Privacy Policy

Last updated: 2026-04-22

This Privacy Policy explains how Orit ("we", "us", "Orit") collects, uses, stores, and shares information when you use the service at orit.appor any related API or browser extension (together, the "Service"). By using the Service, you agree to this Policy.

1. Information we collect

Information you provide

  • Account data: email address, name (optional), and password (stored as an argon2 hash).
  • Payment data: when you purchase credits, billing is handled by Stripe. We do not see or store your full card number. We store a Stripe customer ID and metadata about your purchases (amount, plan, date).
  • Search queries: the domains, names, or emails you look up. We retain these so you can see your history, avoid paying twice for the same domain, and we can improve quality.
  • Feedback: anything you submit via our feedback form or send to [email protected].
  • Contacts you save: any contacts you add to your private My Contacts list, including custom notes, tags, and segments.

Information we collect automatically

  • Usage data: IP address, user agent, request timestamps, and endpoints you access. Used for rate limiting, abuse prevention, and debugging.
  • Session cookie: a short-lived token that keeps you signed in. Does not track you across other sites.

Information Orit extracts from public sources

Orit extracts contact information from pages that are publicly accessible (visitable by a logged-out browser) - for example, a company's team page, about page, or public social profile. We only extract information that is intentionally public. We do not scrape login-walled pages. We attach a source URL to each extraction so you can verify its public nature.

2. How we use information

  • Provide, operate, and improve the Service.
  • Process payments and manage credits.
  • Communicate about your account, transactions, and important updates.
  • Detect abuse, rate-limit bad traffic, and enforce the Terms of Service.
  • Legal compliance: respond to lawful requests, enforce agreements.

We do not sell your personal data to third parties.

3. Sharing with third parties

We share data only with the sub-processors that power the Service:

  • Stripe — payment processing.
  • Cloudflare — DNS, CDN, and DDoS protection.
  • Google reCAPTCHA — bot protection on signup and login.
  • Hetzner — hosting provider (EU / Germany data center).
  • Transactional email provider — account emails, password resets.

Each sub-processor receives only the minimum information needed for its function. We do not share your personal data for advertising.

4. Your rights

Subject to applicable law (including GDPR for EU residents), you have the right to:

  • Access: request a copy of the personal data we hold about you.
  • Correct: ask us to correct inaccurate data.
  • Delete: request deletion of your account and associated personal data.
  • Portability: receive your data in a machine-readable format.
  • Withdraw consent: opt out of optional processing at any time.
  • Complain: contact your local data protection authority.

To exercise these rights, email [email protected]. We respond within 30 days and usually within 24 hours for deletion requests.

If you are listed in extracted contact data

Orit extracts contact information that is publicly posted. If you are a data subject whose contact appears in our results and you wish to be removed, email [email protected] with the domain, your name, and any identifying emails. We purge the record within 24 hours and add the identifier to a suppression list to prevent re-extraction.

5. Data retention

  • Account data: kept until you delete the account, then purged within 30 days.
  • Search history: kept for the lifetime of your account so the re-search policy works.
  • Payment records: retained 7 years for tax and legal compliance.
  • Extracted contact data: re-crawled or purged on a rolling basis (within 90 days if stale).
  • Rate-limit counters, session tokens: short-lived (24 hours to 30 days).
  • Audit logs: 1 year.

6. Security

Passwords are hashed with argon2id. Session tokens are random 32-byte values, stored as SHA-256 hashes. Payments are processed by Stripe and we do not see card numbers. The service uses TLS (HTTPS) for all traffic, HSTS, CSP, and other standard HTTP security headers. We rate-limit login, feedback, and other public endpoints to deter brute force and spam.

No service is 100% secure. If you suspect unauthorized access to your account, email [email protected] immediately.

7. International transfers

The Service runs on servers in the European Union (Germany). If you access from outside the EU, your data is transferred to and stored in the EU. EU-level protections apply regardless of your location.

8. Children

Orit is not intended for anyone under 16. We do not knowingly collect data from minors.

9. Changes to this Policy

We may update this Policy occasionally. Material changes will be posted on this page with a new "Last updated" date. If the changes are significant, we email registered users.

10. Contact

Questions, requests, or complaints: [email protected].

This document is provided for transparency and is not legal advice. For your specific situation, consult a qualified lawyer in your jurisdiction.

See also: Terms of Service