Privacy Policy

Qlareti B.V. ("we", "us", "our"), operating the Ora coaching platform, is the data controller responsible for your personal data. We process personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

We may collect and process the following personal data:

• Account data: name, email address, and password (hashed).
• Profile data: responses to explorations, scores, insights, and companion conversations.
• Usage data: pages visited, features used, and session information.
• Technical data: IP address, browser type, device information, and cookies.

We use your personal data to:

• Provide, maintain, and improve the Service.
• Personalise your experience and the AI companion's responses.
• Generate scores, insights, and profile information from your explorations.
• Communicate with you about your account and the Service.
• Ensure security and prevent fraud.

What we do NOT do with your data. Qlareti does not train, fine-tune, or use your conversations to develop any AI model — our own or a third party's. We do not sell your data or share it with advertisers or data brokers. As set out in Section 5, our subprocessors are contractually prohibited from training on your data as well. If we ever wished to use aggregated, de-identified conversation data for model evaluation or improvement, we would ask for your explicit opt-in consent first, and you could withdraw it at any time without losing access to Ora.

We process your personal data on the following legal bases:

• Consent (Art. 6(1)(a)): for non-essential cookies and optional communications.
• Contract (Art. 6(1)(b)): to provide the Service you have signed up for.
• Legitimate interests (Art. 6(1)(f)): for security, fraud prevention, and service improvement.
• Legal obligation (Art. 6(1)(c)): to comply with applicable laws.

We do not sell your personal data. We share data with the following named subprocessors that help us operate the Service, under written data-processing agreements that prohibit any use of the data beyond delivering Ora to you. None of these providers use your data to train their own models or for advertising.

• Anthropic PBC — large language model (primary coaching responses)
• OpenAI, L.L.C. — large language model (background extraction tasks)
• Deepgram, Inc. — speech-to-text transcription
• ElevenLabs, Inc. — text-to-speech voice synthesis
• LiveKit — real-time voice room infrastructure (self-hosted by Qlareti)
• Amazon Web Services EMEA SARL — cloud infrastructure (eu-west-1, Ireland)
• MongoDB, Inc. (Atlas) — managed database (eu-west-1, Ireland)
• Twilio, Inc. (SendGrid) — transactional email delivery

A current list of our subprocessors, including their roles, locations, and the legal safeguards governing their use, is maintained at my-ora.ai/subprocessors and updated as it changes.

We may also disclose data if required by law or to protect our rights and safety.

Your data may be transferred to and processed in countries outside the European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

We retain your personal data for as long as your account is active or as needed to provide the Service. When you delete your account, we will delete or anonymise your personal data within 30 days, unless retention is required by law.

Under the GDPR, you have the following rights:

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to erasure: request deletion of your personal data ("right to be forgotten").
• Right to restriction: request that we limit how we process your data.
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interests.
• Right to withdraw consent: withdraw consent at any time where processing is based on consent.
• Right to lodge a complaint: file a complaint with your local supervisory authority.

To exercise any of these rights, please contact us at privacy@qlareti.com.

The Service is not intended for children under 16 years of age. We do not knowingly collect personal data from children under 16. If we learn that we have collected data from a child under 16, we will take steps to delete it promptly.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. However, no method of transmission over the Internet is 100% secure.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy and revising the "Last updated" date. Your continued use of the Service constitutes acceptance of the revised policy.

For any questions or concerns about this Privacy Policy or our data practices, please contact our Data Protection Officer at privacy@qlareti.com.