Privacy policy

1. Data controller

This policy describes how ora. processes the personal data of the people who use its platform. The controller is the company operating ora. ("ora.", "we"), whose details are given in the "Contact us" section.

It applies in compliance with the Swiss Federal Act on Data Protection (FADP) and, where relevant, the European Union's General Data Protection Regulation (GDPR).

Each lawyer is, for their part, the controller of the data they receive from a client in the course of a mandate, in accordance with their professional obligations.

2. The data we process

The service processes the following categories of data.

• Account: email address, name, language, time zone and, where applicable, company name, VAT number and billing address.
• Lawyer profile: registration number, canton, practice areas, languages, hourly rate, published services, biography, photograph, declared career, and the history of verification decisions.
• Enquiries and mandates: the conversations, fee offers, bookings, uploaded documents, consultation notes, time entries and reviews linked to a relationship between a client and a lawyer.
• Payments: amounts, their status, invoices and the identifiers passed on by our payment provider. We never store a full card number.
• Video consultations: the start and end time of each consultation and its participants, and nothing of its content, which is neither recorded nor transcribed.
• Saved lawyers: visible to you alone, and never disclosed to the lawyer concerned.
• Technical data: error and security logs, IP address, browser type, without the content of your searches.

3. Purposes and legal bases

We process this data for the following purposes.

• Providing the service and performing our contract with you, including matching, transmitting messages and documents, holding payments and issuing invoices.
• Verifying lawyers' registration with the cantonal register and maintaining trust in the platform.
• Ensuring security, preventing fraud and abuse, and meeting our legal obligations, including accounting requirements.
• Sending you notices about your account, your enquiries and your mandates. No marketing message is sent without your consent.
• Improving the service using aggregated statistics that do not identify you.

4. Your searches are not recorded

What you type into the search box can reveal a health problem, a family dispute or criminal proceedings. The text of your search is never written to our logs. We keep only the fact that a search took place and the number of results returned.

5. Professional secrecy and matter content

The content of an enquiry or a mandate is covered by the lawyer's professional secrecy. It is readable only by the two parties, and that rule is enforced by the database itself on every read.

There is no general administrative access at ora. Exceptional access to content, for example at the request of an authority, requires a written justification, approval by a second person, a limited duration, and leaves a permanent trace.

Video consultations are neither recorded nor transcribed by the platform.

6. Sharing and subprocessors

We do not sell your data and share it only with the providers needed to run the service, bound by a data processing agreement, or where the law requires. Our subprocessors are currently the following.

• Supabase: database, authentication and file storage, Zurich region, Switzerland.
• Vercel: hosting and rendering of the application, Frankfurt region, European Union.
• Stripe: payment processing, holding of funds and payouts to lawyers. Stripe alone processes your card data.
• LiveKit: transport of the audio and video streams of consultations, encrypted in transit and not recorded.
• Resend: delivery of notification emails.

7. Where data is processed

The database and files are hosted in Switzerland, in the Zurich region. Pages are rendered from the European Union, which offers a level of protection recognised as adequate by the Federal Council.

Where a provider processes data outside Switzerland or the European Union, we ensure appropriate safeguards, in particular standard contractual clauses, before any transfer.

8. Security

Data is encrypted in transit and at rest. Access to every database table is controlled row by row according to the identity of the signed-in person, and documents are reachable only through short-lived signed links, after a technical check of the file.

Every document download is logged. Administrative keys are never exposed to the browser and are rotated periodically.

No measure is infallible. In the event of a data security breach likely to harm you, we inform you and the Federal Data Protection and Information Commissioner, as the law requires.

9. Retention

We keep your data for as long as your account is open and the service needs it. A closed account is deactivated rather than erased immediately.

• Accounting data, including invoices and payments, is kept for ten years, as Swiss law requires.
• The content of a mandate is kept for as long as either party may need it as evidence, then deleted.
• Technical and security logs are kept for at most twelve months.
• The data of a closed account with no mandate and no payment is deleted within thirty days.

10. Cookies and local storage

ora. uses no advertising cookies and no third-party trackers. The only cookies set are those needed to run the service, mainly to keep your session open.

Some preferences, such as the display theme or the background chosen for video consultations, are stored in your browser and never leave your device.

11. Your rights

You have the following rights over your data, which you can exercise from your account or by writing to us.

• Access the data we hold about you and obtain a copy in a common format.
• Have inaccurate or incomplete data corrected.
• Request erasure of your data, within the retention limits set out above.
• Object to a processing operation or ask for it to be restricted, where the law allows.
• Withdraw a consent you gave, without effect on earlier processing.
• Lodge a complaint with the Federal Data Protection and Information Commissioner if you believe your rights are not being respected.

12. Minors

The service is intended for people aged eighteen and over. We do not knowingly collect data about a minor. If you learn that a minor has created an account, write to us and we will delete their data.

13. Changes to this policy

We may change this policy to reflect a change in the service or in the law. The effective date appears at the top of the document, and any substantial change is announced to you in the platform or by email before it takes effect.

14. Contact us

For any question about this policy or to exercise your rights, write to us from your account. The postal details of the controller and the dedicated contact address are published with the definitive text.