Privacy Policy

1. Who We Are

Ornymo is based based in Toronto, Ontario, Canada. We are responsible for the personal information described in this policy and for answering privacy questions. You can reach our privacy contact at team@ornymo.com.

2. Our Role: Customers and Visitors

This policy covers two groups. "Customers" are the businesses and people who create an Ornymo account. "Visitors" are people who chat with the Ornymo widget on a Customer's website. For Customer account data, we decide how the data is used. For Visitor chat data, the Customer decides why the widget is used and we process the data on the Customer's behalf. If you are a Visitor and want to see or delete your chat data, please contact the business whose website you were on, or email us and we will pass your request on.

3. Information We Collect

We collect information you provide directly, such as account details, business information, uploaded content (FAQs and website information), and messages you send us. For paid plans, our payment processor, Stripe, collects your payment details; we receive limited billing information such as plan, status, and the last digits of a card, and we do not store full card numbers. From Visitors, the widget collects the messages they type and, if they choose to give it, an email address so the Customer can reply. We may also collect technical data like browser type, device information, IP address, cookies and similar identifiers, and usage logs when you interact with the platform or the widget.

Please do not submit sensitive information (such as health details, government ID numbers, or payment card numbers) in uploads or chat messages.

4. How and Why We Use Information

We use information to provide the service (create accounts, generate answers, forward unanswered questions to the Customer by email, manage subscriptions and billing), to provide support, to secure the platform and prevent abuse, to meet legal obligations, and to send service notices. We also use usage data to fix bugs and improve the service, for example by looking at how often features are used and where errors occur. We do not use your content or Visitor chats to train AI models. Where the law requires a legal basis, we rely on performing our contract with you, our legitimate interests in running and securing the service, compliance with legal obligations, and your consent where we ask for it (for example, for non-essential cookies or marketing emails). Where the law requires consent for collecting or using personal information, we obtain it.

5. AI Processing

Visitor questions and the Customer's FAQs are processed by AI models, including models from Google (such as Gemma and Gemini), to find and verify an answer. These providers process the data only to provide the service to us, and we do not permit them to use it to train their models. Answers are generated automatically and no automated decision with legal or similarly significant effects on a person is made. We do not routinely read conversations, but we may review them where needed for support, security, or to fix errors. Visitors are told in the widget that they are chatting with an AI.

6. Sharing of Information

We do not sell your personal data. We share information only as needed with service providers that help us run the platform: our AI model providers (the content of questions and the relevant FAQs), Vercel for hosting (website and application traffic, including IP addresses and logs), any database provider we use to store account data and conversations, Stripe for payments (billing details), and email delivery providers (email addresses and forwarded questions). Visitor messages and any email address a Visitor provides are shared with the Customer whose website they used. We may also disclose information when required by law, to protect our rights and users, or in a sale or restructuring of the business. A current list of our providers is available on request at hasnain@ornymo.com.

7. International Transfers

We are based in Canada, and our providers may store and process data in Canada, the United States, and other countries. When data leaves your country, we rely on contracts with our providers and other safeguards the law allows to protect it. Data processed in another country may be accessible to courts and authorities there.

8. How Long We Keep Information

We keep account data while your account is active and delete it within 30 days after you close it, unless we must keep it longer. Visitor conversation logs are kept for 12 months and then deleted, or sooner if the Customer deletes them. Billing records are kept as long as tax and accounting laws require, generally up to 7 years. Backups are overwritten on a regular cycle. After retention ends, we delete or anonymize the data.

9. Your Rights

Depending on where you live, you may have the right to access your personal information, correct it, delete it, restrict or object to its use, receive a copy in a portable format, and withdraw consent at any time. To use any of these rights, email hasnain@ornymo.com. We will reply within 30 days. You also have the right to complain to your privacy regulator, such as the Office of the Privacy Commissioner of Canada, or your local data protection authority in the EU. Providing account information is needed to use the service; providing optional information, such as a Visitor's email address, is voluntary.

10. Security and Breaches

We use reasonable safeguards to protect personal information, including encrypted connections and access controls. No system is completely secure. If a breach creates a real risk of significant harm, we will notify affected Customers and the authorities as required by law, and we keep a record of breaches.

11. Cookies and Similar Technologies

Our dashboard and widget use cookies or local storage that are necessary to log you in, keep sessions secure, and make the widget work. If we use analytics or other non-essential cookies, we will ask for your consent where the law requires it, and you can control cookies in your browser settings. Because we do not sell personal data or share it for cross-context advertising, we do not respond to opt-out requests for those activities, and we do not currently respond to "Do Not Track" signals.

12. Children

Ornymo is a business service for people 18 and over. We do not knowingly collect personal information from children under 13 (or the minimum age in your country). Customers decide where to place the widget, and they are responsible for not directing it to children. If you believe a child has given us personal information, contact us and we will delete it.

13. Customer Responsibilities

If you embed the widget on your website, you must tell your Visitors that their messages are processed by an AI service and by Ornymo, link to a privacy notice of your own, have a lawful basis for collecting their data, and not upload sensitive information.

14. Regional Notes

Canada: we handle personal information in line with Canada's PIPEDA and applicable provincial privacy laws, and Ontario law governs this policy. Quebec: our privacy contact for Quebec residents is hasnain@ornymo.com. United States: we do not sell or share personal information for advertising, and residents of states with privacy laws can use the rights described in section 9. European Economic Area and UK: the rights in section 9 apply, and you can contact us to ask about the safeguards for transfers outside your region.

15. Changes to This Policy

We may update this policy from time to time. We will change the effective date at the top, and for material changes we will notify Customers by email or in the dashboard before they take effect.

16. Contact

Questions or requests about privacy: team@ornymo.com.