Privacy Policy

OREYM is a website, digital-card and enquiry platform operated by OREYM. In this document “we” means OREYM and “you” means the person or business holding an account.

There are two different sets of people in play, and they are treated differently. For your account data we are the data controller. For the enquiries your visitors send you, you are the controller and we process that data on your behalf - see Your website visitors.

• Account details - name, email address and an authentication identifier. Passwords are handled by our identity provider and never stored by us in readable form.
• Business profile - business name, handle, category, phone, WhatsApp number, address, working hours and the About text. This is the information you have chosen to publish, so it appears on your public website and digital card by design.
• Site content - the pages, sections, images and files you upload to build your site.
• Enquiries - the name, email, phone number and message a visitor submits through a form on your site.
• Card analytics - counts of views, contact saves and taps on your digital card, recorded per card and not tied to a named individual.
• Payment records - plan, amount, currency, status and, where you upload one, a payment screenshot. We do not receive or store full card numbers.
• Technical logs - IP address, browser user agent and request timestamps, kept for security and abuse investigation.

We do not buy personal data from third parties and we do not sell yours.

• To create your account, authenticate you and keep the service running.
• To publish the site and card you asked us to publish.
• To deliver the enquiries your visitors send, and to notify you about them.
• To take payment and issue receipts.
• To investigate abuse, fraud and outages.
• To send service email you cannot opt out of while you hold an account - billing, security and material changes to the service. Marketing email is separate and you can unsubscribe from it at any time.

When someone fills in a form on a site you publish with us, that enquiry belongs to you. We store it, show it to you in your dashboard, and act only on your instructions. We do not use your enquiries to market to those people, and we do not share them with your competitors or anyone else.

Because you are the controller of that data, you are responsible for having a lawful basis to contact those people, for answering their access and deletion requests, and for publishing a privacy notice on your own site if your local law requires one. Deleting an enquiry in your dashboard deletes it from our systems.

Application data - accounts, profiles, sites, enquiries - is stored in India (Mumbai region). Uploaded images and files are stored in object storage and served through a global content delivery network, which means copies of public site assets are cached on edge servers worldwide. That caching applies only to files you have chosen to publish.

We use a small number of processors to run the service: a managed database host, an identity provider for sign-in, object storage for uploads, an email relay for transactional mail, and a DNS and CDN provider for custom domains. Each is bound by contract to process data only on our instructions.

If you are outside India, using the service involves transferring your data to India. For customers in the EEA or UK, transfers rely on Standard Contractual Clauses. Ask us at [email protected] for the current processor list.

• Account and site content - for as long as your account is open, and for 30 days after you close it, so an accidental deletion can be undone.
• Enquiries - until you delete them, or 30 days after the account closes.
• Payment and invoice records - seven years, because tax law requires it. This is the one category we cannot delete on request.
• Technical logs - 90 days.

We set a session cookie so you stay signed in, and a preference cookie that remembers your light or dark theme. Both are strictly necessary for the parts of the product you asked for, so there is no consent banner to click through.

We do not run third-party advertising or cross-site tracking cookies on OREYM. Sites you publish may embed third-party code if you add it; anything you embed is yours to disclose.

You can ask us to give you a copy of your data, correct it, delete it, or stop processing it. Most of this is self-service - the dashboard lets you edit your profile, export enquiries as CSV and delete sites and cards. For anything else, or to close the account entirely, email [email protected] and we will respond within 30 days.

If you are not satisfied with how we have handled a privacy complaint, in India you can escalate it to the Data Protection Board. In the EEA or UK, escalate it to your national supervisory authority.

Traffic is encrypted in transit with HTTPS and data is encrypted at rest by our hosting providers. Access to production systems is limited to the people who need it. Published tenant sites are served from their own subdomain, which sandboxes any JavaScript a template carries away from your dashboard session. No system is perfect - if we ever suffer a breach affecting your data we will tell you and the relevant regulator without undue delay.

We will update this page when the service changes. If a change materially reduces your rights we will email account holders before it takes effect, not after. The date at the top always reflects the last substantive revision.

Privacy questions and requests: [email protected]. Anything else: [email protected] or the contact page.