Login

Privacy Policy

Last updated: September 2026

1. Introduction

Orato ("we," "us," or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI voice agent platform and our marketing website at tryorato.com (including the public demo call experience).

Please read this policy carefully. By using Orato, you consent to the practices described herein.

2. Information We Collect

2.1 Account Information

  • Name, email address, phone number
  • Company name and business information
  • Billing and payment details
  • Account credentials

2.2 Call Data

  • Call recordings and transcripts (when recording is enabled for your workspace)
  • Phone numbers of call participants
  • Call duration, timestamps, and metadata
  • AI-generated analysis and insights

2.3 Lead and Contact Data

  • Contact information you upload (names, phone numbers, emails)
  • Lead status and qualification data
  • Campaign and engagement history

2.4 Usage Data

  • Device and browser information
  • IP address and location data (stored in hashed form for guest demo traffic)
  • Usage patterns and preferences
  • Log data and analytics

2.5 Marketing site and guest demo call

If you use the public demo call widget on our marketing site, we may process the following in addition to the categories above:

  • Guest identity cookies: orato_guest (HttpOnly) and orato_guest_csrf, typically retained for up to 180 days by default, used to recognize returning demo visitors and protect session refresh
  • Short-lived access token: a guest JWT held in browser memory (not localStorage) to authorize demo API requests, typically about 30 minutes
  • Session correlation: a tab-scoped sessionStorage value (orato_guest_browser_session) used with first-party activity beacons
  • Marketing attribution: landing path, referrer, and UTM parameters when a guest session is created
  • Demo phone number: the mobile number you submit for an outbound demo call (E.164), stored with the call record and, today, also on the guest identity for admin support and abuse controls
  • Activity events: first-party events such as page views in the demo funnel, CTA clicks, and call lifecycle signals (default retention about 365 days)
  • Optional CAPTCHA: if enabled, a Cloudflare Turnstile token is sent to verify you are human before dialing

Guest cookies and a guest identity are created when you submit the demo form (after consent), not merely by loading the page. Demo call recording defaults to off unless we explicitly enable it.

3. How We Use Your Information

We use collected information to:

  • Provide and maintain the Orato platform
  • Process calls and generate transcripts/analytics
  • Improve our AI models and service quality
  • Process payments and manage subscriptions
  • Send service updates and support communications
  • Ensure compliance and prevent fraud and abuse (including demo quotas and rate limits)
  • Operate the marketing-site demo call and measure funnel interest
  • Optionally link a prior demo guest session to your Orato account when you register (and, if enabled, on login or phone match)
  • Respond to legal requests and prevent harm

3.1 Enquiry communications (calls, SMS, and WhatsApp)

When you book a demo or send us a message through our contact forms and agree to the opt-in, you authorize Orato to contact you about your enquiry by phone call, SMS, and WhatsApp. The consent language shown on those forms is:

"I agree to receive calls, SMS and WhatsApp messages from Orato about my enquiry."

We use the details you provide (such as name, phone number, email, and company) only to follow up on your enquiry, schedule or confirm demos, and answer related product questions. You can opt out of further marketing messages at any time by replying STOP where available, or by emailing privacy@tryorato.com.

4. Data Sharing and Disclosure

We do not sell your personal data. We may share information with:

  • Service Providers: Third parties who help us operate our platform (hosting, databases, payment processing, analytics, CAPTCHA, and telephony carriers used to place demo or product calls)
  • Integrations: CRM and business tools you choose to connect
  • Legal Requirements: When required by law or to protect rights and safety
  • Business Transfers: In connection with mergers, acquisitions, or asset sales

Platform administrators at Orato may access guest demo records (including submitted demo phone numbers) to operate, support, and secure the demo experience.

5. Data Retention

We retain your data for as long as necessary to provide our services and fulfill the purposes described in this policy. Specifically:

  • Account data: Retained while your account is active
  • Call recordings: Retained based on your plan settings (default: 90 days)
  • Analytics data: Retained for up to 2 years
  • Billing records: Retained for 7 years for legal compliance
  • Guest demo cookies: default up to 180 days
  • Guest demo identity, activity, and demo call records: default up to 365 days (subject to operational erasure requests)

6. Your Privacy Rights

Depending on your location (including India and other jurisdictions), you may have the following rights:

  • Access: Request a copy of your personal data
  • Correction: Request correction of inaccurate data
  • Deletion: Request deletion of your personal data
  • Portability: Request your data in a portable format
  • Opt-out: Opt out of marketing communications
  • Restrict Processing: Request limitation of data processing

To exercise these rights, including guest demo data subject requests, contact us at privacy@tryorato.com. We also operate internal erasure procedures for guest identities when appropriate.

If you used the public demo call on this device, you can delete that guest demo data associated with your current browser session:

6A. California / GPC (Do Not Sell or Share)

We do not sell personal information for money. Marketing tags (including Google Analytics and Google Ads) load with Consent Mode storage granted by default so we can measure site and ad performance, unless the build sets NEXT_PUBLIC_GUEST_ANALYTICS_MODE=off. If your browser sends a Global Privacy Control (GPC) signal, or you want a formal Do Not Sell or Share request, email privacy@tryorato.com.

7. Data Security

We implement industry-standard security measures including encryption in transit and at rest, access controls, regular security audits, and secure data centers. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

8. International Transfers

Your data may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place, including Standard Contractual Clauses for transfers to countries without adequacy decisions.

9. Children's Privacy

Orato is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected data from a child, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through our platform. Your continued use of Orato after changes indicates acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

Privacy: privacy@tryorato.com
Support: support@tryorato.com
Address: Orato, Floor 21, Metropolis Tower, 57 Marasi Drive, Business Bay, Dubai, United Arab Emirates

Orato - Privacy Policy | Orato