Privacy Policy

Orem is a brand-visibility monitoring service. It measures how often AI answer engines — such as ChatGPT, Perplexity and Google AI Overviews — mention a brand in response to buyer-intent questions, and tracks that over time against competitors.

For the purposes of data-protection law, Orem is the data controller for account information, and a data processor for the workspace content you enter (brands, prompts, competitors).

Information you give us

• Account details — your name, email address, and a password. Passwords are stored only as a scrypt hash with a per-user random salt; we never store or transmit the password itself.
• Organisation details — your company or agency name.
• Workspace content — the brand names, domains, competitor names and prompts you choose to track, and any brand facts you add.
• Billing details — if you subscribe, we record which plan, the amount, and the gateway's transaction reference. We never see or store your card number, expiry or CVV — payment is completed on the payment provider's own hosted page.
• Support and enquiry content — anything you send us through a contact, demo-booking or careers form.

Information collected automatically

• Session data — a session identifier stored in a cookie (web) or the device keychain (mobile), so you stay signed in.
• Technical data — IP address and request metadata in ordinary server logs, used to operate and secure the service, including rate-limiting sign-in attempts.
• Usage records — how many measurement samples your workspace consumes, to enforce plan limits.

The mobile apps do not use advertising identifiers, do not track you across other companies' apps or websites, and contain no third-party analytics or advertising SDKs.

Information from services you connect

If you choose to connect Google Analytics, Google Search Console, X, Facebook or Reddit, we store an access token for that service and read only the data needed for the feature you enabled. You can disconnect at any time, which deletes the stored token. Tokens are encrypted at rest with AES-256-GCM.

• To provide the service — running measurements, producing reports and alerts.
• To authenticate you and keep your account secure.
• To send service messages: sign-up confirmation, password resets, alerts you configured, and renewal reminders.
• To enforce plan limits and take payment.
• To meet legal obligations, and to investigate abuse or security incidents.

We do not sell personal information, and we do not use it for advertising. We do not use your workspace content to train AI models.

• Contract — providing the service you signed up for.
• Legitimate interests — securing the service, preventing abuse, and improving reliability.
• Legal obligation — accounting and tax records.
• Consent — where you connect an optional third-party integration, withdrawable at any time by disconnecting it.

We share personal information only with service providers who process it on our behalf, under contract, for the purposes below.

• Hosting — Amazon Web Services (United States). Runs the application and database.
• AI answer engines — OpenAI, Anthropic, Google and Perplexity. They receive the prompts you choose to track, which are questions about brands, not personal information about you.
• Search data — DataForSEO, for search-visibility measurement.
• Email — Zoho, to deliver transactional email.
• Payments — PayFast, which handles card details directly; we receive only the outcome and a transaction reference.
• Integrations you enable — Google, X, Facebook or Reddit, only where you connect them.

We may also disclose information where required by law, or to protect the rights and safety of Orem, our users, or the public. If Orem is involved in a merger or acquisition, information may transfer as part of that transaction; we would notify you first.

Our servers are in the United States, and several sub-processors operate globally. If you are in the UK, EEA or another region with data-transfer rules, your information may be processed outside your country. Where required, transfers rely on standard contractual clauses or an equivalent safeguard.

• Account and workspace data — for as long as your account is open.
• After deletion — deleting your account removes your workspaces, prompts, measurement history, competitors and connected-service tokens. Backups are kept for up to 30 days, after which they expire automatically.
• Sessions — expire after 30 days; expired records are purged daily.
• Password reset links — expire after one hour and can be used once.
• Billing records — retained as long as tax law requires, typically seven years.

You can ask us to:

• give you a copy of your personal information;
• correct anything inaccurate — most of it is editable in Settings;
• delete your account and its data;
• restrict or object to certain processing;
• export your data in a portable format.

Email help@getorem.com and we will respond within 30 days. You may also complain to your local data-protection authority.

Deleting your account. Email help@getorem.com from your registered address with the subject “Delete my account”. We action it within 30 days.

• All traffic is encrypted in transit with TLS.
• Passwords are hashed with scrypt and a per-user salt.
• Third-party tokens are encrypted at rest with AES-256-GCM.
• Mobile session credentials are held in the iOS Keychain or Android EncryptedSharedPreferences, never in plain storage.
• Access tokens are short-lived and rotate; signing out revokes them immediately.
• Sign-in attempts are rate-limited per account and per network address.

No system is perfectly secure. If we discover a breach affecting your personal information, we will notify you and the relevant regulator as the law requires.

Orem is a business tool and is not directed at children. We do not knowingly collect information from anyone under 16. If you believe a child has given us information, contact us and we will delete it.

If we change this policy we will update the date above, and for material changes we will notify you by email or in the app before they take effect.

Questions about this policy or your data: help@getorem.com