Sign inCreate an account

Privacy policy

Last updated: August 18, 2026.

In the following we explain how Orintis processes personal data when you visit our website and use the Orintis web app. Personal data is any data that can be related to a specific natural person, such as your name, email address, or IP address.

Orintis is currently in a Beta Testing Phase. We are a small team. We do not sell your data. We only collect what we need to provide the service, and you can delete your account and your data at any time yourself, directly in the app under Settings. By using Orintis you acknowledge that we are in active development.

1. General information

1.1. Controller

The controller within the meaning of Art. 4 para. 7 EU General Data Protection Regulation (GDPR) is Orintis, founded by Carlotta Clauter, Berlin, Germany. Email: support@orintis.com. Full legal entity details are listed in our Imprint.

1.2. Data protection officer

Orintis has not appointed a separate data protection officer at this stage. Privacy questions can be directed to support@orintis.com.

1.3. Legal bases for processing

We rely on the following legal bases under Art. 6 para. 1 GDPR:

  • Art. 6 para. 1 s. 1 lit. a GDPR (consent) for optional processing, for example AI-powered features you choose to use.
  • Art. 6 para. 1 s. 1 lit. b GDPR (performance of a contract) for processing necessary to provide your account, store your content, and deliver the service you signed up for.
  • Art. 6 para. 1 s. 1 lit. c GDPR (legal obligation) where we are required to retain data, for example for tax or commercial law reasons.
  • Art. 6 para. 1 s. 1 lit. f GDPR (legitimate interests) to operate, secure, and improve the service, including basic server logs and abuse prevention.

1.4. Data transfers outside the EEA

Some of our service providers are based outside the European Economic Area (EEA), or process data in the United States. In those cases the security of the transfer is ensured either by an adequacy decision of the EU Commission under Art. 45 para. 3 GDPR (for example under the EU US Data Privacy Framework), or by standard contractual clauses adopted by the EU Commission under Art. 46 para. 2 lit. c GDPR. We list the relevant providers in section 3.

1.5. Storage duration

Unless stated otherwise in this policy, we store personal data only for as long as it is needed for the purpose for which it was collected, or as long as we are legally required to keep it.

When you delete your account (Settings, "Delete account"), the deletion runs immediately: your account, your portfolio and public page, your uploaded media, your diary entries, goals, and salary history are permanently deleted, and any agent access tokens you issued stop working. There is no grace period and no way to restore a deleted account. What remains afterwards:

  • Anonymous aggregate statistics (for example, total page view counts) that no longer reference you and cannot be traced back to you.
  • Your former username stays permanently retired, so an old link to your public page can never lead to a different person.
  • Backups and log entries may persist for a limited period until they are rotated.

1.6. Your rights as a data subject

You have the following rights with respect to your personal data:

  • Right of access (Art. 15 GDPR);
  • Right to rectification (Art. 16 GDPR);
  • Right to erasure / "right to be forgotten" (Art. 17 GDPR);
  • Right to restriction of processing (Art. 18 GDPR);
  • Right to data portability (Art. 20 GDPR);
  • Right to object to processing based on legitimate interests (Art. 21 GDPR);
  • Right to withdraw consent at any time, with effect for the future (Art. 7 para. 3 GDPR).

You can exercise your right to erasure yourself at any time: open Settings in the app and choose "Delete account". Section 1.5 describes what deletion covers. For the other rights, or if you prefer to request erasure by email, contact us at support@orintis.com. You also have the right to lodge a complaint with a data protection supervisory authority. A list of German supervisory authorities is available at bfdi.bund.de.

1.7. Obligation to provide data

Within the scope of your use of the service, some data is required to create and maintain your account (for example your email address and password). Without this data we cannot provide the service. Optional data, such as the content of your portfolio, diary entries, or CV, is voluntary; the service may be less useful without it.

1.8. No automated individual decision-making

We do not use solely automated decision-making with legal or similarly significant effect within the meaning of Art. 22 GDPR. Our AI-powered features generate suggestions and draft text only; you remain in control of what to keep, change, or discard.

2. Data we process

2.1. Account and authentication

When you create an account we process your first name, last name, email address, and password (stored as a salted hash by our authentication provider). We use this data to operate your account, authenticate you, and contact you about the service. Legal basis: Art. 6 para. 1 s. 1 lit. b GDPR.

2.2. Portfolio and career content

Orintis is a tool for tracking personal and professional growth. As part of using the service you may enter or upload content such as:

  • Portfolio information (name, role, location, contact email, optional avatar);
  • Career direction, personal goals, and team or company goals;
  • Diary entries, including free-text reflections, mood, and impact notes;
  • Portfolio data (headline, vision statements, skills, work experience, education, languages, references, projects, interests);
  • CV uploads and the text extracted from them;
  • Intro videos you record or upload;
  • AI-generated reports and drafts (performance, team update, role negotiation, career guidance).

This content belongs to you. We process it to operate the service for you, store it, and make it available to you. Legal basis: Art. 6 para. 1 s. 1 lit. b GDPR.

2.3. Technical data and server logs

When you visit our service we collect technical information that your browser transmits for security and stability purposes, including IP address, date and time of request, requested URL, HTTP status, browser type and version, and operating system. This data is kept in server logs for a limited period and then deleted. Legal basis: Art. 6 para. 1 s. 1 lit. f GDPR (legitimate interest in operating a secure service).

2.4. Cookies and session storage

We use first-party cookies and similar local storage only as needed to keep you signed in and to operate the service (for example to remember your authentication session). We do not use advertising, profiling, or third-party tracking cookies. Legal basis for strictly necessary cookies: Section 25 para. 2 no. 2 TDDDG (Telekommunikation-Digitale-Dienste- Datenschutz-Gesetz) and Art. 6 para. 1 s. 1 lit. f GDPR.

3. Service providers (processors)

We use a small number of service providers to operate Orintis. Each acts as a processor on our behalf within the meaning of Art. 28 GDPR, under a data processing agreement.

3.1. Hosting and content delivery

Application compute runs on Contabo GmbH, Aschauer Str. 32a, 81549 Munich, Germany, in EU data centres (provider privacy policy: contabo.com/legal/privacy-policy). Static assets, DNS, and edge caching are delivered through Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (provider privacy policy: cloudflare.com/privacypolicy). The providers process content, usage, and meta/communication data necessary to deliver the application. Legal basis: Art. 6 para. 1 s. 1 lit. f GDPR. For transfers to the USA we rely on the EU US Data Privacy Framework or, where applicable, on standard contractual clauses.

3.2. Database, authentication, and file storage

Account data, portfolio and career content, and uploaded files (avatars, intro videos, CVs) are stored using Supabase, operated by Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992 (provider privacy policy: supabase.com/privacy). The underlying infrastructure runs in EU data centres where available. Legal basis: Art. 6 para. 1 s. 1 lit. b GDPR.

3.3. Transactional and lifecycle email

We send service-related email (account confirmations, password notifications, and lifecycle reminders such as onboarding follow-ups) through Resend, operated by Resend Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA (provider privacy policy: resend.com/legal/privacy-policy). To deliver these emails we share your email address, name, and the content of the message with Resend, together with technical delivery metadata (open and click events for lifecycle campaigns). Legal basis: Art. 6 para. 1 s. 1 lit. b GDPR (transactional email) and Art. 6 para. 1 s. 1 lit. f GDPR (lifecycle and reactivation email). You can opt out of lifecycle email at any time via the unsubscribe link in each message. For transfers to the USA we rely on the EU US Data Privacy Framework or, where applicable, on standard contractual clauses.

3.4. AI-powered features

Some features in Orintis (for example portfolio review, performance review, role negotiation drafts, team update drafts, or goal suggestions) are built on top of the Vercel AI SDK. We use AI providers located in the United States and Europe only, selected per feature based on performance for the use case. When you use one of these features, the relevant context you provided is sent to the chosen provider to generate a response. Legal basis: Art. 6 para. 1 s. 1 lit. b GDPR. For transfers to the USA we rely on the EU US Data Privacy Framework or, where applicable, on standard contractual clauses.

4. Security

We use industry-standard security measures, including encryption in transit (TLS) and at rest, scoped access controls, and row-level security to keep your data restricted to your account. Because Orintis is in a Beta Testing Phase, we do not recommend storing highly sensitive personal information (such as medical records or financial credentials) on the platform. We accept no liability for data loss arising from the experimental nature of the beta software beyond what is set out in our Terms of service.

5. Reporting content

If you see content on Orintis that should not be here, you can tell us using our content report form, whether or not you have an account. We store what you send us (the category, your description, and the portfolio concerned) together with your name and email address, so that we can look into the report and come back to you about it. Legal basis: Art. 6 para. 1 s. 1 lit. c and lit. f GDPR (our obligations under the Digital Services Act, and our legitimate interest in keeping the service free of abusive content). Reports of child sexual abuse material are the exception: you do not have to give us your name or your email address to file one, and if you do not, we store neither (Art. 16 para. 2 lit. c Digital Services Act). We then have no way to reply to you.

To stop automated systems flooding the form, we also store a one-way cryptographic hash of the IP address the report was sent from. It cannot be turned back into an address, it is used only to limit how many reports one sender can file in an hour, and it is erased after 30 days. We send no automated email in response to a report; any reply comes from a person.

6. Changes to this policy

We will update this policy as the service evolves. Where the changes are material we will notify you in the application or by email to the address associated with your account before the changes take effect.