Privacy Policy

1. Information We Collect

Account and contact information: your email address and authentication/account information.

Business and Agency information: company or agency names, websites, service areas, client-business information, competitors, prompts or buyer-intent questions, and other configuration information you provide.

Monitoring and analysis data: AI-provider requests and responses, mentions, citations, links, evidence, competitor observations, opportunities, analyses, recommendations, experiment records, measurement history, reports, and usage/cost evidence.

AI-provider credentials: credentials or API keys you choose to connect for supported providers. The application is designed to keep provider credentials server-side and not display a saved credential after persistence.

Subscription and payment information: subscription status, plan, billing identifiers, and related transaction information. Payment-card information is processed by Stripe; we do not store your full card number.

Consent records: records of your acceptance of our Terms of Service and Privacy Policy, including the applicable version and acceptance timestamp.

Usage and security data: technical information used to operate and secure the Service, which may include IP address, browser/device information, session information, request logs, and security/audit events.

2. How We Use Your Information

We use information to create and authenticate accounts; administer trials and subscriptions; configure Business and Agency workspaces; run monitoring requests you initiate or authorize; organize AI-provider responses and evidence; generate analyses, recommendations, experiments, measurements, and reports; track usage/cost evidence; process payments; send service communications; secure and maintain the Service; and comply with legal obligations.

We do not sell your personal information, client information, provider credentials, or monitoring data to third parties.

3. Business and Agency Data

Business accounts are intended to manage one business. Agency accounts may manage multiple client businesses. Agency client data is maintained within the account and tenant-isolation structure of the Service.

If you submit information relating to a client or another business, you are responsible for having appropriate authority to provide and use that information through the Service.

4. AI Provider Credentials and AI Provider Processing

If you connect an API credential for a supported AI provider, Oratotita uses that credential to make requests you initiate or otherwise authorize. Supported providers may include OpenAI, Anthropic, Google Gemini, and Perplexity.

Requests sent to an AI provider and responses returned by that provider are processed through the provider's systems and are subject to that provider's applicable terms and privacy practices. Oratotita does not control a provider's independent systems or policies.

We do not sell your provider credentials.

5. Third-Party Service Providers

Based on the current production architecture, service providers may include Vercel for application hosting and deployment; Supabase for authentication, database, security, and backend infrastructure; Stripe for subscription and payment processing; Resend for transactional authentication and service email; and OpenAI, Anthropic, Google Gemini, and Perplexity when you connect or use the applicable AI provider.

These providers receive information as necessary to perform services on our behalf or as directed by you. Their processing is also governed by their own terms and privacy policies.

We may also disclose information when required by law, to protect rights or security, in connection with a business transaction, or with your direction or consent.

6. Data Security

We use administrative and technical safeguards designed to protect account, business, client, credential, and monitoring information. The production architecture uses authenticated access controls and tenant isolation, and sensitive server-side credentials are intended not to be exposed in the browser.

No method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Data Retention

Oratotita is designed to preserve monitoring history, competitors, recommendations, experiments, measurements, reports, and related account data so later monitoring cycles can use prior history.

We retain account and Service data for as long as reasonably necessary to provide the Service, maintain the account, comply with legal obligations, resolve disputes, enforce agreements, and support legitimate business and security purposes, subject to deletion rights and applicable law.

8. Your Choices and Rights

You may request access to, correction of, or deletion of certain account information by contacting us at contact@oratotita.com.

Depending on your location, you may have additional rights under applicable law, including rights to access, correct, or delete personal information or to opt out of certain processing where applicable.

Deleting information may be subject to legal, security, billing, fraud-prevention, backup, or other legitimate retention requirements.

9. Cookies, Sessions, and Authentication

The Service may use cookies, browser storage, or similar technologies that are necessary for authentication, session persistence, security, preferences, and operation of the Service.

10. Children's Privacy

Consistent with the Children's Online Privacy Protection Act (COPPA), we do not knowingly collect personal information from children under 13 years of age. The Service is intended for adults acting for businesses or agencies. If we become aware that we have inadvertently collected personal information from a child under 13, we will take steps to delete it promptly.

11. United States Audience

The Service is intended for users and businesses in the United States. It is not intended for, or directed to, individuals residing outside the United States, including the European Union or European Economic Area.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated "Last updated" date and, where appropriate, additional notice.

13. Contact

Questions about this Privacy Policy can be sent to contact@oratotita.com.