Legal

Privacy policy

Last updated: 9 October 2026

1. Who is responsible

The controller within the meaning of the EU General Data Protection Regulation (GDPR) is:

We are not required to appoint a data protection officer and have not appointed one.

2. The short version

This website sets no cookies, uses no analytics or tracking, embeds no third-party content (no videos, maps or external fonts), and has no forms. Personal data is processed only (a) technically, when your browser loads the page, and (b) if you choose to email us.

3. Visiting this website (hosting)

This website is hosted with Amazon Web Services: the files are stored in the AWS region Europe (Stockholm), and delivered through the content delivery network Amazon CloudFront, which serves the page from a server location close to you.

To deliver the page, your IP address, the date and time of the request, the requested file, and technical information sent by your browser (such as browser type) are necessarily processed. Without this, the website cannot be displayed.

We do not store access logs. This data is processed only transiently, for the delivery of the page.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure and reliable delivery of this website. Amazon Web Services processes this data on our behalf under a data processing agreement (Art. 28 GDPR). Our contracting party is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg.

4. Contacting us by email

The “Request access” button and other links on this site open your own email program. If you email us, we receive your email address, your name (if included) and the content of your message, together with the usual technical email data.

We use this data only to answer you and, if you ask for access to the Oronai beta, to handle your request.

Legal basis: Art. 6(1)(b) GDPR where your message concerns access to the beta (steps taken at your request before a possible contract), otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries).

We delete your emails once they are no longer needed for these purposes, unless statutory retention obligations require us to keep them.

Our email is hosted by Google Workspace, which processes it on our behalf under a data processing agreement (Art. 28 GDPR). Our contracting party is Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland.

You are not obliged to email us; without your email, however, we cannot reply.

5. Transfers outside the EU/EEA

Amazon Web Services and Google are part of groups headquartered in the United States, and Amazon CloudFront operates server locations worldwide. Personal data may therefore be processed outside the EU/EEA, including in the United States. Such transfers rely on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR), for companies certified under it, and on the European Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR), which are part of the providers’ data processing agreements.

6. Your rights

You have the right to access your personal data (Art. 15 GDPR), to have it corrected (Art. 16), erased (Art. 17) or its processing restricted (Art. 18), and to data portability (Art. 20).

Right to object (Art. 21 GDPR): where we process your data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation.

To exercise these rights, email contact@oronai.de.

7. Right to lodge a complaint

You may complain to a data protection supervisory authority, in particular in the EU member state of your habitual residence, place of work, or of the alleged infringement. The authority responsible for us is:
Der Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany

8. No automated decision-making

We do not use automated decision-making or profiling.

9. Changes

We will update this policy if the website changes, for example if we add new features.