Privacy Policy

1. Who we are

Orvelt operates an opinions and customer-feedback platform. We act as the organization responsible for the personal information described in this policy, except where a business or another provider acts as an independent controller. Privacy questions go to [email protected].

Mailing address: Orvelt, Hudson Yards, New York, NY 10018, USA. Orvelt is currently operated as a United States-focused service. If our legal operating entity or address changes, we will update this policy.

2. What Orvelt does

Orvelt lets people publish opinions, ratings, comments, answers, photos, and purchase evidence about businesses. Businesses can collect feedback, manage projects, respond to opinions, review private responses, and use analytics, delivery, widget, and integration features. Some features require an account; public pages can be viewed without one. Business features may require a paid plan.

You can choose an anonymous display for some opinions. “Anonymous” describes the public presentation, not the absence of records in Orvelt's systems. We may still associate a submission with an account, session, device, or business recipient.

3. Information we collect

Account, profile, and authentication information

When you create or link an account, we collect your name, email address, profile image, authentication records, linked sign-in provider, passkeys, account status, and account settings. Storefront accounts may begin as anonymous sessions. Orvelt Business accounts may also include a phone number, organization memberships, roles, invitations, API-key metadata, and billing relationship identifiers.

Content and submissions

We collect opinions, titles, ratings, answers, comments, business submissions, profile details, photos, audio sent for transcription, receipts, receipt metadata, purchase dates, item names, verification information, and other material you submit. A private opinion can include content that a business receives under the visibility choice and workflow you select.

Device, session, and usage information

We collect IP address, browser and device type, operating system, user agent, language, time zone, referral URL, page and feature activity, approximate location derived from IP or technical signals, request identifiers, session information, security events, and diagnostic data. Our storefront analytics can include page URL, referrer, campaign parameters, viewport and screen dimensions, color scheme, navigation timing, bot classification, and pseudonymous session and browser IDs. Server-side analytics can also include the request IP address and country, region, or city derived from proxy headers.

Location information

If you use location features, your browser may provide precise device coordinates for reverse geocoding or nearby-place suggestions. We store a selected place and coordinates in your browser's local storage. Receipt uploads may include optional coordinates in the receipt record for verification. You can deny browser permission, choose a place manually, or clear the saved location.

Business, billing, and communications information

We collect organization names, business details, project configuration, team roles, subscription plan and status, billing interval, trial and renewal dates, payment status, invoices or transaction metadata, support requests, legal reports, and communications. Authorized payment processors handle payment card details for paid business plans; Orvelt does not store full card numbers.

What we do not intentionally collect

Orvelt does not intentionally request passwords in plain text, full payment card numbers, contact lists, or address books. We do not knowingly collect personal information from children. You should not upload government identifiers, health information, financial account numbers, or other sensitive information unless a lawful, secure Orvelt workflow specifically requires it.

4. How we use information

• Provide, personalize, maintain, troubleshoot, and secure Orvelt.
• Authenticate accounts, transfer anonymous work after account linking, and manage preferences.
• Publish public opinions, deliver private responses, process evidence, and operate business workflows.
• Transcribe audio, extract receipt text, generate suggested titles, detect abuse, and support moderation or fraud review.
• Measure traffic, understand feature use, debug errors, and improve product performance.
• Process subscriptions, send transactional and security communications, and provide support.
• Enforce our Terms and Acceptable Use Policy, investigate reports, prevent fraud, and comply with law.

Depending on the law that applies, we rely on contract, legitimate interests, consent, and legal obligations. Where we rely on consent, you can withdraw it for future processing. Withdrawal does not affect processing that already occurred or processing based on another lawful ground.

5. How we share information

• With third-party vendors and service providers that host, store, authenticate, secure, monitor, analyze, communicate, geocode, deliver, or support Orvelt.
• With the relevant business when a private response, business submission, or other workflow is designed to reach that business.
• With authorized payment processors for billing and subscription management, and with communications providers for requested transactional notices and verification messages.
• With professional advisers, auditors, insurers, regulators, courts, law enforcement, or other parties when reasonably necessary to comply with law or protect rights, safety, and property.
• With a successor or transaction partner in a merger, financing, acquisition, restructuring, bankruptcy, or sale of assets.
• With you or others when you direct us to share information.

Orvelt does not sell personal information for money and does not share it for cross-context behavioral advertising as those terms are defined by applicable U.S. privacy laws. We do not use sensitive personal information to infer characteristics about you. If we enable a new advertising, analytics, or similar technology that requires consent or an opt-out, we will update this policy and provide the controls required by applicable law.

Service provider categories

We engage trusted third-party service providers that assist in operating, securing, and enhancing our platform. These providers are bound by strict confidentiality and data protection obligations and process information only as necessary to perform services on our behalf. Categories of service providers include:

• Cloud infrastructure and storage: hosting environments, content delivery networks, and secure cloud storage for platform assets and records.
• Artificial intelligence and processing: automated machine learning systems for voice transcription, optical character recognition (OCR), moderation signals, and text assistance.
• Billing and payment processing: payment gateway services, subscription billing management, invoicing, and tax calculation.
• Observability, analytics, and diagnostics: error reporting, system health monitoring, security anomaly detection, and aggregate usage analytics.
• Authentication and location services: identity verification, social sign-in, and mapping or geocoding features.
• Communications and messaging: transactional email, SMS, and account notification services.

6. Cookies and local storage

Orvelt uses cookies and similar storage technologies for authentication, security, preferences, rate limiting, analytics, and feature operation.

Orvelt does not use third-party advertising cookies or cross-site tracking cookies. You can block cookies or clear local storage through your browser settings, though disabling essential storage may prevent authentication or certain features from functioning properly.

7. AI-assisted processing

Orvelt utilizes automated systems and artificial intelligence (AI) technologies to support specific platform features, such as audio transcription, receipt text extraction, suggested titles, and fraud or moderation signals.

We transmit only the specific content required for each task to our designated processing partners. Uploaded media and text are processed strictly to fulfill the requested functionality. We do not use Your Content to train general-purpose AI models without authorization.

Third-party AI providers process data under commercial service agreements and security safeguards. Because automated outputs may occasionally be inaccurate or incomplete, you should review all AI-assisted results before publishing or relying on them. Orvelt does not use automated processing or AI output as the sole basis for decisions producing legal or similarly significant effects.

8. Retention

We retain information for as long as necessary to fulfill the purposes described in this policy, including providing our services, maintaining security, preventing fraud, resolving disputes, and complying with legal obligations.

• Account and business records: retained during the active relationship and thereafter as required for legal, tax, accounting, or audit compliance.
• Published opinions and comments: retained while published or until removed through applicable moderation or account management workflows.
• Receipt images and verification data: retained as necessary for verification, dispute handling, fraud prevention, and audit records. Temporary access links expire automatically.
• Anonymous drafts and session records: retained temporarily until completed, expired, or cleared.
• Authentication and security tokens: retained only until their configured expiration or revocation.
• Analytics and diagnostic logs: retained in accordance with our internal log retention schedules to ensure system performance, reliability, and security.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, object to, or receive a portable copy of personal information; withdraw consent; opt out of certain sales or sharing; and appeal a privacy decision. You can request account deletion from settings where available or email [email protected]. We may verify your identity before completing a request. Verification protects account information and does not require you to provide more information than we reasonably need.

We will respond within the period required by applicable law. If we cannot grant a request, we will explain why and identify available appeal or complaint options. You may also complain to your local data-protection authority.

10. International transfers

Orvelt is operated from the United States, and our providers may process information in the United States or other countries where they operate. Data may also transit through other locations as part of ordinary internet routing. Where required, we use adequacy decisions, Standard Contractual Clauses, data-processing agreements, or another lawful transfer mechanism. Contact us if you need more information about applicable safeguards.

11. Children

Orvelt is not directed to children under 18. We do not knowingly collect personal information from children under 13, and we do not knowingly permit a person under 18 to use the service. If you believe a child provided information, contact [email protected] so we can investigate and delete it where appropriate.

12. Security

We use HTTPS/TLS, access controls, provider-managed security, authentication safeguards, rate limits, monitoring, and other administrative and technical measures designed to protect information. No service or transmission is perfectly secure. Orvelt does not guarantee that information will never be accessed, altered, lost, or disclosed without authorization.

If we identify a breach that requires notice, we will notify affected people and authorities as required by law. Report suspected security issues to [email protected].

13. Changes to this policy

We may update this policy as our service, providers, or legal obligations change. We will post the revised policy with a new “Last updated” date. For material changes, we will provide additional notice where appropriate. Review this page periodically. Continued use after the effective date means you acknowledge the updated policy; where consent is legally required, we will request it.

14. Contact

Privacy requests and questions: [email protected] or [email protected]. Legal notices: [email protected]. Security reports: [email protected].

We aim to acknowledge privacy inquiries within 30 days, although complex or legally regulated requests may take longer.

15. Regional supplements

EEA, UK, and Switzerland

If the GDPR, UK GDPR, or Swiss data-protection law applies, the rights and legal bases in this policy include access, correction, deletion, restriction, portability, objection, and withdrawal of consent where applicable. You may complain to the supervisory authority in your country. We will identify a local representative or data-protection officer if required for Orvelt's activities and will provide the contact details here when appointed.

California and other U.S. states

California and other states may grant additional rights to know, access, correct, delete, opt out of sale or sharing, limit certain sensitive-information uses, and appeal a refusal. Orvelt does not sell or share personal information for cross-context behavioral advertising. California residents can use the contact methods above and will not receive discriminatory treatment for exercising privacy rights, subject to lawful exceptions.

Orvelt does not knowingly collect or use personal information for automated decisions that produce legal or similarly significant effects. If this changes, we will update this policy and provide any notice or opt-out required by law.