompts, attachments, generated media | Until you delete them, or your account |
| Content processed by AI providers (§6) | Anthropic: up to 30 days (up to 2 years if flagged for a policy violation); fal.ai: request data up to 30 days — see §6 |
| Dictation audio | Processed on your device (Apple/Google); not received or stored by Ori |
| Usage & diagnostics / crash data | Up to 24 months, then aggregated/deleted |
| Purchase records | As required for tax, accounting, and audit (typically 7 years) |
| Safety/abuse and legal records | As needed for the purpose or as law requires |
| Back-ups | Purged on our routine back-up rotation after deletion |
10. International data transfers
We and our providers may process your data in countries other than yours, including the United States and, for certain video, voice and music generation (Kling / Kuaishou and MiniMax), China, which may not provide the same level of protection as your home country. Requests to those models reach China through fal.ai, under fal.ai’s agreements with the model providers. Where we transfer personal data out of the EEA, UK, or Switzerland, we use appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK Addendum/IDTA) or reliance on an adequacy decision, together with supplementary measures where needed. You may request a copy of the relevant safeguards at help@ori-app.chat.
11. Security
We use technical and organizational measures appropriate to the risk, including encryption in transit (TLS/HTTPS), access controls and least-privilege, network protections, and monitoring. No method of transmission or storage is completely secure; we cannot guarantee absolute security. If we become aware of a personal-data breach affecting you, we will notify you and regulators where required by law.
12. Automated decision-making
The Service uses AI to generate content in response to your input. This is not automated decision-making that produces legal or similarly significant effects about you within the meaning of GDPR Article 22, and we do not use it to make such decisions. Safety systems may automatically flag or block prohibited content; you can contact us to contest an action.
13. Your rights (EEA, UK, Switzerland)
Subject to conditions and exemptions in applicable law, you may:
- access your personal data and receive a copy;
- rectify inaccurate or incomplete data;
- erase your data (“right to be forgotten”);
- restrict or object to certain processing (including processing based on legitimate interests);
- data portability;
- withdraw consent at any time; and
- lodge a complaint with your local supervisory authority.
To exercise these rights, email help@ori-app.chat or use the in-app controls. We will respond within the timeframe the law requires (generally one month for the GDPR) and may need to verify your identity.
14. US state privacy rights
If you are a resident of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, or other states with comprehensive privacy laws, you may have rights to know/access, correct, delete, obtain a portable copy, and opt out of “sale,” “sharing”/targeted advertising, and certain profiling. In the preceding 12 months we collected the categories in §3 and disclosed them to the service providers in §6–§8 for the purposes described.
- We do not sell personal information for money, and we do not process it for cross-context behavioral advertising to build profiles about you. To opt out of any sharing used for marketing measurement, decline the tracking prompt or email us.
- Sensitive personal information: we do not use or disclose it for purposes that require a right-to-limit offering.
- How to exercise rights: email help@ori-app.chat or use in-app controls; you may use an authorized agent. We will not discriminate against you for exercising your rights, and you may appeal a decision by replying to our response.
15. Children’s privacy
The Service is not directed to, and we do not knowingly collect personal data from, children under 16. If you believe a child has provided us personal data, contact help@ori-app.chat and we will delete it. We do not knowingly sell or share the personal data of minors.
16. Third-party links and services
The Service may link to or rely on third-party services with their own privacy practices. We are not responsible for those practices; please review their policies.
17. Changes to this Policy
We may update this Policy from time to time. We will post the updated version with a new effective date and, for material changes, provide additional notice (for example, in the App). Your continued use after the effective date constitutes acceptance of the updated Policy.
18. Contact us
Adverio OÜ
Harju maakond, Tallinn, Kesklinna linnaosa, Tuukri tn 19-315, 10120
Privacy: help@ori-app.chat · Support:
help@ori-app.chat