Privacy Policy

This Privacy Policy explains how Orato AI Limited ("Orato AI", "we", "us", or "our") collects, uses, and protects information when you use our software and services, including the Orato Flow application (the "Service"), whether obtained directly from us or via Microsoft Marketplace.

This Privacy Policy applies when you access or use the Service, and should be read together with our Terms and Conditions.

1. Who we are and our role

For account, billing, website and direct customer relationship information, Orato AI Limited generally acts as a data controller.

When an organisation uses Orato Flow to process audio, transcripts, translations or other event content on behalf of its participants, employees, speakers or attendees, that organisation generally acts as the data controller and Orato AI acts as a data processor on its behalf.

The organisation using Orato Flow is responsible for ensuring that it has an appropriate lawful basis for collecting and processing event content, and for informing the people involved.

2. Information we collect and process

Depending on how you use Orato Flow, we may collect or process the following categories of information.

Account and organisation information

• Name and email address
• Organisation name
• Account and authentication identifiers
• Subscription, licensing and billing information, including Microsoft Marketplace subscription identifiers
• Account settings and preferences

Event and session information

• Event names, session details and configuration
• Glossary terms, names and preferred translations
• Live transcripts and translated text
• Caption and translation outputs
• Other event content that users choose to save within Orato Flow

Technical information

• IP address
• Browser and device information
• Session and diagnostic information
• Error and security logs

Support information

• Emails and messages you send us
• Screenshots, logs, audio samples or other information you voluntarily provide when requesting support

3. How we use information

Providing the Service

• Delivering real-time transcription, translation, captioning and translated audio
• Applying glossaries and other event configuration you set up
• Making saved event content available in your account

Accounts, licensing and billing

• Creating and authenticating accounts
• Activating and verifying your Orato Flow licence
• Managing subscriptions, including those created via Microsoft Marketplace

Supporting you

• Responding to your support requests
• Communicating with you about updates, fixes and important service notices

Security, reliability and legal obligations

• Detecting and preventing misuse or unauthorised access
• Maintaining and improving the stability and security of our systems
• Meeting legal, accounting and record-keeping obligations

We do not use customer event audio, transcripts or translations to train AI models, and we do not use them for advertising or marketing purposes.

4. Website analytics and cookies

This section is about this marketing website, not the Orato Flow application. No event audio, transcripts or translations are involved.

We use Google Analytics to understand how visitors find and use our pages — which pages are read, which links are followed, and roughly where visitors are located. Google Analytics sets cookies in your browser and processes information including your IP address, device and browser type, and the pages you view.

We configure analytics to record the shape of an interaction rather than its content, so information you type into forms on this site is not sent to Google Analytics. We do not use advertising or remarketing cookies, and we do not sell or share this information with data brokers.

Where we embed video, we use YouTube's privacy-enhanced mode, which does not set tracking cookies unless you choose to play the video.

You can prevent analytics collection using your browser's cookie controls, or by installing Google's opt-out browser add-on. Information Google collects as the provider of Google Analytics is also subject to Google's own privacy policy.

5. Audio, transcripts and translation data

Orato Flow processes live audio to provide real-time transcription, translation, captioning and translated audio. Live audio is transmitted to our speech-recognition providers for processing. The resulting transcript and related text may then be processed by our AI, translation and text-to-speech providers as required to provide the Service.

Orato Flow does not retain live audio recordings by default. Live audio is processed as it streams, and is not stored as an audio recording in the user's Orato Flow account.

Depending on how a session is configured, event transcripts, translations, glossaries and related event information may be stored within the user's Orato Flow account. Users may choose not to save event content after a session.

Saved event content remains under the control of the account holder, and can be viewed, exported or deleted through Orato Flow by authorised users.

Users can download transcripts, translations and subtitle files to their own device. Once downloaded, those copies are controlled by the user or their organisation, and are no longer managed by Orato AI.

If you integrate Orato Flow with third-party services (for example cloud storage, meeting platforms, or your own APIs), the privacy policies of those services will apply to any data shared with them.

6. Legal basis and customer instructions

Where data protection laws such as the GDPR apply, we process personal data on the following bases:

• Performance of a contract — to provide, activate and support the Service and your Orato Flow licence.
• Legitimate interests — to secure our systems, prevent abuse, and operate and improve the Service in ways that do not override your rights.
• Consent — where you explicitly choose to send us additional data, for example logs, audio or transcripts for support.
• Legal obligation — where we are required to retain or disclose information by law.

Where we act as a processor on behalf of a customer organisation, we process event content in accordance with that organisation's instructions and the agreement in place with them.

7. Data retention and deletion

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected.

• Account and subscription information: retained while the account is active, and for a reasonable period afterwards where required for legal, accounting, security or operational purposes.
• Saved event content: retained within the user's account until deleted by the user, by the organisation, or in accordance with applicable account retention policies.
• Unsaved event content: where a user chooses not to save event content, that content is not retained as saved event history after the applicable processing is completed, subject to temporary technical processing required to operate the Service.
• Live audio: not retained as an audio recording by default.
• Support information: retained only for as long as reasonably necessary to provide support and maintain appropriate business records.

Authorised users can delete saved event content directly through Orato Flow.

8. Service providers and subprocessors

We do not sell your personal data.

We use trusted third-party service providers to operate Orato Flow, including providers of cloud hosting, authentication, speech recognition, artificial intelligence, translation, text-to-speech, email, monitoring and customer support services.

These providers process information only as necessary to provide their services to us, and are subject to contractual, confidentiality and security obligations.

Where Orato AI acts as a data processor, certain providers may act as subprocessors. Information about applicable subprocessors, including their role and relevant processing locations, is available to customers on request, and may be provided as part of our Data Processing Addendum or vendor due-diligence process.

We may also disclose information where required by law, regulation or valid legal process, or to protect the rights, property or safety of Orato AI, our users, or others.

9. International data transfers

Orato AI Limited is established in New Zealand. New Zealand is recognised by the European Commission as providing an adequate level of protection for personal data.

Some of our service providers may process information in other countries. Where required by applicable data protection law, we use appropriate contractual or other safeguards for international transfers of personal data.

10. Security

We use appropriate technical and organisational measures to protect the data we hold, including:

• Encryption of data in transit using TLS, and encryption at rest using industry-standard encryption provided by our cloud infrastructure
• Role-based and restricted access controls, following the principle of least privilege
• Authentication and account security controls
• System logging and monitoring

No system can be guaranteed completely secure. You are responsible for keeping your account credentials confidential, and for securing any transcripts, translations or subtitle files you export to your own devices or storage.

11. Your privacy rights

Depending on your location and the laws that apply, you may have rights such as:

• Accessing the personal data we hold about you
• Requesting correction of inaccurate information
• Requesting deletion of data we no longer need
• Objecting to or restricting certain uses of your data
• Requesting a portable copy of your data
• Withdrawing consent where processing is based on consent

Where personal data or event content is stored within an Orato Flow account, authorised users can access, export or delete that information directly through the Service.

If we process event content on behalf of an organisation, requests relating to that content should normally be directed to the organisation acting as the data controller. We will assist our customers in responding to applicable data subject requests where required by law.

To exercise these rights in relation to data for which we are the controller, please contact us at [email protected]. You may also have the right to lodge a complaint with your local data protection authority, or with the Office of the Privacy Commissioner in New Zealand.

12. Children's data

Orato Flow is not intended for children to create or manage accounts directly. Customer organisations may, however, use the Service in settings that involve minors — a school assembly or a community workshop, for example. In those circumstances the customer organisation is responsible for ensuring that it has an appropriate lawful basis, provides any required notices, and obtains any required consent or authorisation. Where Orato AI processes such event content on behalf of the customer, we do so as the customer's data processor.

If you believe we have unintentionally collected personal data from a child in a context where we are the controller, please contact us so we can delete it.

13. Changes to this Privacy Policy

We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you via email or through the Service.

14. Contact us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact: