Privacy policy

Accelerated Ideas OÜ (“we”), a company registered in Estonia, runs the hosted Oriel service. This policy explains what we collect, why, and what you can do about it. It covers our website, the dashboard, and the assistants our customers put on their own sites.

We have two roles:

• For our customers' accounts, the people who sign in to Oriel to build assistants, we decide how data is used.
• For our customers' visitors, the people who talk to an assistant on a customer's site, we handle data on that customer's behalf and follow their instructions. Their privacy notice applies too. If you talked to an assistant on someone's site, they're the best people to ask about your data, and we'll help them answer.

Oriel is also open source. If an organization runs it on its own servers, we never see that data and this policy doesn't apply to it.

• Your account: your email address, which you use to sign in, and the workspaces you belong to and your role in them. If you sign in with Google, Google shares your name, email address and profile picture with us. When you invite someone, we keep their email address and the invitation.
• Billing: Stripe takes your payment details, billing name, address and tax ID. We keep only Stripe's references to your customer and subscription, and your plan's status. We never see your full card number.
• What you add: your assistants' settings, the knowledge you give them, their site maps and the actions you set up. Files are turned into text and the originals aren't kept. Website pages are fetched from your site. API keys and headers for your actions, and your Stripe connection, are encrypted before we store them.
• Help in the dashboard: conversations with the dashboard's help assistant, which can read the visible text and links of the page you're on to answer you.
• Usage: counts such as conversations, messages and call minutes, and records of the AI and voice services each one used. These don't include what was said.
• Support: what you send us when you get in touch.

When someone talks to an assistant on a customer's site, we process the following on the customer's behalf:

• The conversation: what the visitor types, what they say on calls as text, the assistant's replies, and the actions it took with their results. Results can include details from the customer's systems, such as billing information from their Stripe account.
• Call audio: sent straight from the visitor's browser to Google, or to ElevenLabs when Google can't take the call, to be turned into text, while the reply is turned into speech by ElevenLabs. We don't record or store call audio.
• The page: the address and title of the page the visitor is on. If the customer turns on “Read the current page”, which is on by default, also its visible text and links, so answers match what the visitor sees. We keep the most recent page with the conversation.
• Who they are: if the customer signs visitors in, the details their server shares, such as an ID, name, email address and any other attributes, and their Stripe customer reference.
• Technical details: a random ID kept in the browser, the browser and device type, the visitor's country, the referring page and the site the assistant is on. IP addresses are used briefly to limit how many conversations can start, and aren't stored with conversations.
• What the assistant writes about the conversation: a title, a summary and a sense of how it went. It also notes feedback for the customer's team, such as a bug the visitor hit, which can include their email address and the page. When it asks the customer's team to follow up, it sends a summary and the visitor's contact details by email or to the customer's own systems.

• to run the service: answering, speaking, searching knowledge, and taking the actions customers turn on
• to sign you in, bill your plan and send the emails the service needs, like invitations and follow-up requests
• to keep the service secure and protect it from abuse
• to support you, and to understand our costs and fix problems
• to see how people find and use our website (if you allow it) and how the dashboard is used, so we can improve them
• to meet our legal obligations, such as keeping tax records

We don't sell personal data, show ads, or use your content or your visitors' conversations to train AI models.

Where laws like the GDPR apply, we rely on our contract with you to provide the service, on our legitimate interests to keep it secure and improve it, including measuring and recording how the dashboard is used, on legal obligations for records like invoices, and on consent where we ask for it, such as for analytics cookies on our website. For visitors' data, the customer whose site they used decides the legal basis.

We use these providers to run Oriel. They handle data only to provide their service to us:

• Supabase: Our database, and sign-in
• Anthropic (Claude API): Writing answers, unless an assistant is set to use another model
• Google (Gemini API): Turning call audio into text, summaries and insights, searching knowledge, and writing answers for assistants set to use Gemini or when another model fails
• OpenAI (API): Writing answers for assistants set to use GPT, without OpenAI keeping the conversation
• ElevenLabs: Turning replies into speech, and call audio into text when Google can't
• Stripe: Payments for your plan
• Resend: Invitation and follow-up emails
• Upstash: Rate limiting, to keep the service from being abused
• Vercel: Hosting the app and website
• Google Analytics: Measuring visits to our website if you allow it, and how the dashboard is used
• PostHog (EU): Measuring how the dashboard is used, and recording dashboard sessions to find what's confusing or broken

When a website page only shows its content in a browser, we may load it in a hosted browser service to read it.

Assistants also send data to the systems their owner connects, such as the customer's own API, webhooks or Stripe account. The customer chooses those, and their own policies apply.

We may disclose data if the law requires it, and if our company is sold or merged, data would pass to the new owner under this policy.

We're based in the European Union. Our providers process data there, in the United States and in other countries. When data leaves the European Economic Area, the UK or Switzerland, we rely on safeguards such as the European Commission's standard contractual clauses, or on the provider's certification under the EU-US Data Privacy Framework, as with Google.

• Workspaces, assistants and conversations are kept while the workspace exists, including after a plan ends, so you can come back. Ask us to delete them at any time.
• Knowledge, site maps and actions are deleted when you remove them in the dashboard.
• Billing and usage records are kept as long as tax and accounting rules require.
• Rate-limiting records expire within minutes.
• Google Analytics keeps what it measures for 14 months.
• PostHog keeps session recordings for 30 days, and what it measures in the dashboard for a year.

Our website uses what it needs to work, and analytics cookies only if you allow them. The dashboard measures how everyone signed in uses it, and records sessions. We never use advertising cookies.

• Signing in: cookies that keep you signed in to the dashboard, until you sign out or for up to 400 days.
• Your cookie choice on our website: kept in your browser's storage as oriel:consent, so we don't ask on every page. We ask again after 6 months.
• Google Analytics cookies: _ga and _ga_…, which count visits and how people move around, for up to 13 months: on our website only if you allow them, and in the dashboard for everyone signed in. Google doesn't store your IP address, and its advertising features and Google signals are off.
• PostHog, in the dashboard: a ph_…_posthog cookie and browser storage that tell visits apart and link them to your account by its ID, never your email. Session recordings show the pages you open, where you click and scroll. They hide everything you type, the email addresses on screen, and visitors' conversations and insights. PostHog stores this in the EU.

On our website nothing optional runs until you choose. Change your mind any time with Cookie settings at the bottom of every page; if you turn analytics off, we remove its cookies and stop measuring. If your browser sends a Global Privacy Control signal, we treat it as a no. The dashboard doesn't ask: it's measured and recorded as described here for everyone signed in.

On customers' sites, the assistant sets no cookies. It uses the browser's storage on that site to remember a random visitor ID, the current conversation (so it can pick up again within 12 hours), how the assistant looks, and a call in progress across page loads. These stay until the browser's site data is cleared. The assistant on our own website works the same way.

Data travels over encrypted connections. API keys, request headers and Stripe connections are encrypted with AES-256 before we store them. Assistants can be limited to their owner's domains, and visitors who are signed in are verified with tokens signed by the customer's server. No system is perfectly secure, so if you find a problem, please tell us.

Depending on where you live, you can ask to see, correct, delete or export your personal data, to object to how we use it or have us limit it, and to withdraw consent. To ask, email [email protected]. We'll reply within a month. You can also complain to your local data protection authority, or to ours, the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

If you talked to an assistant on someone else's site, ask that business first; we'll help them with your request. California residents: we don't sell or share personal information for advertising.

Oriel isn't meant for children, and customers agree not to use it to collect data from anyone under 16. If you think a child has given us data, email [email protected] and we'll delete it.

We'll update this page when we change how we handle data, and email workspace owners about significant changes before they take effect. Our terms of service explain the rest of our agreement with customers.

Accelerated Ideas OÜ (registry code 17113323), Ruunaoja tn 3, Lasnamäe linnaosa, 11415 Tallinn, Harju maakond, Estonia. Email [email protected] for anything about privacy, including data processing agreements.