Privacy Policy

Part 1: General information and data subject rights

1. Who is responsible for data processing?

The controller within the meaning of the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and other data protection provisions is:

Thorge Mrowinski
Project “Orately AI”
Gerhart-Hauptmann-Ring 7j
21629 Neu Wulmstorf
Germany
Email: support@orately.app

Note: Orately is currently in a closed, non-commercial test phase (private beta). A business will be duly registered before the official public launch.

2. Rights of data subjects (user rights)

As a data subject you have the following rights vis-à-vis the controller at any time, free of charge, within the scope of the GDPR:

• Right of access (Art. 15 GDPR): You have the right to know whether and which personal data we process about you, for which purposes, and how long it is stored.
• Right to rectification (Art. 16 GDPR): You may request the immediate correction of inaccurate personal data or the completion of personal data we hold about you.
• Right to erasure / right to be forgotten (Art. 17 GDPR): You may request the deletion of your personal data, provided no legal ground (e.g. statutory retention obligations) prevents this.
• Right to restriction of processing (Art. 18 GDPR): Under certain conditions you may request that the processing of your data be restricted.
• Right to data portability (Art. 20 GDPR): You have the right to receive data that we process automatically on the basis of your consent or for the performance of a contract, in a common, machine-readable format — for yourself or for transmission to a third party.
• Right to object (Art. 21 GDPR): Where your personal data is processed on the basis of legitimate interests pursuant to Art. 6(1)(f) GDPR, you have the right to object to the processing on grounds relating to your particular situation.
• Withdrawal of consent (Art. 7(3) GDPR): You may withdraw any consent to data processing you have given at any time with effect for the future.

You also have the right to lodge a complaint with a data protection supervisory authority pursuant to Art. 77 GDPR.

Part 2: Data processing on our website (orately.app)

1. Provision of the website and server log files (hosting via Vercel)

Our website is hosted and delivered via the cloud platform of Vercel Inc. (340 S Lemon Ave #4133, Walnut, CA 91789, USA). When you visit our website, Vercel's servers automatically collect general information and technical data (browser type, operating system, referrer URL, hostname, IP address, date/time). This processing is technically essential to ensure stable, performant and secure delivery.

• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in error-free provision).
• Data processing agreement: We have concluded the legally required data processing agreement (Data Processing Addendum) with Vercel.
• Third-country transfer: Vercel processes data under the EU Standard Contractual Clauses.

2. Vercel Speed Insights (anonymous performance measurement)

For continuous technical optimisation we use the analytics tool Vercel Speed Insights by Vercel Inc. It is configured so that no personal data of website visitors is collected, processed or stored. No tracking of individual user profiles takes place.

• Legal basis: Art. 6(1)(f) GDPR.

Part 3: Data processing in the mobile app (Orately AI - Coach)

1. Registration, authentication and user account (Supabase Auth)

A user account is required to use the app.

• Email registration: We process your email address, a password and a freely chosen username.
• Third-party login (Google Sign-In): If you sign in with your Google account, Google LLC gives us access to the email address stored there, your name and a unique Google user ID.

For the entire user database and authentication we use the services of Supabase Inc. (1111 Broadway, Suite 300, Oakland, CA 94607, USA). The database infrastructure we rent is physically located on servers in Frankfurt am Main (Germany).

• Legal basis: Art. 6(1)(b) GDPR (performance of the user agreement).
• Data processing agreement: We have concluded a data processing agreement (Data Processing Addendum) with Supabase.

2. Collection, processing and storage of audio recordings and photos

The app processes media content you actively provide:

• Voice recordings (audio): To provide feedback during your practice sessions.
• Photos (image files): Optionally, for uploading presentation slides, handouts or notes.

These audio recordings and photo files are stored encrypted in our project database at Supabase on servers located in Frankfurt am Main (Germany).

• Legal basis: Art. 6(1)(a) GDPR (explicit consent) and Art. 6(1)(b) GDPR.
• Storage period: Recordings remain in the database for as long as your user account is active. Upon deletion, all data is deleted without delay.

3. Data transfer and AI analysis (Google Gemini API / Vertex AI)

To generate automated feedback, data is transmitted via an API to the Google AI Agent Platform (Vertex AI) of Google Cloud. The model used is Google Gemini 2.5 Flash.

• Strict use of the regional EU endpoint: The app exclusively uses the regional endpoint within the European Union (Europe region). Processing therefore physically takes place on servers within the EU.
• No model training: It is contractually agreed that the transmitted customer data is not used by Google to train or improve AI models. It is deleted after the transient analysis process.
• Legal basis: Art. 6(1)(b) GDPR. We have concluded a data processing agreement (Data Processing Addendum) with Google.

4. Error analysis and stability monitoring (Sentry)

To ensure stability we use the error diagnostics service Sentry by Functional Software Inc. dba Sentry (45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA).

• Scope of processing: In the event of errors, anonymised log information (e.g. app version, device type, code section) is transmitted. IP addresses are masked immediately.
• Consent-based use: Tracking is only activated after your explicit consent (opt-in) within the app and can be withdrawn at any time in the settings.
• Legal basis: Art. 6(1)(a) GDPR. We have concluded a data processing agreement (Data Processing Addendum) with Sentry based on the EU Standard Contractual Clauses.

5. Push notifications (Firebase Cloud Messaging & Web Push)

We offer optional push notifications to inform you about purely operational events — in particular that Orately is available again after maintenance. No advertising messages are sent and no usage profiles are created.

• Mobile app (Firebase Cloud Messaging): For delivery on iOS and Android devices we use Firebase Cloud Messaging (FCM) by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Only a pseudonymous, device-related delivery token is processed and stored together with the platform information (iOS/Android) in our database (Supabase, servers in Frankfurt am Main). No names, email addresses, content or usage data are transmitted to Google; the token does not allow us or Google to draw any conclusions about your use of the app. Upon sign-out or uninstallation the token becomes invalid and we automatically remove the associated record.
• Web app (Web Push): In the browser we use the open Web Push standard with VAPID authentication via your browser vendor's push service. Only your browser's technical push address and its encryption keys are stored; message contents are encrypted end-to-end to your browser. No Firebase service is used on the web.
• Consent and withdrawal: Notifications are only activated after your explicit consent via the system permission dialog and can be disabled at any time in the system or browser settings.
• Legal basis: Art. 6(1)(a) GDPR (consent). A data processing agreement is in place with Google; any third-country transfers are safeguarded by the EU Standard Contractual Clauses and the EU-U.S. Data Privacy Framework.

6. Transactions, subscriptions and in-app purchases (RevenueCat)

For the technical provision of our purchases we use the infrastructure provider RevenueCat Inc. (831 Montgomery St, San Francisco, CA 94133, USA). Only pseudonymised IDs and purchase status data are transmitted. RevenueCat does not process real names or payment data.

• Legal basis: Art. 6(1)(b) GDPR. The data transfer is safeguarded by a data processing agreement including the EU Standard Contractual Clauses.