Legal
Privacy Policy
How Oratia collects, uses, stores, and shares information — including data we access from your Google account.
Oratia is a customer relationship platform for vacation rental management companies. This policy explains what we do with information handled by Oratia LLC (“Oratia,” “we,” “us”) when you use oratia.io and the Oratia application (the “Service”).
The short version. We use your data to run the Service for you and for nothing else. We do not sell it, we do not use it for advertising, and no Oratia employee reads your email, call recordings, or messages unless you ask us to for support, or we are required to for security or law.
1. Who this policy covers
Oratia is business software sold to companies. Two different groups of people appear in it, and they have different relationships with us:
- Users — people at a customer company who log in to Oratia. We are the controller of their account information.
- Contacts — homeowners, prospects, and other third parties whose details a customer stores in Oratia. We process that information as a processor on the customer’s behalf. The customer decides what is collected and why. If you are a Contact and want your information corrected or removed, contact the company you dealt with; we will support their request, and you can also reach us at privacy@oratia.io.
2. Information we collect
Information you give us
- Account and profile data — name, business email address, password credentials (stored hashed by our authentication provider), role, team membership, and phone number.
- Business verification data — company name, business address, EIN or equivalent, and website, where you enable telephone or SMS features. This is required by mobile carriers for 10DLC registration and is passed to our telephony provider and the carriers.
- Customer Data — the contacts, deals, properties, notes, tasks, and activity records you create or import.
- Billing data — plan, subscription status, and billing contact. Card numbers go directly to Stripe and are never stored on Oratia’s systems.
Communications content
Where you enable the relevant features, Oratia stores the substance of business communications so it can appear on the right record in your CRM:
- Email — messages sent through Oratia, messages forwarded to your Oratia lead intake address, and, if you connect a mailbox, messages retrieved from that mailbox.
- Calls — call metadata (numbers, direction, timestamps, duration) and, where you turn recording on, call recordings and transcripts.
- SMS — message content and delivery metadata.
- Calendar — events and availability from a connected calendar.
Information we collect automatically
- Usage and device data — pages viewed, features used, IP address, browser and device type, and timestamps.
- Diagnostic data — error reports and performance traces, used to keep the Service working.
- Cookies — see section 9.
3. Google user data
If you connect a Google account, Oratia accesses it through the Gmail and Google Calendar APIs. We request the narrowest scopes that support the features below, and we ask for them only when you start the connection.
| Scope | What it permits | Why Oratia needs it |
|---|---|---|
gmail.send | Send mail as you | So email you compose in Oratia leaves from your own address and lands in your Sent folder, rather than from a generic system address. |
gmail.readonly | Read your email messages and settings | To sync inbound messages into the CRM, so correspondence with a homeowner or prospect appears on that contact’s timeline without copying and pasting. Oratia never modifies, labels, moves, or deletes anything in your mailbox. |
calendar | Read and write calendar events | To show your real availability when booking an owner meeting and to write the confirmed appointment back to your calendar. |
Limited Use
Oratia’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Concretely, that means:
- We use Google user data only to provide and improve the features described above, which are visible in Oratia’s interface.
- We do not transfer or sell Google user data to third parties for advertising, data brokerage, credit assessment, or lending.
- We do not use Google user data to serve advertisements of any kind, including retargeted or interest-based advertising.
- We do not allow humans to read Google user data, except: where you give specific affirmative consent (for example, you send us a message so we can debug it); where it is necessary for security purposes such as investigating abuse; where we are required to by law; or where the data has been aggregated and anonymized for internal operations.
- We share Google user data with the service providers in section 6 only to the extent needed to operate these features, under contracts that hold them to equivalent restrictions.
Automated processing of message content
Oratia uses automated language models to draft summaries, extract contact details from inbound enquiries, and surface follow-up suggestions. Where the source is Google user data, that content is sent to Google’s Gemini API for processing and is not used to train any general-purpose model. This processing is machine-only; it is not a human reading your mail.
Who can see synced messages
Messages synced from your mailbox are visible only to you inside Oratia. Managers on your team see derived items such as follow-up suggestions, activity counts, and contact records, but not the content of your mailbox.
Disconnecting
You can disconnect at any time in Oratia under Settings → Integrations. Disconnecting deletes the access token stored by Oratia immediately and instructs Aurinko, our connectivity provider, to delete the connection, which revokes Oratia’s access in your Google Account. You can also revoke Oratia’s access directly from your Google Account permissions page. Revoking stops all future access; to delete content already synced into your CRM, see section 7.
4. How we use information
- To provide, maintain, and secure the Service.
- To power the features you turn on — logging communications to the right record, transcribing and summarizing calls, suggesting follow-ups, and scheduling meetings.
- To authenticate users and enforce team and role permissions.
- To process payments and manage subscriptions.
- To provide support and respond to your requests.
- To send you service messages about your account, billing, and material changes. Marketing email is separate and you can opt out of it at any time.
- To detect, investigate, and prevent fraud, abuse, and security incidents.
- To comply with legal obligations.
We do not sell personal information, and we do not share it for cross-context behavioural advertising. We do not use Customer Data or Google user data to train general-purpose AI models.
5. Call and message recording
Recording laws vary by state and country. Some jurisdictions require every party on a call to consent. Oratia provides the recording capability; the customer operating the account is responsible for obtaining any consent the law requires and for configuring the feature accordingly. See section 5 of our Terms of Service.
6. Service providers
We use the following subprocessors to run the Service. Each receives only the data needed for its function and is bound by contract to protect it.
| Provider | Function | Data involved |
|---|---|---|
| Vercel | Application hosting and file storage | All data in transit; call recordings at rest |
| Supabase | Database, authentication, storage | Account data and Customer Data at rest |
| Stripe | Payment processing | Billing contact and payment details |
| Aurinko | Email and calendar connectivity | OAuth tokens, message and event content |
| Google (Gemini API) | Automated summarization and extraction | Message, call, and transcript content |
| Telnyx | Voice and SMS carriage | Phone numbers, call audio, message content |
| Deepgram | Live call transcription | Call audio |
| Amazon Web Services | Live voice assistance | Call audio |
| Groq | Data cleaning and import processing | Imported spreadsheet and contact data |
| Resend | Transactional and inbound email | Email addresses and message content |
| Upstash | Rate limiting | IP addresses and request metadata |
| Sentry | Error monitoring | Diagnostic data and technical identifiers |
We also disclose information:
- To a customer’s account administrators, who can see activity within their own team.
- Where required by law, subpoena, or to protect the rights, property, or safety of Oratia, our customers, or the public.
- In connection with a merger, acquisition, or sale of assets. Google user data will only be transferred in such a transaction with your explicit prior consent.
7. Retention and deletion
- Customer Data is retained while the account is active. You can delete individual records at any time from within the Service.
- Deleting your account. You can delete your account yourself under Settings → Account. Deleting your account immediately and permanently deletes your synced mailbox messages, your calendar data, and your profile; if you are the last member of your team, all of the team’s Customer Data is deleted at the same time. Copies in encrypted backups and diagnostic logs expire within 90 days.
- On account closure by other means, we delete or anonymize Customer Data within 90 days, except where we must retain records to meet a legal or accounting obligation.
- OAuth tokens are deleted immediately when you disconnect an integration, and the connection is deleted at Aurinko at the same time.
- Call recordings are retained for as long as the customer’s configured retention period, and can be deleted individually at any time.
- Raw webhook and diagnostic data is retained for up to 90 days and then purged automatically.
To request deletion, email privacy@oratia.io. We respond within 30 days.
8. Security
Data is encrypted in transit with TLS and at rest by our infrastructure providers. Access to production data is restricted to personnel who need it, tenant data is isolated at the database level by row-level security policies, and OAuth tokens are never exposed to other users on your team. No system is perfectly secure, but we take this seriously and will notify affected customers of a breach without undue delay and as required by law.
9. Cookies
We use cookies that are strictly necessary to run the Service — keeping you signed in, maintaining your session, and protecting against cross-site request forgery. We do not use advertising cookies or third-party tracking pixels. Blocking essential cookies will prevent you from signing in.
10. Your rights
Depending on where you live, you may have the right to access, correct, delete, port, or restrict the processing of your personal information, and to withdraw consent. Residents of California may request disclosure of the categories of personal information collected and may opt out of sale or sharing — Oratia does neither. Residents of the EEA and UK may object to processing and lodge a complaint with a supervisory authority.
Exercise any of these rights at privacy@oratia.io. We will not discriminate against you for doing so. If your information is in Oratia because a customer put it there, we will refer your request to that customer and assist them in fulfilling it.
11. International transfers
Oratia is operated from the United States and information is processed there. If you access the Service from elsewhere, you understand that your information will be transferred to and processed in the United States, which may have different data protection laws than your jurisdiction.
12. Children
The Service is business software and is not directed to anyone under 16. We do not knowingly collect information from children. If you believe a child has provided us information, contact us and we will delete it.
13. Changes
We may update this policy. If a change materially affects how we handle your information, we will notify account administrators by email and update the effective date above before it takes effect. We will not apply materially different handling to previously collected Google user data without your consent.
14. Contact
Oratia LLC
25 Goldsmith St, Greenville, SC 29609
privacy@oratia.io