Privacy notice

1.1 The controller of your personal data is Driss Chelouati, sole trader, trading as Orvio, Blv Sahl Rhone, Residence Les Magnolias, Imm A02 App04, 12000 Temara, Morocco, which operates Orvio.

1.2 For any question or request about your data, write to us at support@orvio.design (also given on the Support tab).

1.3 No EU or UK representative and no data protection officer is appointed.

2.1 Account data. Your email address, whether it is verified, your display name if you set one, and the date you joined. If you sign in with email and password, Supabase stores the password only as a hash. If you sign in with Google or GitHub, we receive the email address and name that provider shares with us. We do not ask for anything else from them.

2.2 Membership and billing data. Your plan, billing period, subscription status and renewal dates, and the Lemon Squeezy subscription reference. We do not receive or store your card number. Lemon Squeezy collects your payment details, billing name, address and tax details as merchant of record.

2.3 Consent record. When you buy, we record which wording of the right-of-withdrawal consent you saw, and when you accepted it.

2.4 Team data. If you are a Team owner, the email addresses of the teammates you add. If you are added to a Team, the Team owner's name and the fact that you were added.

2.5 Your use of the service. The products you bookmark, the AI tools and CLI sessions you approve (the tool's name, when you approved it, when it last made a request, and whether it was revoked), and the downloads, pulls and fetches you make, as far as needed to give you access and keep the service safe.

2.6 Emails. The emails we send you (sign-in links, password changes, membership notices) are queued with the recipient address, the kind of email and the facts in it (such as dates and plan), and whether it was delivered.

2.7 Audit records. Actions that matter for security or accountability are logged with the account or admin that did them, the action, what it concerned and, if one was given, the reason. Examples: approving or revoking a tool, adding a teammate, granting access, suspending an account.

2.8 Messages to support. What you write to us, and your address.

2.9 Technical data. Our host sees your IP address and browser details when you visit, as any web host does. To limit abuse, request counters use a hashed form of your IP address, email or account, never the plain value. Error logs hold an error type and a request reference, and no email address, token or message text.

2.10 What we do not do. We do not use advertising or analytics trackers, we do not build advertising profiles and we do not sell personal data.

• To create your account, sign you in and give you the membership you bought: performance of our contract with you.
• To take payment, issue receipts and meet tax and accounting duties: contract, and legal obligation (mostly through Lemon Squeezy).
• To keep a record of your right-of-withdrawal consent: legal obligation and our legitimate interest in proving it.
• To send emails you need about your account and membership: contract. These are not marketing emails.
• To secure the service, limit abuse and keep audit records: our legitimate interest in running a safe service.
• To answer your messages and requests: contract, and our legitimate interest in helping you.

3.1 We do not make decisions about you by automated means that have legal or similar effects.

We use these providers to run Orvio. Each acts on our instructions as our processor, except where we say otherwise.

• Supabase: database and sign-in. Holds your account, membership, bookmarks, tool approvals, audit records and email queue, and handles passwords and sessions. Hosting region: the European Union (Ireland).
• Lemon Squeezy: payments, as merchant of record. It sells the membership to you, takes payment, handles tax, refunds, receipts and invoices, and keeps your payment and billing details. It is responsible for that data under its own privacy policy, and sends us your plan, status and renewal dates.
• Cloudflare: hosting and delivery of the website (Workers), storage of product files (R2), DNS, and forwarding of the support address (Email Routing). Cloudflare sees traffic details such as IP addresses.
• Resend: sends our emails. It receives the recipient address and the email content. Sending region: EU (Ireland).
• Google and GitHub: only if you choose to sign in with them. They tell us you signed in and share your email address and name. Their own privacy policies apply to what they hold.

4.1 We share data with others only to run the service, when the law requires it, or to protect our rights. Product files themselves are not personal data and are not shared with other members.

5.1 We use only strictly necessary cookies, so there is no cookie banner. We use no advertising or analytics cookies, and we store nothing in your browser's local storage.

• Sign-in session (set by Supabase, names beginning "sb-"): keeps you signed in. Removed when you sign out or when the session expires.
• orvio_next: remembers the page you were going to while you sign in. Lasts up to one hour.
• For Orvio staff only: orvio_admin_theme and orvio_admin_notif_read remember admin display settings.

• Account, membership, bookmarks and tool approvals: while your account exists.
• Billing data held by Lemon Squeezy: as the law and Lemon Squeezy's own policy require.
• Consent records: as long as needed to show your consent, normally the life of the contract plus the limitation period (six years, for tax and consumer-law records).
• Audit records: three years. They record who did what, so they are kept after a release is withdrawn or a membership ends.
• Email queue: 90 days.
• Support messages: two years.
• Backups: Supabase keeps rolling backups for a limited time, so deleted data can remain in a backup until it expires.

6.1 Deleting an account removes your account data. We may keep what the law requires, or what we need to defend a legal claim, and audit records may stay with your identifying details removed.

7.1 You can ask us for a copy of your data, to correct it, to delete it, to limit or object to how we use it, and to receive it in a portable form. Where we use your data on the basis of consent, you can withdraw it.

7.2 To make a request, email us from your account's address. We answer within 30 days. Deleting an account ends any membership and cannot be undone. It is separate from a suspension, which never deletes anything.

7.3 You can complain to a data protection authority. In Morocco this is the CNDP. In the EU it is the authority in the country where you live or work. Please tell us first so we can try to put it right.

8.1 Our providers may process data outside the country where you live, including outside the European Economic Area. Where that happens, we rely on the safeguards the provider offers, such as standard contractual clauses. Details are in each provider's own data protection terms.

9.1 Data is sent over encrypted connections. Passwords are stored as hashes. Access to the database is limited by row-level security and by server-side checks.

9.2 If a data breach puts your rights at risk, we will tell you and the authority as the law requires.

10.1 Orvio is for professionals who build websites and applications. It is not meant for children under 16, and we do not knowingly collect their data.

11.1 We may update this notice. The date at the top shows the current version. We tell members by email about a change that matters to them.