Privacy Notice

• Your Orvia account. For your own details — name, email, business details, billing — we are the controller and this notice applies.
• Your customers' details. For enquiries, customers and job records inside your account, you are the controller and we are your processor. Our Data Processing Agreement covers that.

BRONI&BO LTD (trading as Orvia Hub), 17 Birch Avenue, West Parley, Ferndown, England, BH22 8PG. For anything about privacy, email privacy@orviahub.app.

• Account details: your name, email address, password (stored encrypted, never in readable form) and, if you sign in with Google, the basic profile Google shares with us.
• Business details: business name, trade, address, phone number, opening hours, logo and photos — much of which you choose to publish on your own website.
• Billing details: plan, subscription status and payment history. Card details go straight to Stripe; we never see or store them.
• How you use Orvia: pages visited in your dashboard, features used, setup progress, and technical logs including IP address for security and troubleshooting.
• Support messages you send us.

• To provide your account, website and features — because we have a contract with you.
• To take payment and chase failed payments — contract, and our legitimate interest in being paid.
• To keep the service secure, prevent abuse and fix faults — our legitimate interests.
• To send service emails you need (setup, billing, security, your monthly stats if enabled) — contract and legitimate interests.
• To send Orvia product news and offers — only if you have opted in. It's a separate tick box and never a condition of signing up. You can turn it off in your settings or from any email.
• To meet legal duties such as tax and accounting records — legal obligation.

We use the following suppliers to run Orvia. They only process data on our instructions.

• Lovable (hosting and application platform)Hosting, build and delivery of the Orvia application and business websites
• SupabaseDatabase, authentication, file storage and server functions
• CloudflareEdge delivery and running the application's server code
• StripeSubscription billing and payment processing
• TwilioPhone numbers, calls, voicemail and text messaging where a business has bought them
• Google (Maps Platform)Maps and postcode lookups shown on job records
• Google (Gemini via the Lovable AI gateway)AI call handling and content drafting where enabled
• Name.comDomain registration and renewal where a business buys a web address
• Meta (Facebook / WhatsApp)Social posting and click-to-chat where a business connects it

We never sell your data. Some suppliers operate outside the UK; where they do, transfers are covered by the UK's approved safeguards such as the International Data Transfer Agreement or an adequacy decision.

• Your account data: while your account is open, then deleted when you delete your account.
• Billing and invoice records: six years, because tax law requires it.
• Security and technical logs: normally up to 12 months.
• Website visitor counts: 90 days in raw form, then only anonymous daily totals.
• Marketing suppression records: kept indefinitely, so we don't email someone who asked us to stop.

You can ask for a copy of your data, correct it, delete it, restrict or object to how we use it, ask for it in a portable format, or withdraw consent for marketing. Email privacy@orviahub.app and we'll reply within one month. You can also complain to the Information Commissioner's Office (ico.org.uk).

We only use what's needed to run Orvia, plus optional analytics. See our Cookie Policy and change your choice at any time.

Where you switch on AI features, content and call summaries are generated with the help of AI models. No decision with a legal or similarly significant effect on anyone is made by automated means alone.