Privacy policy

1. Who we are and what this covers

Oro Digital Inc. (Corporation No. 1780273-1), incorporated in Canada with its registered office in Ontario, operates Oro’s AI stylist. This policy describes personal information handled through our texting service, its signup flow, and buildingoro.ca.

The separate mobile application remains covered by its mobile app privacy policy. Sharing or linking an account across products does not, by itself, give us permission to use your information for a new purpose.

Oro’s texting service is in beta. We record conversations, including the content you send and the content Oro generates. Our team can review complete transcripts, photos and other attachments, generated content, and associated technical records for testing, evaluation, prompt improvement, debugging, and engineering. This review can include information that identifies you. Please consider this before sharing personal information.

Contact us at admin@buildingoro.ca.

2. Information we collect

• Signup and account information: your name, mobile number, date of birth, country, state or province, how you heard about Oro, and verification and consent records. We use your birth date and location to check eligibility.
• Your conversations: messages you send, Oro’s replies, timestamps, delivery information, and any attachments or links you share. Conversations may include occasions, shopping plans, budgets, sizing, or personal circumstances you choose to discuss.
• Photos and wardrobe information: images you send, clothing descriptions, wardrobe entries, outfit feedback, and preferences. AI processing can produce labels, summaries, style profiles, or numerical representations used to find relevant clothing and personalize replies.
• Optional styling details: information you choose to provide about fit, measurements, appearance, location, or weather needs. Photos can reveal your face, body, surroundings, and information about other people.
• Technical and diagnostic information: IP addresses, browser or device details, requests, errors, message delivery status, and records of AI processing, including inputs, outputs, model usage, and performance.
• Support and website forms: contact details and messages you submit to our contact form or mailing list.
• Payment information, if you subscribe: customer and subscription identifiers, plan, billing status, and transaction records from our payment provider. Payment details are entered in the provider’s checkout, not in an Oro text conversation.

Only send information relevant to styling. Avoid intimate images, identity documents, financial details, and other sensitive information you do not want processed. Obtain permission before sharing another person’s image or personal information.

3. How we use information

We use the information described above to verify your number and eligibility; respond to styling requests; process photos; remember your wardrobe and preferences; provide relevant recommendations; deliver messages; administer access and any subscriptions; answer support requests; detect misuse; investigate errors; and meet legal requirements.

Personalization means using your account information and conversation context to respond to you.

During beta, our team can review all parts of your interactions with Oro: your messages and conversation transcripts, photos and other attachments, Oro’s replies and generated images or other outputs, and the related diagnostic records. We use this review to evaluate response quality, test and improve prompts and service behaviour, investigate errors, and perform engineering work. We do not use reviewed content in advertising or sell it.

4. AI processing and service providers

Oro sends relevant parts of your messages, images, wardrobe information, and conversation context to service providers to generate replies, process images, operate the service, and support the beta review described above. Human review and provider processing mean that your conversation is not seen only by an automated system.

• Messaging and verification: Twilio processes phone numbers, verification requests, messages, attachments, and delivery information for SMS and MMS.
• AI processing: the service integrates OpenAI, Google’s Gemini services, and Anthropic for tasks such as understanding requests, interpreting images, and generating styling recommendations. The information sent depends on the task.
• Hosting and storage: AWS provides backend infrastructure and image storage. Account, wardrobe, and conversation records are held in our backend database. Vercel hosts the website; Supabase stores website form submissions.
• Support and email: Resend delivers website contact notifications and emails. Our support team receives the information needed to respond to a request.
• Payments: Stripe processes texting-service purchases when paid checkout is available and returns billing and subscription information to Oro.
• Diagnostics and analytics: error reporting integrates Better Stack using the Sentry SDK. The backend includes PostHog monitoring that, when enabled, sends AI inputs and outputs along with usage and performance records. Website analytics are described separately below.

We do not sell your personal information or share conversations, photos, generated content, mobile numbers, or texting opt-in records with advertisers or other companies for their own marketing. Service providers may process information on our behalf to operate Oro, support internal beta evaluation and engineering, and honor your choices. This provider processing is distinct from selling information or sharing it for advertising.

We may disclose information where required by law or where law permits disclosure to address fraud, security threats, or legal claims. If a business transaction changes who is responsible for your information or how it is used, we will provide the notice and obtain the consent required by applicable law.

5. Messages and consent

The signup flow requests consent to the recurring automated texting program separately from acceptance of our terms. We record the time of texting consent. Oro’s styling messages may include onboarding, answers to your requests, and the follow-ups described in that program. Message frequency varies; carrier message and data rates may apply.

Reply STOP to stop styling messages, START to resubscribe, or HELP for help. We retain an opt-out record so we can honor your choice. Stopping messages does not itself delete your information or cancel a subscription.

Verification codes you separately request through signup or sign-in serve that request and are subject to carrier blocking. Contact admin@buildingoro.ca if you cannot receive a code.

We will seek additional consent where required for promotional messages outside the program you joined. You can unsubscribe from mailing-list emails using their unsubscribe link or by contacting us. Holding an account does not give us unlimited permission to send marketing.

Where your consent is required for a new purpose or a new disclosure of personal information, we will explain it and request that consent. Posting a revised policy is not a substitute for obtaining it.

6. Website cookies and analytics

Our website stores your cookie choice, interface and newsletter preferences, and unfinished signup answers in browser storage. Those answers can include your name, birthday, location, referral information, and phone number so you can resume signup. Google Analytics is loaded only after you accept analytics through the cookie banner. It measures website visits, navigation, and interactions. Our cookie policy explains these technologies and their duration.

You can decline optional analytics and continue using the site. To choose again, clear buildingoro.ca’s cookies and site data in your browser and reload the website. This resets the cookie banner and can also clear saved website preferences. Website analytics choices are separate from the processing needed to respond when you text Oro.

7. Where information is processed

Oro is a Canadian company and uses service providers outside Canada, including in the United States. Information sent to those providers may be stored or processed outside your province, state, or country and may be subject to lawful access by authorities in those jurisdictions.

Our backend configuration uses AWS’s US-East-1 region. Other providers’ locations and practices depend on the services and account configurations we use.

8. Retention and deletion

Conversation history: we keep raw messages, conversation attachments, and Oro’s generated replies and other outputs for up to six months from when each item is received or created, and delete them sooner when no longer needed for the purposes described in this policy. Continuing to text Oro does not restart the retention period for older items. Copies of this content in diagnostic or human-review records follow the same limit.

Saved closet and preferences: wardrobe items, saved clothing photos, and useful style preferences are separate from the raw conversation history. We keep them while needed to provide ongoing styling for your active account, unless you ask us to delete them. Deleting an old transcript does not by itself remove a saved closet item or preference. This does not allow us to retain a duplicate of the full conversation as a saved preference.

Deletion requests: you can request deletion of your account, messages, photos, or saved preferences by emailing admin@buildingoro.ca. We delete the requested information within 30 days of verifying your request, subject to the limited exceptions below. If we need information to confirm that you control the account, we will ask promptly. This deadline applies even when the information is less than six months old and covers copies held by providers on our behalf.

We may retain limited records where required by law, such as applicable billing or tax records, or where necessary and legally permitted to honor a texting opt-out, investigate a specific security incident, or resolve a legal dispute. We will explain any exception that affects your request and the applicable retention period or criteria. Such records are restricted to those purposes and are not retained for general prompt improvement or beta evaluation.

Deleting information from Oro does not erase copies already on your device or independently retained by your carrier or another service you use. Deleting an account and cancelling a subscription are separate actions.

9. Security

We use safeguards designed to restrict access to personal information and protect our systems. No service can guarantee absolute security. SMS and MMS are not end-to-end encrypted, and copies can exist on devices and with messaging providers.

If you suspect unauthorized account access, contact admin@buildingoro.ca. We will provide breach notifications where required by applicable law.

10. Your privacy choices

You can ask to access or correct your personal information, request deletion, withdraw consent where applicable, or raise a complaint by contacting us. We may need to verify your identity. We will respond within the timeframe required by applicable law and explain any permitted restriction or extension.

Some information is needed to provide texting and personalized styling; withdrawing permission to process it can prevent us from providing those features. Withdrawal does not make prior lawful processing unlawful.

Your rights depend on the laws that apply to you. Canadian users may contact the Office of the Privacy Commissioner of Canada or an applicable provincial regulator if a concern remains unresolved.

11. Age and eligibility

Oro’s texting service is for people aged 16 and older. If you believe a person under 16 has provided information to us, please contact admin@buildingoro.ca so we can investigate and take appropriate action.

12. Changes to this policy

We will date revised policies and give affected users at least 14 days’ notice of material changes through a text, email, or another appropriate direct notice. Where a change requires fresh consent, we will request it before making that change for you. This policy does not retroactively authorize a new use of information collected under an earlier policy.