Legal
Privacy Policy
This policy explains what data we collect when you use Oriel and how we handle it.
Overview
Oriel (“we,” “us”) operates the link-in-bio page builder at oriel.page. This Privacy Policy describes personal information we collect, how we use it, and the choices you have. It applies to visitors, account holders, and buyers who interact with Oriel pages.
Questions: privacy@oriel.page
Information we collect
Account information
When you sign up, we collect your name, email address, and password (stored hashed). If you use Google OAuth, we receive profile information Google shares with us (such as name and email) via Better Auth.
Page and content data
We store the content you create: page layout, widget settings (Link, Bio, Image, Social, Embed, Product), themes, uploaded images (stored on Cloudflare R2), and product listings.
Session and technical data
When you log in, we create sessions that record your IP address and user agent for security, fraud prevention, and session management.
Commerce data
If you sell through Oriel, we process order metadata (product, amount, buyer email where provided) and connect your Stripe Express account. Payment card data is handled directly by Stripe — we do not store full card numbers.
Public page visitors
Visitors to public Oriel pages may generate server logs (IP address, browser type, referring URL). We plan to use PostHog analytics (EU hosting) to understand product usage; when enabled, we will update this policy and our Cookie Policy.
How we use information
We use personal information to:
- Provide, maintain, and improve the Service
- Authenticate you and secure your account
- Host and display your public page at oriel.page
- Process subscriptions and facilitate seller payouts via Stripe
- Send service-related communications (e.g., password resets)
- Detect abuse, enforce our policies, and comply with law
- Analyze aggregated usage to improve features (when analytics are active)
We do not sell your personal information. We do not use your page content to train third-party AI models.
Legal bases (EEA/UK)
Where GDPR applies, we process data based on: performance of our contract with you (providing the Service), legitimate interests (security, analytics, improvement), consent (where required, e.g., non-essential cookies), and legal obligations.
How we share information
We share information with service providers who help us operate Oriel:
- Stripe — payments, Connect onboarding, subscriptions
- Vercel — application hosting
- Neon — PostgreSQL database
- Cloudflare R2 — image storage
- Google — OAuth sign-in (if you choose it)
- PostHog (planned, EU) — product analytics
We may also disclose information if required by law, to protect rights and safety, or in connection with a merger or acquisition.
Data retention
We retain account data while your account is active. If you delete your account, we delete or anonymize personal data within a reasonable period, except where we must retain records for legal, tax, or fraud prevention purposes (e.g., Stripe transaction records).
Security
We use industry-standard measures including encrypted connections (HTTPS), hashed passwords, and access controls. No system is perfectly secure; please use a strong, unique password and enable available security features.
Children
Oriel is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us data, contact privacy@oriel.page.
Your rights
Depending on where you live, you may have rights to access, correct, delete, or export your personal data, and to object to or restrict certain processing. EEA/UK residents may lodge a complaint with a supervisory authority.
To exercise rights, email privacy@oriel.page. We may verify your identity before responding.
International transfers
We and our providers may process data in the United States and other countries. Where required, we use appropriate safeguards for cross-border transfers.
Changes
We may update this policy. The “Updated” date at the top reflects the latest revision. Material changes will be communicated through the Service or by email where appropriate.