Privacy Policy

This Privacy Policy explains how Orvone (“we,” “our,” or “us”) collects, uses, discloses, and protects personal information when you access or use our applications, websites, and services (collectively, the “Platform”).

By using Orvone, you consent to the practices described in this Privacy Policy.

1. INFORMATION WE COLLECT

We collect information that is necessary to provide and improve our services.

1.1 Personal Information

Name
Email address
Phone number
Country and address
Account credentials
Student and parent information (for Orvone Teaching)

1.2 Service & Transaction Information

Order details
Service requests
Payment confirmations (not full payment details)
Proof uploads (receipts, photos, videos)
Chat communications

1.3 Technical & Usage Information

Device type
IP address
App usage activity
Log data and timestamps

2. HOW WE USE YOUR INFORMATION

Your information is used to:

Provide and manage services
Communicate with you
Verify payments and requests
Deliver teaching and charity services
Improve platform performance and user experience
Meet legal and regulatory obligations

We do not use your data for unauthorized profiling or automated decision-making.

3. DATA SHARING & DISCLOSURE

We share information only when necessary, including with:

Verified agents and instructors (for service execution)
Vendors, couriers, and service partners
Payment and remittance providers
Legal or regulatory authorities when required by law

We do not sell personal data to third parties.

Third-Party SDKs & Services

The Orvone mobile app uses the following third-party SDKs and services that may process limited user data. Each is bound by its own privacy policy linked below:

Google Firebase (Authentication, Cloud Messaging, Crashlytics, Analytics, Performance Monitoring, Remote Config) — handles sign-in, push notifications, crash reports, usage analytics, and feature configuration. firebase.google.com/support/privacy
Google Sign-In — used as one of the optional sign-in providers. policies.google.com/privacy
Apple Sign In — used as one of the optional sign-in providers on iOS. apple.com/legal/privacy/data/en/sign-in-with-apple
Google ML Kit (Text Recognition) — on-device OCR used to read text from photos you choose to scan (e.g. receipts or tailoring measurement notes). The recognition runs entirely on your device — the images are not uploaded to Google for text recognition. developers.google.com/ml-kit/terms

Push notifications are delivered via Apple Push Notification Service (APNs) on iOS and Firebase Cloud Messaging on Android. Payment for concierge services is processed by manual bank transfer — Orvone does not integrate a third-party card-payment SDK such as Stripe or PayPal, and never stores card numbers on its servers.

4. INTERNATIONAL DATA TRANSFERS

As Orvone serves users globally, your information may be processed or stored in jurisdictions outside your country of residence, including Pakistan and the United States.

We take reasonable steps to ensure appropriate data protection safeguards are in place.

5. DATA SECURITY & CYBER PROTECTION

Orvone implements reasonable administrative, technical, and organizational security measures to protect personal data.

However:

No system can guarantee absolute security.
Orvone is not liable for unauthorized access caused by factors beyond reasonable control.

In the event of a data breach, we will take appropriate action and notify affected users where required under applicable Pakistan or U.S. laws.

6. DATA RETENTION

We retain personal data only for as long as necessary to provide services or to satisfy legal, regulatory, or audit obligations. Specific retention periods by data category:

Account profile (name, email, phone number) — retained for the life of your account; deleted within 30 days of an account-deletion request, per Google Play and Apple App Store requirements.
Transaction & order records (procurement orders, payments, invoices) — retained for 7 years after the transaction date, in line with Pakistan FBR record-keeping requirements and standard accounting practice. After account deletion, these records are anonymised (the link to your identity is removed) but the transaction ledger remains for reconciliation purposes.
Chat messages & attachments — retained for the life of your account; deleted within 30 days of account-deletion request.
Crash reports & performance traces (via Firebase Crashlytics / Performance Monitoring) — retained for up to 90 days under Firebase's default retention. Reports are not linked to your personal identifiers in our dashboards.
Analytics events (via Firebase Analytics) — aggregate event counts are retained per Firebase's default settings (currently 14 months); user-identifying event data is deleted within 30 days of account-deletion request.
Encrypted backups — retained for up to 30 days after account deletion before being permanently erased.

Data may be retained longer where specifically required by Pakistan or U.S. law (e.g. response to a valid legal hold). When the retention period ends, data is permanently deleted or anonymised so it can no longer be linked to you.

7. USER RIGHTS

Subject to applicable Pakistan and U.S. laws, users may have the right to:

Access their personal data
Request corrections
Request deletion (where legally permitted)
Opt out of non-essential communications

Requests can be made via in-app support or by emailing support@orvone.com.

7.1 European Economic Area (GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, the EU General Data Protection Regulation (EU 2016/679) grants you the following rights with respect to your personal data:

Right of access (Art. 15) — confirm whether we process your data and obtain a copy
Right to rectification (Art. 16) — correct inaccurate or incomplete data
Right to erasure / "right to be forgotten" (Art. 17) — exercised via the in-app account-deletion flow or by emailing support@orvone.com
Right to restrict processing (Art. 18)
Right to data portability (Art. 20) — receive your data in a machine-readable format
Right to object (Art. 21) — to processing based on legitimate interests or direct marketing
Right to lodge a complaint with your national supervisory authority (Art. 77) — typically your country's Data Protection Authority

Our lawful bases for processing under GDPR Article 6 are: (a) performance of a contract when you place a concierge order or book a service, (b) legitimate interests for service improvement and fraud prevention, and (c) consent for optional marketing communications which you may withdraw at any time. To exercise any of the above rights, email support@orvone.com; we respond within 30 days per Art. 12(3).

7.2 United Arab Emirates & Saudi Arabia

If you are located in the United Arab Emirates, Orvone respects your rights under the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL). If you are located in the Kingdom of Saudi Arabia, Orvone respects your rights under the Saudi Personal Data Protection Law (PDPL) issued by the Saudi Data & Artificial Intelligence Authority (SDAIA). In both jurisdictions, the data subject rights are substantially equivalent to those listed under §7.1 (access, rectification, erasure, portability, objection). Exercise any of these by emailing support@orvone.com.

8. CHILDREN’S PRIVACY

Orvone Teaching may involve students under 18 years of age.

Data related to minors is collected only with parental or guardian consent.

Such data is used strictly for educational and service-related purposes.

9. COOKIES & TRACKING (WEBSITE)

Our website may use cookies or similar technologies to improve functionality and analytics.

Users can manage cookie preferences through browser settings.

10. POLICY UPDATES

We may update this Privacy Policy periodically. Updates will be posted on the Platform.

Continued use indicates acceptance of the updated policy.

11. CONTACT INFORMATION

For privacy-related questions or requests:

Email: support@orvone.com
In-App Support: Available via chat