Privacy Policy

We collect information to provide and improve the ORME AI Service. The types of information we collect include:

Account Information

• Name, email address, and contact details provided during registration
• Authentication credentials managed through our identity provider
• Billing information and payment details for paid subscriptions
• Company or organization name for workspace setup

Instagram Data via Meta API

• Instagram account profile information (username, profile picture, bio)
• Media posts, comments, and engagement metrics
• Direct message conversations you authorize ORME AI to manage
• Story interactions and live stream data
• Follower and subscriber information relevant to CRM features

Usage Data

• Device information (browser type, operating system, device identifiers)
• Log data (IP address, access times, pages visited, actions taken)
• Feature usage patterns and interaction analytics
• Performance data and error logs

We use the information we collect for the following purposes:

• To provide, operate, and maintain the ORME AI Service, including AI-powered comment classification, response generation, and automation features
• To process your transactions, manage your subscription, and send billing-related communications
• To personalize your experience, including training AI models on your brand voice and knowledge base
• To analyze usage patterns and improve Service performance, features, and user experience
• To communicate with you about Service updates, security alerts, and support inquiries
• To detect, prevent, and address technical issues, fraud, and security threats
• To comply with legal obligations and enforce our Terms of Service

ORME AI accesses Instagram data through the official Meta Graph API (v21.0). We are committed to full compliance with Meta's Platform Terms and data handling requirements.

• We only access Instagram data that you explicitly authorize through the Facebook Login for Business OAuth flow
• Instagram data is used solely to provide the features you have enabled, including comment management, DM automation, and subscriber tracking
• We do not sell, rent, or trade your Instagram data to any third party
• Access tokens are encrypted at rest using industry-standard encryption protocols
• You can revoke ORME AI's access to your Instagram account at any time through your Meta account settings or the ORME AI dashboard
• Upon disconnection or account deletion, all associated Instagram data is permanently removed from our systems within 30 days

ORME AI uses artificial intelligence to classify comments, generate responses, and automate workflows. Here is how your data is handled in the AI pipeline:

• Comments and messages are processed through our tiered classification system to determine intent, sentiment, and appropriate responses
• Your knowledge base documents, brand voice profiles, and product catalog data are used to generate contextually relevant AI responses
• AI processing is performed using third-party AI providers (such as Google AI and Groq). Data sent to these providers is subject to their respective privacy policies
• We do not use your data to train general-purpose AI models. Your data is used only to improve responses specific to your account
• Agent memory and learning data (corrections, positive/negative feedback) are stored securely and tied exclusively to your account
• Shadow mode and sandbox environments allow you to review AI decisions before they are published

We do not sell your personal information. We may share your data with third parties only in the following circumstances:

• Service Providers: Trusted partners who assist in operating the Service, including cloud infrastructure (Vercel, Supabase), payment processing, AI model providers, and analytics services
• Meta/Instagram: Data shared as required by the Meta Graph API to provide Instagram integration features
• Legal Requirements: When required by law, regulation, legal process, or governmental request
• Business Transfers: In connection with a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity
• With Your Consent: When you have given explicit permission for a specific data sharing purpose

All third-party service providers are contractually obligated to protect your data and use it only for the purposes we specify.

We take the security of your data seriously and implement industry-standard measures to protect it:

• All data in transit is encrypted using TLS 1.2 or higher
• Sensitive data at rest, including Instagram access tokens, is encrypted using AES-256 encryption
• Database access is restricted through role-based access controls and multi-tenant isolation
• Regular security audits and vulnerability assessments are conducted
• Employee access to user data is limited to those who require it for Service operation and is logged

While we strive to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security but commit to promptly addressing any breaches in accordance with applicable law.

ORME AI uses cookies and similar tracking technologies to enhance your experience:

• Essential Cookies: Required for authentication, session management, and core Service functionality
• Analytics Cookies: Help us understand how you use the Service so we can improve it
• Preference Cookies: Remember your settings and customization choices

You can manage your cookie preferences through your browser settings. Disabling essential cookies may affect your ability to use certain features of the Service.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right to Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete personal data
• Right to Deletion: Request deletion of your personal data, subject to legal retention requirements
• Right to Portability: Request your data in a structured, machine-readable format
• Right to Restrict Processing: Request that we limit how we use your data
• Right to Object: Object to processing of your personal data for specific purposes
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at ormedevteam@gmail.com. We will respond to your request within 30 days.

We retain your data for the following periods:

• Account Data: Retained for the duration of your active account plus 30 days after deletion
• Instagram Data: Synced data is retained while your Instagram account is connected and deleted within 30 days of disconnection
• Analytics Data: Retained based on your subscription tier (7 days for Starter, 90 days for Pro, lifetime for Business)
• Billing Records: Retained for 7 years as required by applicable tax and accounting regulations
• AI Training Data: Knowledge base and brand voice data is deleted within 30 days of account termination

ORME AI is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal data from a child under 18, we will take immediate steps to delete that information.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at ormedevteam@gmail.com so we can take appropriate action.

ORME AI is operated from India. If you access the Service from outside India, your information may be transferred to, stored, and processed in India or other countries where our service providers operate.

By using the Service, you consent to the transfer of your information to countries that may have different data protection laws than your jurisdiction. We take appropriate safeguards to ensure your data remains protected in accordance with this Privacy Policy regardless of where it is processed.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the “Last Updated” date at the top of this page
• Notify you via email or through a prominent notice in the Service
• Provide at least 30 days' notice before material changes take effect

Your continued use of the Service after any changes constitutes acceptance of the updated Privacy Policy.

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us: