Privacy Policy

01Your designs come first, because they are the sensitive part

Most of what you put into this service is not ordinary account data. It is unreleased commercial design work — a garment nobody has seen yet, its measurements, its construction, and sometimes its print artwork. Leaking that, or feeding it into a model, would cause you direct commercial harm. So the rules for it are stricter than the rules for the rest, and they are stated as prohibitions rather than intentions.

• You own them. Styles, specifications, measurements, flat sketches and artwork you upload or generate here belong to you. See the Content Licence.
• We do not train on them. Your designs, specifications and artwork are never used to train or fine-tune any model, ours or anybody else’s. This is a contractual prohibition on us and on our inference provider, not a setting you have to find and switch off.
• We do not show them. Your work is never used in our marketing, our examples, a portfolio or a case study, including in anonymised or redrawn form.
• You can take them and go. Export everything — styles, specifications, images and version history — at any time, in formats that open elsewhere.
• Deletion is real. Delete a single style whenever you like. Close your account and everything is hard deleted within 30 days.

02What we collect

• Account data — email address, hashed password, display name, the plan you are on, and your consent records.
• Billing data — handled by our payment provider. We do not store full card numbers. We receive the billing name, country, billing address, the last four digits and card brand, and the status of each charge, which we need for tax records and for handling refunds.
• Design content — the descriptions you type, reference photographs and files you upload, measurements you enter, and the specifications, sketches, diagrams, artwork and videos generated from them.
• Enquiry data — anything you send through the contact, data request or infringement report forms, including your name, email, country and message.
• Technical data — IP address, device and browser type, pages requested, timestamps, error traces, and essential cookies.

We do not ask for and do not want special category data. Please do not put health, biometric, political or religious information into a garment specification.

03Why we are allowed to use it

Under UK GDPR and EU GDPR we have to have a lawful basis for every use. Ours are:

• Performance of a contract — running your account, generating specifications from what you give us, storing your styles, producing exports, taking payment, and providing support.
• Legitimate interests — keeping the service secure, preventing abuse and fraud, debugging failures, and understanding aggregate usage so we know what to fix. We have weighed these against your interests and they do not extend to your design content.
• Legal obligation — keeping billing and tax records, and responding to lawful requests.
• Consent — optional analytics cookies and optional marketing email, each asked for separately and each withdrawable at any time without affecting the service.

04Who else touches it

We use the processors below and nobody else. Each is bound by a written processing agreement, may only act on our instructions, and — for anything touching design content — is contractually prohibited from using it for training. We will list a new processor here at least 30 days before it starts handling your data.

We do not sell personal data, and we do not share it for cross-context behavioural advertising. We will disclose data if a court or regulator lawfully requires it, and we will tell you unless we are legally barred from doing so.

05International transfers

Some processors operate outside the UK. Where that happens we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or on an adequacy decision where one applies. The safeguard used for each processor is in the table above. You can ask us for a copy of the transfer mechanism at support@orasci.shop.

06How long we keep things

• Account data — while your account is open, then deleted within 30 days of closure.
• Design content — until you delete it, or within 30 days of account closure, whichever comes first. Deleted items leave backups within a further 30 days.
• Billing records — six years after the end of the accounting period, because UK tax law requires it.
• Enquiry and support messages — 24 months.
• Infringement reports — six years, because they may be needed as evidence.
• Technical logs — 90 days.

07Your rights, and how to use them

Under UK GDPR and EU GDPR you can ask us to give you a copy of your data, correct it, delete it, export it in a portable format, restrict or object to how we use it, and withdraw any consent. Under the CCPA, if you are in California, you can ask what we collect, ask us to delete it, and opt out of sale or sharing — we do neither, but the right stands. Exercising any of these costs nothing and we will not treat you differently for it.

Use the data request form or email support@orasci.shop. We answer within one month and will tell you if a complex request needs longer.

If we get it wrong, you can complain to the Information Commissioner’s Office (ICO), the UK supervisory authority, at ico.org.uk. If you are in the EEA you may complain to the supervisory authority where you live, work, or where the problem happened. We would rather you told us first, but you do not have to.

08Security

Data is encrypted in transit with TLS and encrypted at rest. Access to production systems is limited to the people who need it, uses multi-factor authentication, and is logged. Public forms are protected against automated abuse. Details are on the security page.

No system is immune. If a breach is likely to risk your rights we will tell the ICO within 72 hours of becoming aware, and tell you without undue delay if the risk to you is high.

09Age

The service is not for under 13s and we do not knowingly collect their data. Users aged 13 to 17 need consent from a parent or guardian, who must accept the terms on their behalf. If you believe a child has given us data, email support@orasci.shop and we will delete it.

10Changes to this policy

If we change anything material we will email registered users at least 14 days before it takes effect, and we will change the effective date at the top of this page. Continuing to use the service after that means the new version applies. Older versions are available on request.