This Privacy Policy explains how Oro ("Oro," "we," "us," or "our") collects, uses, shares, and protects personal information when you use our websites, applications, and related services (the "Services").
Information We Collect
Oro collects information you provide directly to us, such as when you create an account, request a demo, book through a business that uses Oro, or contact us for support. This may include your name, email address, phone number, business information, payment-related details processed by our payment providers, and any other information you choose to provide.
We also collect certain information automatically when you use the Services, including device and browser information, IP address, approximate location derived from IP, pages viewed, referring URLs, and diagnostic or performance data.
How We Use Your Information
We use the information we collect to:
- Provide, operate, secure, and improve the Services
- Process transactions and manage accounts
- Communicate about the Services, updates, and (where permitted) promotional offers
- Provide customer support and respond to inquiries
- Measure product usage, diagnose issues, and enhance user experience
- Measure advertising effectiveness and deliver relevant marketing (with consent where required)
- Comply with legal obligations and enforce our terms
Cookies, Analytics, and Advertising
We and our service providers use cookies, pixels, SDKs, and similar technologies to operate the Services, remember preferences, understand usage, and measure marketing campaigns. Depending on your region and consent choices, this may include:
- Product analytics (for example, PostHog)
- Web analytics (for example, Google Analytics)
- Advertising and conversion measurement (for example, Meta Pixel / Conversions API)
These tools may collect identifiers (such as cookie IDs), device information, and events about how you interact with our sites (for example page views, sign-ups, or purchases). Where required by law, we request your consent before enabling non-essential cookies and advertising technologies. You can withdraw or change consent through our cookie banner where available, and you can also control cookies through your browser settings.
For Meta (Facebook/Instagram) advertising measurement, event data may be shared with Meta Platforms, Inc. subject to your consent settings and Meta's own terms and policies.
Information Sharing
We do not sell your personal information. We may share information with trusted service providers who help us operate the platform (for example hosting, payments, communications, analytics, and advertising measurement), when required by law, or with your direction or consent. Service providers are permitted to use personal information only to perform services for us or as otherwise required by law.
When you provide personal data in connection with Oro Payments, Stripe receives that personal data and processes it in accordance with Stripe's Privacy Policy.
Bank Account Connections
When you connect a bank account — to receive payroll by direct deposit, to pay booth rent, or to import transactions into your books — we use Plaid to establish that connection. You sign in to your bank through Plaid; we never see or store your online banking username or password.
What we receive from Plaid depends on why the account is being connected:
- To verify an account for direct deposit or rent — the account and routing details needed to move money, the account holder's name as your bank reports it, the institution name, and the last four digits of the account number.
- To import transactions into your bookkeeping — the above, plus your transaction history for the connected accounts, so your books can be reconciled against your bank.
Transaction history is only requested for accounts connected for bookkeeping. An account connected solely to receive pay or pay rent is never used to read your transactions. You are shown which of these applies before you connect.
Account and routing numbers are encrypted at rest and are never returned to your browser or shown to other users of your business. Plaid's own handling of your information is governed by the Plaid End User Privacy Policy.
You can disconnect a bank account at any time from Bank Feeds, or by asking the business owner to remove it. Disconnecting instructs Plaid to discard the connection and revokes our access to that account.
Data Security
We implement appropriate technical and organizational measures to protect personal information against unauthorized access, alteration, disclosure, or destruction, including encryption in transit, access controls, and secure infrastructure practices.
Your Rights
Depending on your location, you may have the right to:
- Access and review your personal information
- Request corrections to inaccurate information
- Request deletion of your personal information
- Opt out of marketing communications
- Object to or restrict certain processing, including targeted advertising where applicable
- Data portability where applicable
Oro is built for Canadian privacy law and follows PIPEDA (federal). For health-adjacent businesses we align with PHIPA (Ontario) and Quebec's Law 25 where applicable.
Data Retention
To delete your Oro account or request deletion without the app, see Account deletion instructions and request form.
We retain personal information for as long as needed to provide the Services, comply with legal obligations, resolve disputes, and enforce agreements. Retention periods vary by data type and business need.
Mobile communications
For mobile phone and receptionist features, we process names, email addresses, phone numbers and account IDs to manage accounts, contacts and communications. We store SMS message contents, sender and recipient phone numbers, call history such as times, status and duration, and booking details and notes to provide these features.
These features process live call audio, voicemail recordings, selected call recordings and transcripts. Live audio is transmitted even when call recording is off; voicemail recording is separate from the call-recording setting. Recordings and transcripts may be retained for playback, message history and receptionist or booking workflows.
Mobile identifiers and diagnostics
We use a persistent installation identifier and push tokens for account sessions and notification delivery. Mobile services also process device and app information to operate calls, notifications and app updates. Twilio processes your client IP address and call-quality diagnostics, including approximate location derived from your IP address, to operate and troubleshoot calls. These call records are linked to your business and account through your calling identity.
While you are signed in, the app sends JavaScript crash reports with error messages, stacks, app and operating-system versions, platform and screen information. Reports forwarded to Sentry include your account ID. Error text can contain details present when an error occurs. On iOS and Android, native app-update requests to Expo include a persistent client ID and a previous fatal update error when one is available. This update path operates separately from the signed-in JavaScript crash reporter.
Mobile permissions
Microphone access supports calls. Optional contacts access displays names from your device beside calls and texts; the address book is not uploaded by this feature. Contact details you enter and save to Oro are stored separately. Optional calendar access writes bookings to the Oro Bookings calendar and reads its events to reconcile changes; this mirror does not upload unrelated device-calendar events. You can manage these permissions in your device settings.
Mobile service providers
Twilio carries calls and SMS and processes voicemail and speech-to-text transcription. When you use the AI receptionist, ElevenLabs processes conversation audio and content. Push delivery uses Expo and Apple or Google notification services, including Firebase Cloud Messaging on Android. Expo also delivers app updates, and Sentry processes error reports for diagnostics. The data sent depends on the feature in use.
Mobile retention and account deletion
Retention depends on the type of data and the relevant business settings. Deleting the app or disabling device permissions does not by itself delete server-held communications. Request account deletion from mobile Settings → Delete account or web Settings → Account. If eligibility checks block deletion, the app explains what must be resolved before it can proceed.
Account access removal and completion of data cleanup are separate steps. Cleanup may remain pending while stored communications, provider-held records and phone-number release are retried. We keep a record of the deletion request so unfinished cleanup can be retried. Removing access does not confirm that every provider-held copy or phone number has already been removed. Accounting, security and callback-suppression records may be retained.
Children
The Services are not directed to children under 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect personal information from children.
Changes to This Policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the latest revision. Continued use of the Services after an update constitutes acceptance of the revised policy where permitted by law.
Contact Us
If you have questions about this Privacy Policy or wish to exercise your privacy rights, use our privacy contact form. A formatted copy of our legal documents is also available in-app at /legal.