Privacy Policy

Last updated: June 2026

This Privacy Policy explains how Ora Group ("Ora OS", "we", "us") collects, uses, and protects information when you use the Ora OS Coffee web application and the Ora OS mobile application (together, the "Service"). Ora OS is business software used by coffee companies to run their operations. We treat your business data as confidential and never sell it.

1. Who this applies to

Ora OS is provided to organizations (our customers) and accessed by their authorized users (employees and staff). If you use Ora OS as part of your work for an organization, that organization controls your account and its data, and this policy operates alongside any agreement between us and that organization.

2. Information we collect

Account information

Your name, email address, role, and the organization you belong to.
Authentication data needed to sign you in securely (handled by our authentication provider).

Business data you enter

Operational records you create in the app, such as purchases, suppliers, inventory, quality-control results, contracts, dispatches, and approvals.
Documents and photos you upload or capture, such as certificates, weighbridge tickets, lab sheets, and loading photos.
Notes and comments you add to records.

Technical information

Basic device and app information (app version, device type, operating system) used to operate and improve the Service and to diagnose errors.

We do not use advertising trackers, and we do not sell or rent your personal or business information to anyone.

3. Camera, photos, and files

The mobile app can request access to your camera, photo library, and files so you can attach documents and photos to your business records (for example, photographing a weighbridge ticket or a loading confirmation). These features are used only when you choose to add an attachment. We access a photo or file only when you select it; we do not scan or upload your photo library in the background.

4. How we use information

To provide the Service and its features to you and your organization.
To authenticate you and keep your account secure.
To store and display the records, documents, and photos you create.
To enforce role-based permissions so users only see what they are authorized to see.
To diagnose problems, maintain reliability, and improve the Service.
To communicate with you about service updates, security, and support.

5. How information is shared

We share information only as needed to run the Service:

Within your organization: your records are visible to authorized users in your own organization, according to their role. Data is isolated so that organizations cannot see one another's information.
Service providers: we use trusted infrastructure providers to host the application and store data and files (including Supabase for our database, authentication, and file storage, and our cloud hosting provider). These providers process data on our behalf under their own security and privacy commitments.
Legal reasons: we may disclose information if required by law or to protect the rights, safety, and security of users and the Service.

6. Data storage and security

Your data is stored on secured cloud infrastructure. Access is protected by authentication and row-level security rules that restrict each user to their own organization's data and role. Connections are encrypted in transit. On mobile, your sign-in session is stored in the device's secure keychain/keystore. While no system can be guaranteed perfectly secure, we take reasonable technical and organizational measures to protect your information.

7. Data retention

We retain business records for as long as your organization's account is active or as needed to provide the Service. Your organization may request export or deletion of its data. When data is deleted, it is removed from active systems and from backups in the normal backup cycle.

8. Your rights and choices

Access and correction: you can view and update much of your information directly in the app, or request help from your organization's administrator.
Deletion: you may request deletion of your account and associated personal data (see below).
Permissions: you can grant or revoke camera, photos, and notification permissions at any time in your device settings.

Account deletion

To delete your account and associated personal data, email support@oraos.io from your account email address with the subject "Account deletion". We will verify the request and delete your account, subject to any records your organization is legally required to retain. We aim to action requests within 30 days.

9. Children

Ora OS is business software intended for use by adults in a workplace. It is not directed to children, and we do not knowingly collect personal information from anyone under 16.

10. International users

Ora OS serves customers in Uganda and other regions. Your information may be processed and stored on servers located in regions operated by our infrastructure providers. By using the Service, you understand that your information may be transferred to and processed in those locations.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you within the Service.

12. Contact us

If you have questions about this Privacy Policy or how your information is handled, contact us at support@oraos.io.