Privacy Policy

1.Scope — What This Policy Covers

This policy covers any information relating to an identified or identifiable individual ('personal data') that we process when you visit our website, request a demo, create an account, or use the ORA product. It does not cover the practices of third parties we do not own or control, including sites we link to or services you connect to ORA.

2.Information We Collect and Why

We collect the following categories of information, for the purposes described:

Account and contact data

• Your name, work email, brand or company name, phone number, and role — to create and administer your account, respond to enquiries, and provide support.

Demo and enquiry data

• The details you submit through our 'Book a demo' form — name, work email, company, product category, phone, and any message — so our team can contact you and schedule a demo.

Content you provide and outputs we generate

• Product images, brand assets, reference material, prompts or 'hints', and settings you upload or enter — to generate campaigns, photography, video, and creative on your behalf.
• The images, videos, and creative that ORA generates for you, and any edits or feedback you make to them — to deliver, store, and improve the outputs you receive.

Billing and commercial data

• Plan, subscription, and transaction history — to process payments, prevent fraud, and provide the service. Card details are handled by our payment processor; we do not store full card numbers.

Device and technical data

• IP address, browser and device type, operating system, and diagnostic logs — to keep the service secure, troubleshoot problems, and prevent abuse.

Usage and analytics data

• Pages viewed, features used, referring links, and interactions — to understand how the service is used, measure reach, and improve it.

Inferences

• Preferences and characteristics we reasonably infer from the above — to personalise and improve your experience.

Legal bases (where UK/EU GDPR applies): we rely on performance of a contract (to provide the service you request), our legitimate interests (to operate, secure, and improve our business), your consent (for example, non-essential cookies and marketing), and compliance with legal obligations.

Sensitive data: we do not intentionally collect special categories of personal data (such as racial or ethnic origin, political opinions, health, or biometric data) and ask that you do not submit it through the service.

3.How We Use Your Content and AI

We process the content you upload solely to provide the service — generating, editing, storing, and delivering the campaigns and creative you request, and providing support.

We may use aggregated or de-identified data to operate and improve our service. We will not use your identifiable brand content to train or develop our AI models without a lawful basis, and where consent is required we will ask for it first.

You can ask us not to use your content for model development by emailing hello@oralab.ai with the subject 'AI Opt-Out'. We do not use your content to make decisions that produce legal or similarly significant effects about you without human involvement.

4.How We Share Your Information

We do not sell your personal data. We share it only as follows:

• Service providers and subprocessors — hosting, storage, AI compute, analytics, email, and payment providers who process data on our behalf under contract and only as needed to perform their service.
• Business partners and integrations you authorise — for example, when you connect ORA to a tool or publish creative to a channel you have chosen.
• Legal and safety — where required by law, to enforce our terms, or to protect the rights, property, or safety of ORA, our users, or the public.
• Business transfers — if we are involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction.

5.Cookies and Tracking Technologies

We and our providers use cookies and similar technologies to run the site and understand how it is used:

• Essential cookies — required to serve pages, sign you in, and keep the service secure.
• Functional cookies — remember your preferences.
• Analytics cookies — we use Google Analytics to understand usage and improve the service.

You can control cookies through your browser settings and, where offered, our consent controls. If we add advertising or cross-site tracking cookies in the future, we will update this policy and, where required, request your consent first.

6.How Long We Keep Your Information

We keep personal data for as long as needed to provide the service and for legitimate business or legal purposes, then delete or anonymise it. Account and content data are retained while your account is active and for a reasonable period afterwards; demo enquiries are kept for as long as needed to follow up and maintain our records; technical logs are kept for a short period for security and diagnostics.

7.How We Secure Your Information

We use technical, organisational, and administrative measures designed to protect personal data, including encryption in transit, access controls, and provider agreements. No method of transmitting or storing data is completely secure, so we cannot guarantee absolute security. Please protect your account by using a strong password and signing out on shared devices.

8.Your Privacy Rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you and receive a copy.
• Correct inaccurate or incomplete data.
• Delete your data.
• Port your data to another provider in a machine-readable format.
• Object to or restrict certain processing, and withdraw consent at any time.

To exercise any of these rights, email hello@oralab.ai. We will respond within the period required by applicable law and may need to verify your identity first. We will not discriminate against you for exercising your rights.

9.U.S. State Privacy Rights

Residents of U.S. states with comprehensive privacy laws (including California, Colorado, Connecticut, Texas, Virginia, and others) have the rights to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of targeted advertising or any 'sale' or 'sharing' of personal data. We do not sell personal data. To exercise these rights, or to appeal a decision, email hello@oralab.ai.

10.India — Digital Personal Data Protection Act

If you are in India, we process your personal data as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 (the 'DPDP Act'), and you are a Data Principal. Where we rely on your consent, we ask for it through a clear notice and you may withdraw it at any time; withdrawing consent does not affect processing already carried out.

As a Data Principal you have the right to:

• Access a summary of the personal data we process about you and how we process it.
• Correct, complete, update, or erase your personal data.
• Nominate another individual to exercise your rights in the event of your death or incapacity.
• Readily available grievance redressal from us before approaching the Data Protection Board of India.

To exercise these rights or raise a grievance, email hello@oralab.ai. If your grievance is not resolved to your satisfaction, you may lodge a complaint with the Data Protection Board of India. You are responsible for providing accurate information and for not impersonating others when exercising these rights.

11.International Data Transfers

We operate on cloud infrastructure that may process data in countries other than your own, including the United States. Where we transfer personal data out of the UK or European Economic Area, we rely on appropriate safeguards such as the European Commission's standard contractual clauses. If you are in the EU, UK, or Switzerland, you may also lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office).

12.Children's Privacy

Our services are intended for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us information, email hello@oralab.ai and we will delete it.

13.Third-Party Sites and Services

Our services may link to or integrate with third-party sites and tools that we do not control. This policy does not apply to those third parties, and we are not responsible for their privacy practices. Please review their policies before providing them your information.

14.Changes to This Policy

We may update this policy as our products and legal obligations evolve. When we make material changes we will update the date at the top of this page and, where appropriate, notify you. Your continued use of the services after an update means you accept the revised policy.

15.Contacting Us

For any question about this policy, to exercise your rights, or to raise a grievance about how we handle your personal data, contact us at:

• ORALAB — Email: hello@oralab.ai
• Registered office: 5th Floor, Tower B, KLJ Square, NH-48, Sector 83, Gurugram, Haryana 122012, India
• GSTIN / Registration Number: 06AAKFO3744P1ZO