Privacy Policy

Effective 3 November 2026

This policy explains how Orrivelo [to be completed before launch] ("we", "us") handles personal data in connection with Orrivelo, and your rights under UK data protection law (the UK GDPR and the Data Protection Act 2018). Questions or requests: orrivelo@outlook.com.

ICO registration number: [to be completed before launch].

1. Two different roles

• Our customers' account data. For the people who sign up to and use Orrivelo, we are the controller. Most of this policy is about that data.
• Our customers' own customer data. When a business uses Orrivelo, it adds details of its own customers (names, email addresses, invoices, replies). For that data the business is the controller and we are its processor, acting only on its instructions under our Data Processing Addendum. If you received a payment reminder sent through Orrivelo and have a question about your data, please contact the business that sent it; we'll help them respond.

2. What we collect about account holders

• Account details: your name, email address and a securely hashed password.
• Business details: your business name, address, contact details, settings and team members.
• Billing: your plan and billing status. Card details are entered directly with Stripe; we never see or store them.
• Usage and security records: a log of actions taken in your workspace (for example, approving a reminder), sign-in sessions, and the IP address and browser details recorded with sessions and some actions, used to keep accounts secure.
• Messages: anything you send us, such as support emails.

We don't use advertising or analytics trackers, and we don't sell personal data.

3. Why we use it, and our legal basis

• To provide Orrivelo (create your account, run your workspace, send emails you approve, take payment): necessary for our contract with you.
• To keep Orrivelo secure and prevent abuse (rate limits, audit logs, fraud prevention): our legitimate interests in protecting the service and its users.
• To send service emails such as password resets, team invites and important changes: contract and legitimate interests. We don't send marketing emails without your permission.
• To keep financial records and meet other legal duties: legal obligation.

4. Who we share it with

We use these service providers to run Orrivelo. They may only use the data to provide their service to us:

We may also share data if the law requires it, or with a business that takes over Orrivelo (in which case this policy would continue to apply).

5. International transfers

Some providers process data in the United States. Where data leaves the UK, we rely on the UK's adequacy regulations (including the UK–US data bridge for certified providers) or on approved safeguards such as the UK International Data Transfer Addendum.

6. How long we keep it

• Account and workspace data: while your account is active. Deleting your workspace in Settings permanently removes its data straight away, including its activity log.
• Backups: deleted data may remain in encrypted backups for up to 30 days before they're overwritten.
• Billing records: kept by Stripe and by us for as long as tax law requires (usually 6 years).
• An anonymous record that a workspace was deleted, with no personal details, so we can show deletion happened.

7. Security

Data is encrypted in transit, passwords are hashed, sensitive values are encrypted at rest, each business's data is kept separate and checked by automated tests, and access is protected by rate limits and logging.

8. Your rights

You can ask to access, correct or delete your personal data, to restrict or object to how we use it, or to receive it in a portable format. Much of this you can do yourself in Settings (including exporting and deleting your data). Otherwise, email orrivelo@outlook.com. We'll respond within one month.

If you're unhappy with how we've handled your data, please tell us first. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint.

9. Cookies

We only use a cookie that keeps you signed in. See our Cookie policy.

10. Children

Orrivelo is a business tool and isn't intended for anyone under 18.

11. Changes

If we change this policy significantly, we'll email account owners before the change takes effect.