Privacy Policy
Last updated: 2026-08-16
This policy is published in English and Swedish. In the event of any discrepancy between the versions, the English version governs.
1. Who is responsible for your personal data
Get Orion AI AB is the controller for the personal data described in this policy. This policy applies to the oriiion website, the oriiion web application, the oriiion mobile application, and the messaging and telephone channels through which the service can be used.
Company: Get Orion AI AB
Registration number: 559391-9961
Registered address: Huskvarnavägen 82, 554 66 Jönköping, Sweden
Privacy contact: data@oriiion.ai
We have not appointed a data protection officer, as we are not required to do so under Article 37 of the General Data Protection Regulation. Privacy enquiries are handled by the privacy contact named above.
Where a customer uses the service to process personal data relating to their own customers, contacts or audience, the customer is the controller for that data and we act as processor on their instructions. The terms governing that relationship are set out in our data processing agreement.
2. What personal data we process
We process the following categories of personal data. Not every category applies to every user, as the categories depend on which features are used and which accounts are connected.
Account and identity data
- Name, email address, and where sign-in is by password, a hashed password. Where sign-in is through Apple or Google, the identifier supplied by that provider.
- Business name, business description, industry, website address, business address and telephone number.
- Language, time zone, notification settings and other preferences.
Content you provide or generate
- Messages you send to the assistant through the web application, the mobile application, Telegram, WhatsApp, Messenger, SMS or telephone, together with the assistant's replies.
- Images, video, audio and documents you upload, including any personal data they contain, such as photographs of identifiable people.
- Captions, scripts, posts and advertisements generated with the service, whether or not published.
- Recordings and transcripts of telephone calls placed to or from the service's telephone number.
Data from accounts you connect
- Access credentials and account identifiers for the social, commerce and design platforms you choose to connect.
- Published posts, comments, direct messages and reviews retrieved from those accounts so that they can be shown and answered within the service.
- Engagement and audience statistics reported by those platforms, such as reach, impressions and follower counts.
Billing data
- Subscription status, plan, invoices and billing address. Card details are entered directly with our payment provider and are not received or stored by us.
- Where you participate in the affiliate programme, referral records, commission balances and payout status.
Technical data
- IP address, browser and device type, and pages visited.
- Server logs recording requests to the service, including account identifiers and error information.
- Product analytics events recording which features are used, where analytics cookies have been accepted.
Personal data about other people
If you upload material depicting or describing identifiable people, connect an account whose messages contain personal data, or add contacts to a broadcast list, you provide us with personal data about people other than yourself. You are responsible for having a lawful basis for doing so and for informing those people as required. We process that data only to provide the service to you.
We do not ask for and do not intend to process special categories of personal data as defined in Article 9 of the General Data Protection Regulation. Material you upload may nevertheless reveal such data, for example where a photograph reveals a person's ethnic origin or health. Do not upload material of that kind unless you have a lawful basis under Article 9.
3. Why we process personal data, and on what legal basis
Each processing activity has a stated purpose and a legal basis under Article 6 of the General Data Protection Regulation.
| Purpose | Data used | Legal basis |
|---|---|---|
| Creating and administering your account, giving you access to the service, and providing customer support | Account and identity data, technical data | Performance of a contract, Article 6(1)(b) |
| Generating captions, scripts, images, video and advertisements at your request | Content you provide, business information, connected account data | Performance of a contract, Article 6(1)(b) |
| Publishing and scheduling content to the accounts you have connected, and retrieving the resulting statistics | Content, connected account credentials, engagement statistics | Performance of a contract, Article 6(1)(b) |
| Operating the assistant across chat, messaging, SMS and telephone, including remembering context between conversations | Messages, uploaded media, call audio and transcripts, business information | Performance of a contract, Article 6(1)(b) |
| Taking payment, issuing invoices, administering the affiliate programme and keeping accounting records | Billing data, account and identity data | Performance of a contract, Article 6(1)(b), and compliance with a legal obligation, Article 6(1)(c), for accounting records |
| Answering support requests and investigating faults you report | Account data, support correspondence, server logs | Performance of a contract, Article 6(1)(b) |
| Keeping the service secure and available, detecting abuse and fraud, and investigating incidents | Technical data, server logs, account data | Legitimate interests, Article 6(1)(f), in protecting the service and its users |
| Understanding how the service is used so that it can be improved | Product analytics events, technical data | Consent, Article 6(1)(a), given through the cookie banner |
| Measuring advertising and showing advertisements for the service | Technical data, advertising identifiers set by cookies | Consent, Article 6(1)(a), given through the cookie banner |
| Establishing, exercising or defending legal claims, and responding to lawful requests from authorities | Any category, as relevant to the claim or request | Legitimate interests, Article 6(1)(f), and compliance with a legal obligation, Article 6(1)(c) |
Where we rely on legitimate interests, we have assessed those interests against your interests and fundamental rights and concluded that our processing does not override them. You may ask us for the reasoning behind that assessment, and you may object to the processing as described in section 5.
4. Artificial intelligence and automated processing
The service uses artificial intelligence systems supplied by third parties to generate text, images, video and speech, and to analyse material you provide. Content you submit is transmitted to those suppliers for that purpose, and if it contains personal data, that personal data is transmitted with it. The suppliers are listed on our sub-processor page.
The service also produces recommendations, for example suggested publication times, suggested content and suggested advertising audiences. These are proposals presented to you. Publication and advertising spend require your decision, and the recommendations therefore do not produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 of the General Data Protection Regulation.
Output generated by an artificial intelligence system may be inaccurate. It may state things about a person that are untrue. You are responsible for reviewing generated content before publishing it, and for the content once published.
We do not permit our artificial intelligence suppliers to use your content to train their general purpose models where their terms allow us to make that election, and we make that election where it is available.
Further information about the artificial intelligence systems used, and about the disclosures required by the EU Artificial Intelligence Act, is set out on our AI transparency page.
5. Your rights
Under the General Data Protection Regulation you have the following rights in relation to your personal data.
- Access: To be told whether we process personal data about you, and to receive a copy of it together with information about the processing.
- Rectification: To have inaccurate personal data corrected and incomplete personal data completed.
- Erasure: To have personal data erased where it is no longer necessary, where you withdraw consent and no other basis applies, or where the processing is unlawful.
- Portability: To receive the personal data you have provided to us in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where technically feasible.
- Restriction: To have processing restricted while a dispute about accuracy or about the basis for processing is resolved.
- Objection: To object at any time to processing based on our legitimate interests, and to object at any time and without reason to processing for direct marketing.
- Withdrawal of consent: To withdraw consent at any time, where processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before it.
Exercising access, portability and erasure yourself
You do not need to contact us to exercise the rights of access, portability and erasure. In the settings area of your account you can download a copy of your personal data as a machine-readable file, and you can delete your account. Deletion ends your access immediately and erases your content 30 days later. The 30 day interval exists so that a deletion made in error, or by somebody who briefly had access to your account, can be reversed by contacting us within that period.
Content already published to a connected platform remains on that platform after deletion. That platform is an independent controller for its copy, and removal must be requested there.
Making a request to us
For any other request, or if you prefer to make a request in writing, write to data@oriiion.ai.
- We respond within one month of receiving the request. Where a request is complex, or where several requests are made, we may extend that period by two further months and will tell you within the first month if we do.
- We may ask for information to confirm your identity where we cannot otherwise establish that the request comes from you. We ask only for what is necessary for that purpose.
- Requests are handled without charge. We may charge a reasonable fee, or decline to act, where a request is manifestly unfounded or excessive, and we will explain our reasoning if that arises.
- Where we cannot act on a request, we will tell you why and inform you of your right to complain to a supervisory authority and to seek a judicial remedy.
Complaints
If you consider that our processing of your personal data infringes the General Data Protection Regulation, you may lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or of the alleged infringement. Our lead supervisory authority is the Swedish Authority for Privacy Protection.
Integritetsskyddsmyndigheten (IMY), Box 8114, 104 20 Stockholm, Sweden. www.imy.se
6. How long we keep personal data
We keep personal data for as long as it is needed for the purpose it was collected for, and thereafter only where a legal obligation requires it or where it is needed to establish, exercise or defend a legal claim. The following periods apply.
| Category | Retention period |
|---|---|
| Account and business data | For as long as the account exists |
| Account and associated content after you delete your account | Erased 30 days after deletion |
| Generated content that was never published and has not been saved by you | Deleted 30 days after it was last changed |
| Content published through the service, and its publication record | For as long as the account exists, so that results remain visible to you |
| Assistant conversations held in your account | For as long as the account exists, or until you delete the conversation |
| Conversations held before an account exists, such as on the public website | Deleted after 24 hours |
| Engagement and audience statistics retrieved from connected accounts | For as long as the account exists |
| Activity log records | Deleted after 72 hours |
| Invoices and accounting records | Seven years, as required by the Swedish Accounting Act |
| Record of your cookie consent choice | Twelve months, after which consent is requested again |
Server logs held by our hosting and logging providers are retained for a short period in accordance with those providers' standard retention settings and are used only for security and troubleshooting. Backups are cycled and personal data erased from the live service is removed from backups as those backups expire.
7. Who we share personal data with, and where it is processed
Processors acting on our instructions
We use service providers to host the service, store files, generate content, deliver messages and analyse usage. They process personal data only on our documented instructions. The complete list, with the purpose and location of each provider, is published and kept current on our sub-processor page.
Recipients acting as independent controllers
Some recipients decide for themselves how they use personal data and are independent controllers rather than our processors. We are not responsible for their processing, and requests concerning it must be directed to them. These recipients are:
- The social and commerce platforms you connect, including Meta, LinkedIn, TikTok, Google, X, Pinterest, Snap, Telegram and Shopify, in respect of the accounts you hold with them and the content published to those accounts.
- Our payment provider, in respect of payment and identity data collected to process a payment and to meet its own regulatory obligations.
- Apple and Google, where you choose to sign in using an account held with them.
Transfers outside the EEA
Several of our providers are established outside the European Economic Area, principally in the United States. Personal data described in this policy is therefore transferred to third countries.
Location of the main database: The database holding account data, generated content and assistant conversations is operated by our database provider in regions located in the United States. This means that the personal data described in section 2 is stored in the United States, and not only transmitted there for particular operations.
We rely on the following safeguards under Chapter V of the General Data Protection Regulation:
- The Standard Contractual Clauses adopted by the European Commission, incorporated into the provider's data processing terms.
- The EU-US Data Privacy Framework, where the recipient is certified under it.
- An adequacy decision of the European Commission, where one covers the country concerned.
You may request information about the safeguard applied to a particular provider, and a copy of the relevant clauses, by writing to the privacy contact in section 1.
Other disclosures
We disclose personal data to professional advisers where necessary for advice, to authorities where required by law or by a binding order, and to an acquirer in connection with a merger, acquisition or transfer of the business, in which case we will inform you before your data becomes subject to a different privacy policy. We do not sell personal data.
8. How we protect personal data
We maintain technical and organisational measures appropriate to the risk. The measures currently in place are:
- Encryption in transit: All connections to the service and to our providers use TLS.
- Encryption at rest: The database and object storage are encrypted at rest by the providers operating them.
- Access control: Access to production systems and to customer data is limited to the personnel who need it, and every request to the application is authenticated and scoped to the account it belongs to.
- Credential handling: Passwords are stored hashed. Credentials for connected platforms are held for the purpose of operating the connection, and are excluded from the data export file so that the file cannot be used to reach those accounts.
- Logging: Requests and errors are logged so that faults and suspicious activity can be identified and investigated.
- Backups: The database is backed up daily by the database provider, with point-in-time recovery.
Certifications
Get Orion AI AB does not hold SOC 2 attestation or ISO 27001 certification, and has not undergone an independent security audit. We state this plainly rather than describe our providers' certifications as though they were our own. Several of our providers do hold such certifications, and we can confirm the position for a particular provider on request.
Access to uploaded files
Files you upload are stored with our storage provider and are served from addresses that are not listed publicly and are not indexed, but which are not individually access-controlled. A person who obtains or correctly constructs the address of a file can retrieve it. Do not upload material through the service if that possibility is unacceptable for the material in question.
Where a personal data breach occurs, we notify the supervisory authority within 72 hours of becoming aware of it where the breach is likely to result in a risk to the rights and freedoms of natural persons, and we notify affected users without undue delay where the risk is high. Our procedure is described in our incident response policy.
9. Cookies and similar technologies
We use cookies and similar technologies on our website. Cookies that are not strictly necessary are set only after you have consented, and you may change or withdraw your choice at any time through the cookie settings link in the footer. The categories, the individual cookies and their durations are described in our cookie policy.
10. Information for residents of California
If you are a resident of California, the California Consumer Privacy Act as amended by the California Privacy Rights Act gives you the following rights, in addition to those described in section 5:
- To know the categories of personal information collected, the sources it came from, the purposes for collecting it and the categories of third parties it is disclosed to. That information is set out in sections 2, 3 and 7.
- To request deletion of personal information, subject to the exceptions provided by the Act.
- To correct inaccurate personal information.
- To opt out of the sharing of personal information for cross-context behavioural advertising, and to limit the use of sensitive personal information.
We do not sell personal information for money. Advertising cookies described in our cookie policy may constitute sharing for cross-context behavioural advertising under the Act. Declining marketing cookies in the cookie settings gives effect to an opt out. We do not discriminate against anyone for exercising a right under the Act.
11. Children
The service is intended for businesses and for people acting in a professional capacity. It is not directed at children, and we do not knowingly collect personal data from a child. If you believe that a child has provided us with personal data, write to the privacy contact in section 1 and we will delete it.
12. Changes to this policy
We review this policy when our processing changes and at least once a year. Where a change materially affects how we process your personal data, we will inform you by email or through the service before the change takes effect, and where the change requires your consent we will ask for it. The date at the top of this page records when the current version was published.