← Back to home

Privacy Policy

Last updated: August 8, 2026

1. Introduction

Orivum Identity, S.L. ("we," "us," or "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect personal data when you use our website, mobile application, and related services (collectively, the "Service").

If you sign in with Google, Apple, or another supported third-party provider, this Privacy Policy also explains how we handle information received from that provider.

2. Who we are

Company name: Orivum Identity, S.L.
Registered address: Lope de Rueda 16, 28009 Madrid, Spain
Email: privacy@orivum.app

If you are located in the EEA, UK, or Switzerland, the entity above is the data controller for the personal data described in this Privacy Policy, unless stated otherwise.

3. Data we collect

a) Information you provide directly

  • Name, email address, and account login details
  • Profile information you choose to provide, such as a nickname, profile and background photos, social profiles, contact methods, and visibility preferences
  • Private chat messages and other content you send through the Service
  • Connection requests, invitations, support requests, and other communications

b) Information collected automatically

  • Device type, operating system, browser type, and IP address
  • User and device identifiers, including push notification tokens
  • App usage and product interaction information
  • Log data, crash data, diagnostics, and performance data
  • Cookies and similar technologies, where applicable

c) Contacts

If you grant contact permission, the app can access email addresses and phone numbers in your device contacts to help you find people you know on Orivum and invite contacts who are not yet registered. Contact identifiers are normalized and converted into cryptographic hashes before they are transmitted to our servers for matching. These hashes are still treated as personal data. We do not use your contacts for advertising, and you can revoke contact access in your device settings.

d) Information obtained from third parties

If you sign in through Google, Apple, or another supported third-party provider, we may receive account information that the provider makes available, such as:

  • Your name
  • Your email address
  • Your provider-specific account identifier

We only access data necessary to authenticate you and provide the features you choose to use, subject to the permissions and information-sharing choices available from the provider.

4. Face data

This section explains specifically how Orivum collects, uses, shares, stores, retains, and deletes information related to human faces ("face data"). Face data may constitute biometric or other sensitive personal data under applicable law.

Face data we process

  • Enrollment photo: after an on-device liveness check succeeds, the app uploads one still image for use as your profile photo and to enroll you in Orivum's optional face-recognition feature.
  • On-device liveness information: camera frames and signals such as face position, head movement, blinking, and smiling are processed on your device to check that a live person is present. These frames and signals are not uploaded; only the final successful still image is uploaded.
  • Recognition image: when a user actively taps a detected face in the camera, the app creates a small cropped image of that face and sends it for a one-time comparison with enrolled Orivum users.
  • Facial template: our processor creates a numerical facial template from an enrollment photo. Orivum stores the template's identifier so the enrolled face can be matched later.

If you use Face ID, Touch ID, or another device biometric check, that authentication is performed by your device's operating system. Orivum receives only whether the check succeeded and never receives or stores the biometric template held by your device.

One-time searches and people who are not enrolled

Orivum's reference collection contains only facial templates of users who expressly enrolled in facial recognition. A recognition image submitted by another user is used for a single comparison with eligible enrolled users. If the image does not match an eligible enrolled user, Orivum returns no identity or profile. We do not add that image to the reference collection, create a persistent facial profile for the person, retain it for later searches, or correlate the person across separate searches.

The searching user controls when an image is captured and submitted and is responsible for using the feature lawfully and respecting the rights of others. Our Terms prohibit covert or systematic surveillance, harassment, stalking, discrimination, identifying minors, and repeated or bulk scanning.

How we use face data

The reference collection used for matching contains only facial templates of users who actively enrolled in facial recognition and expressly agreed to facial discoverability.

We use face data only to perform the liveness and profile-photo checks you request, enroll consenting users in face recognition, compare an actively submitted recognition image with enrolled users, and return the matching user's Orivum profile when a sufficiently confident match is found. A match is a similarity prediction and not a definitive identification.

We do not use face data to authenticate access to your Orivum account, build advertising profiles, serve advertising, market to you, or track you across apps or websites. The Service does not return an identity or profile for a person who is not enrolled and eligible to be discovered. We do not sell face data or use it to train or improve our own or our processors' models.

Sharing and storage

We disclose uploaded face images, recognition images, and facial-template data to Amazon Web Services (AWS), acting as our contracted cloud-hosting and face-comparison processor. The provider processes this data only to provide services to Orivum under our instructions and is required to protect it consistently with this Privacy Policy and applicable law. Orivum has opted out of allowing the provider to use its content for AI service improvement. We do not share facial templates or recognition images with advertisers, analytics providers, data brokers, information resellers, or other users. Other users may see your profile photo and profile information as permitted by your visibility settings, but they do not receive your facial template.

Enrollment photos and facial-template data are stored in Orivum-controlled AWS infrastructure in the European Union (Ireland). Profile photos may be temporarily cached by the provider's content-delivery network in other locations so they can be displayed efficiently. Data is encrypted in transit, and stored face templates are encrypted at rest.

A recognition image submitted for a one-time search is held only in memory while the request is processed. It is not added to the enrolled-face collection or written to Orivum's persistent server storage, is not retained in application logs or analytics, and is discarded after the search response is returned. Orivum does not create or keep a persistent facial template from a one-time search image.

Facial discoverability and user controls

Face matching does not override a user's profile visibility settings. Following a potential match, Orivum returns only profile information that the matched user has authorized for the searching user's audience.

Enrollment in facial recognition is optional and based on the user's explicit consent. That enrollment includes allowing other Orivum users to find the enrolled user through a one-time facial search, subject to the enrolled user's discoverability and profile visibility choices.

Users may disable facial discoverability at any time by enabling Offline Mode. While Offline Mode is enabled, the user's profile is excluded from face-search results. Offline Mode does not delete stored profile photos or associated facial templates; these remain available if the user later returns online.

Retention, deletion, and withdrawal of consent

We retain an enrollment photo and its facial template only while your facial enrollment and account remain active. When you withdraw consent and request deletion, or delete your account, we delete the associated face data from active systems as soon as reasonably practicable and no later than 30 days after receiving the request. Temporary content-delivery caches expire within that same period. We do not retain facial templates for advertising, analytics, or service-improvement purposes after deletion.

You have two deletion options. You may contact privacy@orivum.app to withdraw consent and request deletion of your face data without deleting your account; the recognition features may then no longer function for your account. Alternatively, at any time you may delete your account in the app or contact us to request deletion of all personal data associated with it. We may retain only data necessary to comply with law, establish or defend legal claims, or protect the Service and its users. Withdrawing consent does not affect processing that occurred before withdrawal.

5. How we use personal data

We use personal data to:

  • Provide, operate, and maintain the Service
  • Create and manage user accounts
  • Authenticate users, including through supported third-party sign-in providers
  • Perform liveness checks, verify identity, prevent impersonation, and provide facial recognition features
  • Help users discover contacts and manage connections
  • Deliver private chats, connection requests, invitations, and push notifications
  • Display profile information and available ways to connect according to each user's visibility choices
  • Personalize the user experience
  • Communicate with you about the Service
  • Provide customer support
  • Improve, monitor, and secure the Service
  • Detect, prevent, and investigate fraud, abuse, and technical issues
  • Comply with legal obligations
  • Enforce our terms and policies

You retain control at all times over which profile information and ways to connect are visible to other users by changing your visibility settings.

6. Third-party sign-in and API services

If you choose Google Sign-In, Sign in with Apple, or another supported provider, we use the information supplied by that provider only to authenticate you, create or manage your account, and provide features you request. The information available to us depends on the provider and your choices with that provider.

You can manage or revoke Orivum's access through the provider's account settings, though doing so may affect your ability to sign in using that provider.

Google API-specific commitments

If our Service accesses data from Google APIs, we will use that data only as necessary to provide or improve user-facing features of the Service.

We do not sell Google user data.

We do not use data obtained from Google Workspace APIs to develop, improve, or train generalized artificial intelligence or machine learning models unless such use is expressly permitted by the applicable Google API Services requirements and you have explicitly consented where required.

We only retain Google user data for as long as necessary to provide the relevant functionality, comply with law, resolve disputes, and enforce our agreements.

You can revoke our access to your Google account at any time through your Google account security settings.

7. Legal bases for processing

If you are in the EEA, UK, or Switzerland, we process personal data on the following legal bases, as applicable:

  • Performance of a contract
  • Legitimate interests, such as securing and improving the Service
  • Compliance with legal obligations
  • Consent, where required by law, including explicit consent for biometric data where applicable

You may withdraw consent at any time by contacting us. For facial recognition, contact privacy@orivum.app to withdraw consent without deleting your account, or delete your account in the app. Offline Mode only pauses facial discoverability; it does not withdraw biometric consent or delete face data. Withdrawal does not affect processing that was lawful before consent was withdrawn, and some Service features may no longer work without the relevant data.

8. How we share information

Other users can see the profile details, contact methods, social profiles, and actions that you choose to make available to them. The recipient of a private chat can see the messages and content you send. Your visibility settings determine which information is public, limited to connections, or private.

We may share personal data with:

  • Service providers and processors that help us operate the Service, including cloud hosting, authentication, push notification, identity verification, facial recognition, diagnostics, communications, and customer support providers
  • Professional advisers, such as lawyers, auditors, and insurers
  • Law enforcement or authorities where required by law
  • A buyer, investor, or successor in connection with a merger, acquisition, financing, or sale of assets

We do not sell personal data to third parties, and we do not use personal data for cross-app advertising or tracking.

9. Data retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements.

Account and profile data, chat content, connection information, contact hashes, and facial templates may be retained while your account or the relevant feature remains active. Retention periods may differ where a shorter or longer period is required for security, fraud prevention, dispute resolution, or legal compliance.

When data is no longer required, we will delete it or anonymize it where feasible.

10. International data transfers

Your personal data may be transferred to and processed in countries other than your own. Where required by law, we use appropriate safeguards for such transfers.

11. Security

We use reasonable technical and organizational measures to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure. However, no method of transmission or storage is completely secure.

12. Your rights

Depending on your location, you may have rights to:

  • Access your personal data
  • Correct inaccurate data
  • Delete your data
  • Restrict or object to processing
  • Receive a copy of your data in portable form
  • Withdraw consent where processing is based on consent
  • Request deletion of facial templates and other biometric data, subject to applicable legal exceptions
  • Lodge a complaint with a supervisory authority

To exercise these rights, contact us at privacy@orivum.app.

13. Children's privacy

Our Service is not directed to children under 16 and we do not knowingly collect personal data from children in violation of applicable law.

14. Cookies and tracking

If we use cookies or similar technologies, we use them to operate, secure, analyze, and improve the Service. Where required by law, we will request consent before using non-essential cookies.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and update the "Last updated" date above.

16. Contact us

If you have any questions about this Privacy Policy or our data practices, contact us at:

Orivum Identity, S.L.
Lope de Rueda 16, 28009 Madrid, Spain
privacy@orivum.app