Privacy Policy

Orwen is the data controller for the data described here. Contact: orwen.ai@gmail.com. Full operator details are on the Legal notice page.

• Account: your name, email address and a securely hashed password.
• Your assistant: the name, personality, voice, look and tools you chose.
• Tasks and reminder settings you add.
• Connected tools, only if you connect them: Google Calendar events for the day (titles, times, attendees count, meeting links); Shopify order totals and counts; Stripe payment totals and failed charges. We do not store your customers' personal details.
• Hardware reservations and launch alerts: your email, the product and any engraving text.
• Technical data: sign-in sessions, your time zone, and basic server logs (IP address, browser) kept for security.

• To run your account and your assistant (contract).
• To build your briefs, reminders and alerts from the tools you connect (contract, and your consent when you connect each tool).
• To keep Orwen secure and prevent abuse (legitimate interest).
• To email you about your reservations and important account changes (contract and legitimate interest).
• To meet tax and legal duties once payments start (legal obligation).

We never sell your data, never use it for advertising, and never use it to train AI models.

Orwen's use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. We only read your calendar to show your day and send reminders, and you can disconnect it any time.

• Vercel: hosts the website.
• Supabase: our database, hosted in the EU (Ireland).
• Google: Calendar connection, only if you connect it.
• Shopify and Stripe: only if you connect them; we read data from your own accounts.

When we switch on the chat brain and real voices, we'll add the AI providers here (for example Anthropic and ElevenLabs) before any of your data is sent to them.

Some providers are based in the United States. Where data leaves the EU, it is protected by the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

Connection tokens and keys are encrypted (AES-256). Passwords are hashed. Connections are read-only. Access to production systems is limited to the people who run Orwen.

We keep your data while your account exists. When you delete your account, we delete your data and revoke connected tools straight away; backups expire within 30 days. Reservation emails are kept until the product ships or you ask us to remove them. Invoices, once payments start, are kept as long as tax law requires.

You can access, correct, download, restrict or delete your data, object to processing, and withdraw consent at any time. Download and delete are built into Settings; for anything else email us.

You can also complain to the Croatian data protection authority (AZOP, azop.hr) or the authority where you live.

Orwen is an AI assistant, and it will always say so. Its voices are AI-generated. Briefs and alerts are produced automatically from your data; they don't make legal or financial decisions about you.

If we change this policy in a way that matters, we'll email you before it applies.