Privacy Policy
Last updated: 2026-09-09
In short. We collect your email address so you can sign in, the record of what you bought, and what you do inside the app — which sessions you completed, your streak, and anything you write in the journal. We use it to give you the product and to support you.
We never sell personal data. No analytics or advertising tag runs on this site today — we use essential cookies only. If we ever add one, loading it would count as "sharing" for cross-context behavioural advertising under US state privacy laws, so it would load only after you accept analytics cookies in our cookie notice, and not at all if your browser sends a Global Privacy Control (GPC) signal. You can set or change that choice at any time from Cookie settings in the footer of any page on this website, or use Do Not Sell or Share My Personal Information. You can delete your account and your data at any time. Payments are handled by Stripe; we never see your full card number.
1. Who is responsible for your data
Altoris Enterprises Inc, 30 N Gould St, Ste N, Sheridan, WY 82801, United States, is the controller of the personal data described here.
Contact us about privacy at support@altorismarketing.com, +1 (929) 650-5944 (Mon–Fri, 9am–6pm ET), or by post at the address above.
This policy covers altorismarketing.com and the Orandi web app at altorismarketing.com/orandi. Orandi is a product of Altoris Enterprises Inc.
2. What we collect
Account data
Your email address, your language preference (English or Spanish), your time zone, and the date the account was created. There is no password: you sign in with a single-use link we email to you.
Purchase data
What you bought, the amount, the currency, the date, the receipt link, your Stripe customer identifier, and the IP address used at the moment of purchase. If you accept an optional offer shown after your purchase, we also store the record of that click: date and time, IP address, the item, the price and the version of the page you saw. We keep those records as proof of consent, which is what protects both of us if a payment is ever disputed. We never receive or store your full card number — that stays with Stripe.
Progress data inside the app
Which sessions you opened and completed, the dates, your current and longest streak, reminders you set, and the collections you saved. This is what makes the app work: it is how the app knows where you are.
Journal entries
Anything you write in the in-app journal is stored on our systems, attached to your account. It is yours. We do not use it for advertising, we do not profile you with it, we do not sell it, and we do not use it to train machine-learning models. Our staff can technically reach it, and would only do so if you ask us to for support, or if the law requires it. If that troubles you, do not write anything in the journal that you would not want stored — you can use the app fully without it, and you can delete entries at any time.
Religion — a note that matters here
Orandi is a Christian prayer app. Buying it, and using it, says something about your beliefs. Under European and UK law that is a "special category" of personal data, and other laws call it sensitive personal information.
- We never ask you about religion. There is no field in the app for a denomination, a parish, a church, or any health information, and we do not buy or infer any of it. The only religious information that exists here is the fact that you chose to buy and use a Christian devotional product, plus whatever you decide to write in the journal — that text is your own content, written by you, when you want to.
- We process that minimal information for one purpose: to give you the product you bought and to keep your account working. We do not analyse, classify or profile your journal entries; they are stored so that you can read them back.
- We do not use it to target advertising, we do not build audiences from it, and we never pass it to an advertising network. No analytics or advertising tag runs on this site today. If we ever add one, and only if you accept analytics cookies, it would record that you visited or bought on this site and nothing more (see sections 4, 6 and 8). Your journal and your progress are never sent to anyone, in any case.
- You can remove all of it by deleting your account — see section 9.
Technical data
IP address, browser and device type, pages and app screens requested, and time stamps. Access records with IP and time stamp are kept as evidence of delivery and use — card networks require this for digital products.
Support data
What you write to us by email or tell us by phone, and our answer.
3. Why we use it, and the legal basis
| Purpose | Data | Legal basis (GDPR / UK GDPR terms) |
|---|---|---|
| Create your account, deliver access, run the app, keep your progress | Account, progress, journal | Performance of a contract — you bought a product and we have to deliver it. We do not ask for or record any religious detail beyond that purchase, and you can erase all of it by deleting your account. |
| Take payment, issue receipts, handle refunds and payment disputes | Purchase, consent records, technical | Performance of a contract; legal obligation; legitimate interests (fraud prevention, dispute evidence) |
| Answer support requests | Support, account, purchase | Performance of a contract; legitimate interests |
| Keep the service secure and available | Technical | Legitimate interests |
| Send service emails (sign-in links, receipts, important changes) | Account, purchase | Performance of a contract |
| Send optional marketing emails | Email address | Consent — you opt in, and every message has an unsubscribe link |
| Measure and improve the site with analytics (no analytics tool is in use today) | Technical, cookie identifiers | Consent, collected through the cookie notice — until you accept, nothing is collected for this purpose |
| Comply with tax, accounting and legal duties | Purchase | Legal obligation |
4. Who we share it with
We do not sell personal data. We share it only with the service providers we need in order to run the product, and only for that purpose. They act on our instructions under written agreements.
| Provider | What it does for us | What it receives |
|---|---|---|
| Stripe, Inc. (United States) | Payment processing, checkout, receipts, refunds, payment-dispute handling, sales-tax calculation | Email, name if you give one, card details entered directly on Stripe's form, amount, purchase IP, country |
| Cloudflare, Inc. (United States, global network) | Hosting, content delivery, application database, file storage, security | All application data, technical data, IP addresses |
| Resend (United States) | Sending transactional email: sign-in links, access emails, receipts | Email address, message content, delivery events |
| A speech-synthesis provider (planned; none engaged yet) | Producing the spoken narration of the sessions, if and when we add it | Nothing about you. Any narration would be produced in advance from our own scripts and stored as files; no personal data would be sent. We will name the provider here before it starts. |
| An analytics and advertising-measurement provider (planned: Google Analytics 4 and the Meta Pixel; neither is engaged, installed or loaded today) | Measuring how the site and the ads perform, if and when we add it | Nothing today — no such tag exists on any page of this site. If we add one, it would receive cookie identifiers, IP address, pages viewed and, after a purchase, a purchase event carrying the order amount and currency and nothing else — never your name, email address, phone number, card details, journal entries or progress. It would load only after you accept analytics cookies in our cookie notice, and never while your browser sends a GPC signal. We will name the provider here before it starts. |
We may also disclose data to our accountants and legal advisers, to a competent authority when the law requires it, and to an acquirer if the business is ever sold — in which case this policy continues to apply until you are told otherwise.
Any provider we add or replace will be listed here before it starts processing your data.
5. Where your data is stored
We are a United States company and our providers are based in the United States, so your data is processed there and on global networks. Where data is transferred from the European Economic Area, the United Kingdom, Switzerland or Brazil, the transfer relies on the European Commission's Standard Contractual Clauses (and the UK Addendum where relevant), which our providers include in their agreements with us.
6. Cookies and similar technologies
- Essential. A session cookie that keeps you signed in, and the single-use token behind a sign-in link. Without these the app cannot work. They are not used for advertising and do not require consent.
- Preferences. Your language choice and your light/dark setting, stored on your device.
- Analytics and advertising measurement. None today. This site loads no analytics and no advertising tag, so there is nothing of this kind to consent to yet. Our cookie notice says exactly that on screen and records your choice for the future: if we ever add such a tag, it loads only if you have accepted analytics cookies, and never while your browser sends GPC. You can set or change your choice at any time from Cookie settings in the footer of any page on this website, and you can clear the cookies in your browser. A new choice applies from the next page you open. The Orandi app itself carries no analytics or advertising tag and no cookie notice; if that ever changes, the notice ships inside the app in the same release.
- We honour the Global Privacy Control (GPC) signal. If your browser sends it, we apply it as an opt-out of any sharing of personal data for cross-context behavioural advertising.
7. How long we keep it
- Account, progress and journal — while your account exists. When you delete the account, they are removed from our live systems within 30 days, and from backups as those backups expire.
- Purchase and consent records — for the period required by United States tax and accounting law and by card-network rules on payment disputes. These survive account deletion because the law requires them to.
- Access records (IP, time stamp, page) — 12 months, then deleted.
- Support emails — while they are useful for follow-up questions, then deleted.
- Marketing consent — until you unsubscribe, plus the record of the unsubscribe itself so we do not email you again by mistake.
8. Your rights
Wherever you live, you can ask us to:
- tell you what personal data we hold about you, and give you a copy;
- correct anything that is wrong;
- delete your data (see section 9);
- export your data in a portable format;
- restrict or object to a particular use;
- withdraw consent, at any time, without affecting what was done before;
- opt out of any sale or sharing of personal data, and of targeted advertising.
How to exercise them: email support@altorismarketing.com from the address on your account, or write to us at the postal address above. We answer within 30 days. We do not charge for this and we will never give you a worse product or price for asking.
California, Colorado, Connecticut, Virginia and other US state residents. We do not sell personal data — we have never received and will never receive money or anything of value for it. We do not share it for cross-context behavioural advertising either: no analytics or advertising tag is loaded on this site today. If we ever add measurement (for example Google Analytics 4 or the Meta Pixel), loading it would be "sharing" as the CCPA/CPRA defines it — so it would load only after you accept analytics cookies in our cookie notice, it would be switched off if your browser sends a Global Privacy Control (GPC) signal, and you can set or withdraw that consent at any time from the Cookie settings link in the footer of any page on this website. You may also submit an opt-out request here: Do Not Sell or Share My Personal Information. You may use an authorised agent, and we will verify the request through the email address on your account. You have the right to appeal a decision we make about a request — reply to our answer and a different person will review it.
EEA, UK, Switzerland, Brazil. You may lodge a complaint with your supervisory authority (in the UK, the Information Commissioner's Office; in Brazil, the ANPD). We would rather you told us first.
9. Deleting your account
Two ways, both free:
- In the app: Settings → Delete account. You confirm once, and the deletion runs.
- By email: write to support@altorismarketing.com from the address on your account with the word "delete" in the subject.
What is deleted: your email address, language and time-zone settings, all progress and streak data, every journal entry, your reminders and your access records, removed from our live systems within 30 days.
What is kept: the purchase record itself (date, item, amount, payment reference) and the consent record, because tax law and payment-dispute rules require it. Kept in the narrowest form that satisfies those duties.
Deleting your account ends your access to what you bought, and it cannot be undone. If you only want to stop the emails, unsubscribe instead — that keeps the account. If you want a refund, see the Refund & Cancellation Policy: ask for the refund first, then delete.
10. Age
Our products are sold to adults. You must be 18 or older to buy and to hold an account, and we do not knowingly collect personal data from anyone under 18. Family material is used by children under the supervision of the adult who bought it, inside that adult's account — we do not create accounts for children and we do not ask for a child's name, age or any other detail. If you believe someone under 18 has given us personal data, write to support@altorismarketing.com and we will delete it.
11. Security
The site and the app are served over HTTPS. Sign-in links are single-use and expire shortly after they are sent. Access to production data is limited to the people who need it. Card data never reaches our systems. No online service can promise perfect security, but if a breach ever affects your data we will tell you and the relevant authority within the deadlines the law sets.
12. Changes to this policy
We may update this policy. The date at the top shows when it last changed. If a change materially affects you, we will tell you by email at the address on your account before it takes effect.
13. Contact
support@altorismarketing.com ·
+1 (929) 650-5944 · Mon–Fri, 9am–6pm ET ·
altorismarketing.com/contactus
Altoris Enterprises Inc, 30 N Gould St, Ste N, Sheridan, WY 82801, United States.