Privacy Policy

ORA is a customer engagement platform used by automotive dealerships and the agencies that serve them. This policy explains what personal information we handle, why we handle it, who we share it with, and what you can ask us to do about it.

01 Who we are

ORA AI Inc. ("ORA", "we", "us") is a company incorporated in Canada. We build and operate the ORA platform, which dealerships use to communicate with their own customers by text message, email, voice, and social media.

This policy covers the ORA platform at app.get-ora.ai, our website at get-ora.ai, the short links we generate at o-ra.ca, the landing pages we host on behalf of dealerships, and the ORA AI application that connects to Facebook and Instagram.

02 Whose information this is about, and our role

There are two distinct groups of people in this policy, and our responsibilities differ for each.

Dealership users

Staff at a dealership, dealer group, or agency who hold an ORA account. For their account information, ORA decides how the information is used and is directly accountable for it.

Customers and prospects of a dealership

People whose contact details a dealership loads into ORA, or who give their details to a dealership through an ORA form, landing page, or social media comment. For this information, the dealership decides what happens and why. ORA acts on the dealership's instructions as its service provider.

03 What we collect

We do not collect payment card numbers. We do not collect government identifiers such as social insurance numbers. We do not knowingly collect information about health, religion, ethnicity, sexual orientation, or political views, and dealerships are contractually prohibited from loading it into ORA.

04 Connected social accounts (Facebook and Instagram)

A dealership can connect its own Facebook Page and linked Instagram Business account to ORA. This is optional, is initiated by the dealership, and can be disconnected at any time.

The purpose is narrow: when someone comments a keyword the dealership has advertised in its own post — for example "comment DETAILS below" — ORA posts a public reply to that comment containing a link.

What ORA reads

• Public comments on posts published by the connected Page or Instagram account.
• The commenter's public display name and the numeric account identifier that the platform assigns them.
• Basic information about the connected Page or account — its name, ID, and profile picture — so the dealership can confirm it connected the right one.

What ORA writes

• Public replies to comments, posted as the dealership's own Page or account, and only in response to a comment that matches a keyword the dealership configured.

If you commented on a dealership's post and want the comment data deleted from ORA, see section 13. Deleting your comment on Facebook or Instagram removes it from that platform but does not automatically remove it from ORA, so please ask us directly.

A dealership can revoke ORA's access at any time from within ORA, or from its own Facebook settings under Business Integrations. Revoking access stops all reading and replying immediately.

05 How we use information

• To operate the service — delivering the messages a dealership sends, hosting its landing pages, and recording what happened.
• To enforce consent and legal limits — checking, before every message, that the recipient has not opted out and that sending is permitted.
• To report — showing dealerships how their campaigns performed.
• To improve relevance — helping dealerships understand which of their customers are likely to be interested in what, so fewer irrelevant messages get sent. See section 6.
• To keep the platform secure — detecting abuse, fraud, and unauthorized access.
• To meet legal obligations — retaining consent and message records where the law requires us to prove what happened.

We do not sell personal information. We do not share it with advertising networks, data brokers, or list buyers. We do not use one dealership's customer information for the benefit of another dealership — every dealership's records are isolated.

06 Automated processing

ORA uses automated processing, including machine learning, in two ways: deciding whether an individual message may be sent under the applicable consent rules, and ranking which customers are more likely to be interested in a particular offer or reminder.

These processes affect what messages you receive and when. They are not used to make credit decisions, pricing decisions, or any decision that determines whether you can obtain a product or service. Where a dealership uses ORA to collect information for a financing application, ORA passes that information to the dealership and does not assess it.

If an automated process has been used to make a decision about you based only on your personal information, you may ask us for the reasons and the main factors behind it, and you may ask that it be reviewed by a person. Write to us at privacy@get-ora.ai.

07 Consent and how to opt out

Commercial messages sent through ORA require consent. In Canada this is governed by CASL; in the United States, calls and texts are governed by the TCPA and related rules. The dealership is responsible for obtaining consent and confirms it holds valid consent for every record it loads into ORA. ORA is built to refuse a send where consent is absent.

You can withdraw consent at any time, at no cost:

• Text message — reply STOP (or ARRÊT). This takes effect immediately and permanently for that dealership.
• Email — use the unsubscribe link in any message.
• Any channel — email privacy@get-ora.ai and tell us which dealership and which phone number or email address.

Opting out is recorded permanently against that dealership so it cannot be undone by a later data upload. We keep the opt-out record itself even if we delete everything else, because that record is how we prevent you being contacted again.

08 Who we share information with

We share personal information only in these situations:

• With the dealership whose customer or prospect you are, and with an agency it has authorized to act on its behalf.
• With service providers who operate parts of the platform under contract, limited to what they need to do their job. These are, by category: cloud hosting and storage; telecommunications and messaging delivery; email delivery; automated speech transcription; bot and abuse protection; and large language model processing for the features described in section 6.
• Where you have asked us to — for example, delivering a lead you submitted to the dealership's own customer management system.
• Where the law requires it — in response to a valid legal demand, or to protect against fraud, harm, or a security threat.
• In a business transaction — if ORA is involved in a merger, acquisition, or sale of assets, information may transfer, subject to this policy.

Our service providers are bound by contract to protect the information, to use it only for the service they provide to us, and not to disclose it further. If you want to know the specific providers we use, ask us and we will tell you.

09 Where data is held

Personal information for Canadian dealerships is stored in Canada. Information for United States dealerships is stored in the United States.

Some service providers process information outside Canada, including in the United States. When information is held or processed outside Canada, it may be accessible to the courts, law enforcement, and national security authorities of that country. We use contractual protections to require an equivalent standard of care wherever information is processed.

ORA does not currently offer its services in the European Union or the United Kingdom.

10 How long we keep it

11 Security

Information is encrypted when travelling over the internet and when stored. Access to dealership accounts requires multi-factor authentication. Staff access to production data is restricted to what a person needs for their role and is logged. Access tokens for connected social accounts are stored encrypted and are never shown in the interface.

No system is perfectly secure. If a breach occurs that presents a risk of serious harm, we will notify affected individuals and the appropriate regulators as the law requires, and we keep a register of incidents.

12 Your rights

Subject to the limits the law allows, you can ask us to:

• Tell you what we hold about you, and where it came from.
• Correct it if it is wrong or incomplete.
• Delete it — see section 13.
• Send you a copy in a structured, commonly used electronic format.
• Stop contacting you, at any time.
• Explain an automated decision affecting you — see section 6.

Write to privacy@get-ora.ai. We respond within 30 days. We may need to verify your identity first, and we will only ask for what is necessary to do that. There is no charge.

If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada, or, in Québec, to the Commission d'accès à l'information du Québec.

13 Deleting your data

Full instructions, including for data obtained through Facebook or Instagram, are on our data deletion page.

In short: email privacy@get-ora.ai with the phone number, email address, or social account name you used. We confirm within 5 business days and complete deletion within 30 days. We keep only the minimum record needed to ensure you are not contacted again.

14 Cookies and bot protection

Our websites use only the cookies and local storage needed to keep you signed in, remember your language choice, and secure the session. We do not use advertising cookies and we do not allow third-party advertising trackers.

Our public forms are protected by Cloudflare Turnstile, which distinguishes people from automated scripts without showing you a puzzle. To do this it collects limited technical information about your browser and connection. Cloudflare acts as our service provider for this purpose. See Cloudflare's Turnstile Privacy Addendum and its Privacy Policy.

The links we generate at o-ra.ca record that a link was opened, and when, so the dealership can tell whether its message reached you. This does not follow you across other websites.

15 Children

ORA is a business tool and is not directed at children. We do not knowingly collect information from anyone under 14. If you believe we hold information about a child, write to privacy@get-ora.ai and we will delete it.

16 Changes to this policy

We update this policy when the platform or the law changes. The effective date at the top always reflects the current version. If a change materially affects how we handle your information, we will give notice through the platform, or by email to dealership users, before it takes effect.

17 How to contact us

Our Privacy Officer is accountable for ORA's handling of personal information and for answering the requests described above.

Privacy Officer, ORA AI Inc.
privacy@get-ora.ai
Canada

If you would prefer to write to us on paper, email us and we will provide a mailing address.