Privacy Policy

1. Who we are

OREoS ("OREoS," "we," "us") is an AI marketing operating system that helps businesses generate, schedule, publish, and measure social media content. This policy explains what data we collect when you use OREoS, why we collect it, and how you can control it.

2. Data we collect

• Account data: name, email address, and authentication identifiers when you sign up with email/password or Google OAuth.
• Business data you provide: your website URL, brand information, product catalog, and media you upload.
• Connected social accounts: OAuth tokens for platforms you connect are held by our publishing provider, Postproxy. OREoS does not see or store your raw platform passwords.
• Content and usage data: drafts, scheduled posts, AI generation requests, and the resulting performance metrics from your published content.
• Technical data: log data, device/browser information, and cookies necessary to keep you signed in.

3. How we use your data

We use your data to operate OREoS: to authenticate you, generate and schedule content on your behalf, publish to the social accounts you connect, ingest analytics for your dashboard, and improve the product. We do not sell your personal data.

4. Google user data

If you sign in with Google, OREoS requests only your basic profile scopes (name, email, profile picture) to create and authenticate your account. OREoS's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Third-party processors

OREoS relies on the following processors to operate the service:

• Supabase: database, authentication, and file storage.
• Postproxy: social account connections, publishing, and analytics.
• Resend: transactional email (verification, password reset, notifications).
• Firecrawl: extracting public brand/product information from a URL you provide.
• Google Gemini (via Vercel AI Gateway): AI-generated content and images.
• Vercel: application hosting.

6. Data retention and deletion

We retain your data for as long as your account is active. You can request deletion of your account and associated data at any time by contacting us; we will delete or anonymize your data within a reasonable period, except where retention is required by law.

7. Your rights

Depending on your location, you may have the right to access, correct, export, or delete your personal data, and to withdraw consent (including revoking Google account access at any time via your Google Account permissions).

8. Contact

Questions about this policy? Contact us at the support address listed in your account settings.