← Back to ORMELIA

Privacy Policy

Last updated: July 2026

1. Data Controller

The data controller responsible for your personal data is ORMELIA, located at: To be completed after company incorporation. If you have questions about how your data is processed, contact us at privacy@ormelia.app.

The registered address must be completed after company incorporation.

2. Data We Collect

We collect the following categories of personal data when you use ORMELIA:

  • Account data: your email address, name, preferred language, country, and user category (e.g., student, employee, freelancer).
  • Content data: the documents, receipts, subscriptions, and alerts you upload or create. This includes file metadata (title, type, issuer, dates) and the files themselves.
  • Usage data: feature interactions, insight history (stored to avoid repetitive recommendations), advice memory, and habit/brief state for personalised nudges.
  • Payment data: Stripe customer ID, subscription ID, billing cycle, and subscription status. We do not store your card details, Stripe handles all card information.
  • Device data: browser type, operating system, and IP address (collected by our hosting provider for security and service operation).

3. How We Use Your Data

We process your data for the following purposes:

  • Providing the ORMELIA service: organising your documents, generating alerts, and displaying your administrative dashboard.
  • AI-powered features: extracting metadata from your documents, generating proactive insights, and simulating scenarios (see section 5).
  • Processing payments for Premium subscriptions via Stripe.
  • Sending transactional emails: email verification, password reset, and service notifications.
  • Improving the service: analysing aggregated, anonymous usage patterns to identify and fix issues.
  • Complying with legal obligations.

4. Authentication

You can register and log in using an email and password or via Google single sign-on. Passwords are managed by our platform provider and are never visible to ORMELIA staff. Email verification is required via a one-time code (OTP) sent to your address.

5. AI Processing

ORMELIA uses artificial intelligence to process your data in the following ways:

Document extraction (Premium only)

When you upload a document (PDF, JPG, or PNG, up to 10 MB), AI reads the file to extract metadata such as the document type, issuer name, issue date, and expiry date. A temporary signed URL (valid for 5 minutes) is generated so the AI can read the file. The file content and extracted data are used solely to populate your vault, never to train AI models or shared with third parties.

Proactive insights (all users)

AI analyses your vault data (documents, receipts, subscriptions, alerts) to generate personalised recommendations. Your vault summary is sent to the AI model with your request, along with pre-computed analysis (proof chains, predictions). Insight history is stored on your account to avoid repetitive suggestions. The AI does not retain your data after processing.

What-if simulations (Premium only)

AI simulates the financial and administrative impact of hypothetical decisions. Your current vault summary is sent to the AI model to ground the simulation in your real data. The AI does not retain your data after processing.

No model training

Your documents, receipts, and vault data are never used to train, fine-tune, or improve any AI model. AI processing is purely transactional, your data is processed to generate a response, and the response is returned to you.

6. File Storage and Security

Your uploaded files are stored in private, encrypted cloud storage. Files are never publicly accessible. When you view a file, ORMELIA generates a short-lived signed URL that expires within 60 seconds, enough for you to view or download the file, but not long enough to be shared or reused. The raw file URI is never exposed in the application interface. All data in transit is encrypted via HTTPS.

7. Analytics

We use Plausible Analytics, a privacy-friendly, cookieless analytics service. Plausible does not use cookies, does not collect personal data, and does not track individuals across websites. It provides only aggregated, anonymous statistics (total page views, visit duration, top-level referrers) to help us understand how the service is used. No personal data is shared with Plausible. See our Cookie Policy for details.

8. Payment Processing

Premium subscription payments are processed by Stripe. When you subscribe, Stripe creates a customer record and subscription on your behalf. We store your Stripe customer ID, subscription ID, and billing status on your account to manage your subscription. Stripe processes your card information, we never see or store your card details. Stripe privacy policy is available at stripe.com/privacy.

9. Email Communications

We send transactional emails for account verification, password resets, and service notifications. We do not send marketing emails.

10. Data Sharing and Sub-processors

We do not sell your personal data. We share data with the following sub-processors to operate the service:

  • Hosting and database provider: stores your account data, vault content, and uploaded files.
  • AI provider: processes your vault data to generate insights, extractions, and simulations. Data is processed transactionally and not retained.
  • Stripe: processes your payments and manages your subscription. Only your email, name, and subscription metadata are shared.
  • Plausible Analytics: receives anonymous, aggregated page view statistics. No personal data is shared.

11. Data Retention

We retain your data for as long as your account is active. When you delete your account, all your documents, receipts, subscriptions, and alerts are permanently erased, and your account is anonymised. This happens immediately upon confirmation, there is no 30-day grace period. If you have an active Premium subscription, it is cancelled immediately with no refund for the current period. We may retain limited data if required by law.

12. Your GDPR Rights

Under the General Data Protection Regulation (GDPR) and applicable data protection law, you have the following rights:

Right of accessYou can request a copy of all personal data we hold about you. You can also export your data directly from the Settings page in JSON or CSV format.
Right to rectificationYou can correct inaccurate or incomplete personal data at any time from your account settings.
Right to erasureYou can delete your account and all associated data at any time from the Settings page. This action is permanent and cannot be undone.
Right to data portabilityYou can export your data in a structured, machine-readable format (JSON or CSV) from the Settings page.
Right to objectYou can object to the processing of your data for legitimate interests. Contact us to exercise this right.
Right to restrict processingYou can request that we restrict the processing of your data in certain circumstances. Contact us to exercise this right.

13. Contact

For privacy inquiries, data requests, or to exercise your GDPR rights, contact us at privacy@ormelia.app.

GDPR InformationCookie PolicyTerms of Service