Privacy Policy
Last updated: 30 July 2026 · Version 1.0.0
Courtesy translation. The Spanish version is the only legally binding one.
1. Data controller
Owner: Reinaldo José León Rivera
Tax ID (NIF): 60464852Z
Address: Carrer de la Renaixença, 25, Horta-Guinardó, 08041 Barcelona, Spain
Email: hello@oria.ninja
Support channel: Exclusively by email at hello@oria.ninja (no phone support is provided).
2. What data we collect
2.1. If you are a business (ORIA customer)
- Registration and contact data: name, email.
- Tax data: tax ID, trade name, billing address.
- Payment data: handled 100% securely through Stripe (ORIA does not store card data).
- Uploaded content: logos, images, campaign terms.
2.2. If you are an end customer (user of the ORIA app)
- Account data: email, alias, encrypted password.
- Activity data: stamps earned, recorded visits, redeemed rewards.
- Device data: IP address, operating system.
2.3. If you visit our website
- Browsing data collected via cookies explicitly authorized by the user (see the Cookie Policy).
3. Processing roles under the GDPR
ORIA as controller: We directly process account data of Businesses and the profile/registration data of end users in the app.
ORIA as processor (DPA): When a Business records the loyalty activity of its end customers, the Business is the Data Controller and ORIA acts as Data Processor. This relationship is formalized automatically upon sign-up through Annex I of our Terms and Conditions.
4. Purpose and legal basis for processing
| Purpose | Legal basis |
|---|---|
| Managing the Business's registration and account | Contract performance (Art. 6.1.b GDPR) |
| Billing and compliance with tax obligations | Legal obligation (Art. 6.1.c GDPR) |
| Managing the end customer's account in the app | Contract performance (Art. 6.1.b GDPR) |
| Technical service communications via email | Contract performance / Legitimate interest |
| Analytics and advertising cookies (Google Analytics, Meta) | Explicit consent via banner |
5. Providers and data location
ORIA uses first-tier providers that guarantee compliance with European regulations:
- Amazon Web Services (AWS): Main hosting and infrastructure. Servers located in the European Union (eu-west-1 region, Ireland).
- Stripe: Payment processing and recurring billing.
- Google Workspace / AWS SES: Sending transactional emails and support.
- Google Analytics / Meta Pixel: Analytics and marketing (only with prior consent).
6. Retention period
Business data: Retained for the duration of the contract and afterward for the legal tax retention periods (6 years in Spain).
End user data: Retained while the account remains active or until deletion is requested.
7. User rights
You can exercise your rights of access, rectification, erasure, objection, restriction, and portability by emailing hello@oria.ninja with a copy of your ID document attached.
You also have the right to file a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.