The short version
We limit collection to information needed to respond to inquiries, schedule calls, operate and secure the site, measure performance, and deliver requested services. Optional analytics and website journey tracking are disabled for visits detected in the European Union or California. For other or unknown locations, analytics is enabled by default and may be turned off at any time. Saved opt-outs and Global Privacy Control keep optional analytics off. We do not sell personal information for money. Where enabled through Cookie choices, we use advertising measurement and audience technologies described below.
01
Scope and who we are
This Privacy Policy applies to the Orathis website, including orathis.ai, and to information we receive when you contact us, request an audit, schedule a call, or otherwise interact with our business.
In this policy, “Orathis,” “we,” “us,” and “our” refer to the business operating under the Orathis name and providing answer engine optimization strategy, content, technical implementation, measurement, and related services. Orathis operates this site from the United States.
Orathis is the controller of personal information when we decide why and how it is processed. When we process information solely on a client’s instructions, the applicable client agreement governs that processing.
02
Information we collect
Information you provide
We may collect your name, business email address, optional business phone number, company name or website, business street address, annual business revenue range, industry, how you heard about Orathis, project goals, message content, meeting preferences, and other information you choose to provide. We use campaign qualification answers to evaluate a request and prepare the requested roadmap or consultation. Please do not submit sensitive personal information, passwords, payment-card details, government identifiers, health information, or confidential third-party data through the website.
Information collected automatically
When you visit the site, our hosting, content-delivery, and security providers may process technical information such as your IP address, browser and device type, operating system, referring page, requested pages or URLs, approximate location derived from an IP address, timestamps, and diagnostic or security logs.
When analytics is active—by default outside detected EU or California visits unless you opt out—Google Analytics and PostHog measure page views, referring sources and campaigns, general device and browser characteristics, approximate geography, engagement, calls-to-action, strategy-brief progress, scheduling or booking events, web performance, and how visitors move through public pages. PostHog may also provide heatmaps and session replays. Vercel Speed Insights measures aggregate Core Web Vitals by sanitized public route. We configure these tools not to include names, email addresses, company websites, message text, booking identifiers, URL query strings, or other form contents. When the separate advertising choice is enabled, configured Google Ads, Meta, LinkedIn, and Microsoft tags may receive page, pricing, inquiry, and booking signals plus their own cookie or click identifiers for measurement and audience targeting.
Optional inquiry and customer journey measurement
When our inquiry tracking feature is enabled, we securely save submitted contact details to respond to your request. For new inquiries, while analytics is allowed, we automatically associate the inquiry with this browser's retained past and future permitted website activity, sources, and campaigns. You can disable this through Cookie choices in the footer. Turning analytics off stops new tracking, removes the linked browser history from our active journey records, and unlinks affected inquiries; we retain the inquiry itself to handle your request. We do not backfill previously unlinked inquiries or merge person identities across browsers or devices. We use a private record to connect inquiries, confirmed bookings, and customer or payment outcomes from connected systems. Contact details, messages, booking identifiers, and payment records are not sent to Google Analytics, PostHog, or Vercel Speed Insights. Submitting a form or booking does not verify an email address, and shared-browser activity may overlap.
We group inquiries by their submitted company website. For activity collected under our company-matching notice, while analytics is allowed, we may use a keyed network token to associate visits from other browsers with that company. Only network observations near an inquiry and matching visits within seven days are eligible. These are low-confidence inferences, not verified person or company identities: offices, shared connections, VPNs, and service providers can share addresses. We exclude conflicting company matches, do not use browser fingerprinting, and do not use inferred visits as confirmed conversions, revenue, or advertising exports. Turning analytics off removes this browser's events and its inferred associations; withdrawing an inquiry-linked browser also removes its network evidence for other matches. Earlier network observations are not retroactively used for this matching.
You can turn analytics off before submitting and still send an inquiry or book without linking visit history. Submitting does not subscribe you to marketing messages. Withdrawal requests are retried if delivery fails; backups and third-party copies follow their separate retention and deletion processes. Contact us to request access or deletion.
Information stored in your browser
The site uses session storage to carry your strategy-brief details between the contact and scheduling steps, to maintain a rolling visit identifier, and to support interface behavior. We use local storage and first-party cookies to remember analytics and advertising choices and, while enabled, to recognize a browser across visits.
When inquiry tracking is enabled and analytics is allowed, a random browser identifier can remain for up to 90 days and a session identifier uses a 30-minute inactivity boundary. A company-bound one-way network correlation token derived from the request IP may accompany permitted events; the raw IP is not placed in the journey ledger. Private journey events are retained for up to 90 days; inactive inquiry and outcome copies for up to 24 months. A temporary signed inquiry receipt supports booking attribution for up to seven days. Limited keyed deletion markers can remain for up to 24 months to prevent known retries recreating deleted records. Original accounting records follow their separate retention requirements.
Information from other sources
If you become a client or business contact, we may also receive professional information from your colleagues, referrals, your organization, public business sources, and service providers used to support the relationship.
03
How we use information
We may use personal information to:
- respond to inquiries and communicate with you;
- prepare for, schedule, and conduct strategy calls;
- evaluate potential engagements and provide requested services;
- operate, maintain, secure, troubleshoot, and improve the website;
- measure traffic sources, content engagement, and conversion paths while analytics is active;
- protect against fraud, abuse, security incidents, and unlawful activity;
- maintain business records and enforce our agreements; and
- comply with legal obligations and resolve disputes.
04
Legal bases for processing
Where a law requires a legal basis, we rely on one or more of the following:
- Steps at your request or contract. To respond to a requested proposal, schedule a call, or provide contracted services.
- Legitimate interests. To operate and secure the site, communicate with business contacts, improve our services, prevent misuse, and maintain appropriate records, where those interests are not overridden by your rights.
- Consent. Where required for optional communications, non-essential tracking, or processing that cannot rely on another basis. You may withdraw consent prospectively.
- Legal obligations and rights. To comply with law and to establish, exercise, or defend legal claims.
We do not use website information for solely automated decisions that produce legal or similarly significant effects.
07
Retention and security
We keep personal information only as long as reasonably necessary for the purpose collected, taking account of legal, accounting, security, dispute, and contractual needs:
- Browser session data. Strategy-brief details and interface state in session storage generally remain until the browser session ends or you clear them.
- Inquiries and prospective-client records. Generally retained for up to 24 months after the last substantive interaction, then deleted or anonymized unless a longer period is reasonably needed.
- Client and transaction records. Retained during the relationship and afterward for applicable accounting, tax, contractual, limitation-period, and legal requirements; core business records are typically kept no longer than seven years.
- Technical and security logs. Retained according to the relevant provider’s schedule and only as needed for operations, security, fraud prevention, and incident investigation.
- Analytics event, replay, and performance data. While analytics is active, Google Analytics event and user-level data is configured for retention for up to 14 months; aggregated reporting may remain available longer. PostHog event and session-replay data follows the retention controls configured for the Orathis project. Vercel Speed Insights data follows the retention controls of the Orathis Vercel project. Each dataset is reviewed for deletion or anonymization when no longer reasonably needed.
- Rights and legal records. Retained as needed to fulfill, document, and defend the request or legal matter.
We use reasonable administrative, technical, and organizational safeguards designed to protect personal information, including limiting access and using service providers with appropriate security practices. We assess incidents and make legally required notifications. No online service, transmission, or storage system can be guaranteed completely secure.
08
Your privacy rights
Depending on where you live and subject to applicable exceptions, you may have the right to request access to, correction of, deletion of, or a portable copy of your personal information. You may also have rights to restrict or object to certain processing, withdraw consent, appeal a denied request, or lodge a complaint with a data-protection authority.
We will not discriminate against you for exercising an applicable privacy right. We may need to verify your identity and authority before completing a request. Authorized agents may submit requests where permitted by law, subject to verification.
To exercise a privacy right, email support@orathis.ai with the subject line “Privacy Request” and describe your request and your relationship with Orathis. We will confirm receipt and respond within the period required by applicable law. If we deny a request and local law provides an appeal right, reply with “Privacy Appeal” in the subject line and explain why you believe the decision should be reconsidered.
Additional U.S. state disclosures
Depending on applicable law, the categories described in this policy may include identifiers, internet or network activity, professional information, commercial or inquiry records, approximate geolocation derived from IP address, and inferences drawn to understand a business need. Sources, purposes, and recipient categories are described above. When advertising is enabled, some of these categories may be disclosed to advertising providers for audience targeting and measurement, activity that some laws define as sharing or targeted advertising. Cookie choices and Global Privacy Control provide the controls described above. We do not use sensitive personal information to infer characteristics about you.
09
Children’s privacy
The website and our services are intended for business audiences and are not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided information to us, please contact us so we can take appropriate action.
10
International data transfers
The website is operated from the United States. Orathis and its service providers may process information in the United States and other countries where privacy laws may differ from those where you live. Where applicable law requires a safeguard for an international transfer, we will use an available lawful mechanism before making that transfer, such as an adequacy decision, approved contractual safeguards, or a permitted exception.
11
Changes to this policy
We may update this policy as our practices, services, and legal obligations change. The effective date at the top of the page shows when it was last revised. We will not begin a materially different use of previously collected information without providing notice and obtaining consent where required. If a change is material, we may also provide notice on the site or directly to affected people.
12
Contact us
Questions, concerns, and privacy requests can be sent to:
support@orathis.ai