Privacy Notice
Last updated 12 September 2026 (draft pending legal review)
This notice explains what personal data Orishare processes, why, and what rights you have. It covers people who use the dashboard and website (“users”) and the end customers of our customers (“customers”), for whom we act as a processor.
Users of Orishare
- Account data: name, email, sign-in provider id, role and organization memberships. Basis: performing the contract.
- Product usage: pages viewed and actions taken in the dashboard, tied to your user id, through PostHog hosted in the EU. Basis: legitimate interest in improving the product. Autocapture is off.
- Support and billing: messages you send us, invoices, payment status. Basis: contract and legal obligations.
- Security logs: request ids, IP addresses and timestamps in operational logs for up to 30 days. Basis: legitimate interest in keeping the Service secure.
Customers of our customers
Organizations send us events, customer identifiers and attributes to run their loyalty programs. We process this data on their instructions under the data processing terms. If you are such a customer, contact the organization you have a relationship with; it decides what is collected and how long it is kept. On its instruction we delete or export your data through the API.
AI drafting
When an editor asks for a draft, a bounded description of the organization's configuration and a few event samples are sent to Anthropic to generate rule configuration. Attributes flagged as personal data are excluded and values under personal-looking keys are redacted. The model does not train on this data.
Subprocessors
The current list is on the subprocessors page. We notify organizations before adding one.
Retention
Account data is kept while the organization exists and for 30 days after closure. Sandbox event data is retained 30 days and production event data 90 days in the operational store, with history in an archive for as long as the organization keeps it.
Your rights
You can access, correct, export and delete your account data from the dashboard or by emailing [email protected]. EU and UK residents also have the rights described in the GDPR, including to complain to a supervisory authority.