Privacy policy.

Ora. (“we”, “us”) is a performance marketing agency and the data controller for personal data collected through this website. Contact us at privacy@orastudio.ai.

• Enquiry details — the name, company, work email, enquiry type and context you enter in the contact form.
• Correspondence — messages you send us by email and any notes we make about your enquiry.
• Technical data — IP address, browser and device type, pages viewed and referral source, collected via server logs and analytics.

To respond to your enquiry and discuss a potential engagement (our legitimate interest, or steps taken at your request prior to a contract); to run and secure the website; to understand how the site performs; and to comply with our legal obligations. We do not sell your data, and we will not add you to a marketing list without your consent.

We use strictly necessary cookies to operate the site, and analytics cookies to measure usage. Analytics cookies are only set where you consent, and you can withdraw consent at any time through your browser settings.

We share personal data only with service providers acting on our instructions — website hosting, email, CRM and analytics — and with professional advisers or authorities where the law requires it. All processors are bound by contract to protect your data.

Where data is transferred outside your jurisdiction, we rely on recognised safeguards such as standard contractual clauses or an adequacy decision.

Enquiry data is kept for up to 24 months from our last contact, unless you become a client — in which case it is retained for the life of the engagement and any period required for legal or tax purposes. Analytics data is retained in aggregate form.

You may request access to your data, correction, erasure, restriction or portability, and object to processing based on legitimate interests. Email privacy@orastudio.ai and we will respond within one month. You also have the right to complain to your local data protection authority.

We apply appropriate technical and organisational measures — access controls, encryption in transit, and vendor due diligence — to protect personal data against loss or unauthorised access.

We may update this policy; the date above shows when it last changed. See also our terms of service.