Privacy Policy

Ormeval, the operator of this website, is the data controller for the personal data described below. For any data-protection request, use the contact details at the end of this policy.

Ormeval currently operates as a sole trader. Registered-entity details will be published here on incorporation, and this policy updated with the date of the change. Until then the contact route below reaches the controller directly.

Browsing. You can browse the public catalog without an account. With your consent, we log a limited set of usage events (for example, which pages and calls-to-action are used) to understand and improve the product. These events are never sold, never shared with advertisers, and are not used to track you across other websites. Because analytics is off until you accept it, the legal basis for this processing is your consent, which you can withdraw at any time.

Cockpit & early-access interest. If you set up a cockpit or register early-access interest, we collect your email address, the public asset names you choose to follow and the therapy area you enter, so we can assemble your cockpit and send the digest you request (performance of a contract).

Contacting us. If you use the contact form, we store the name, email and message you submit so we can reply.

Security. Our servers process your IP address transiently to apply rate limits and protect the service against abuse (legitimate interest).

How the product is used. If you have an account, we keep a short record of four actions so we know which answers are worth improving. Each record holds your workspace, your account and the time, plus identifiers naming what was asked for - no message, note or free text of any kind, and no cross-site tracking (legitimate interest in improving the service). These records are deleted after 13 months.

• When an API key or connected assistant looks up an asset, we record which tool was used and which asset was asked for, with your workspace, your account and the time - never the wording of the question.
• When you export a brief, we record the file format and the asset it covered, with your workspace, your account and the time - never the contents of the file.
• When you override a forecast driver, we record which asset, which programme and which driver you changed, with your workspace, your account and the time - never the value you entered, which stays in your browser.
• When you save a catalyst, we record which asset it belonged to, with your workspace, your account and the time - never the note or the event text.

We do not sell personal data, we do not use it for unrelated profiling, and we never ingest confidential or company-proprietary information.

We use a small number of third-party processors to run the service, each acting on our instructions under a data-processing agreement: cloud hosting and database (for accounts, cockpit data and entitlements), payment processing (for paid subscriptions, when billing opens), and the language-model provider that will power the optional assistant once it is switched on. We share only the data each provider needs to perform its function, and no more.

Each sub-processor is named individually, with the data it receives, its processing region and whether it is currently enabled, on our sub-processor register. Our hosting and database providers operate in the United States, so personal data is processed outside the UK, the EEA and Quebec. Each provider is engaged under its own data-protection terms, which include transfer clauses. The transfer mechanism for our own entity, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, is being put in place with counsel and is not yet executed; we will say so here when it is, rather than describe it as in place before it is.

See our Data Processing Addendum for the terms that apply when we process personal data on your behalf.

Where we offer the service to people in the European Economic Area or the United Kingdom, Article 27 of the EU and UK GDPR requires us to designate a representative in each territory who can be contacted by individuals and supervisory authorities on data-protection matters, in addition to contacting us directly.

These appointments are being put in place ahead of our EEA and UK launch. Until their details are published here, every right described below can be exercised directly with us using the contact route at the end of this policy, and we will respond within the same statutory timeframes.

If you are in the EEA or UK, you have the right to access, correct, export, restrict, or erase your personal data, and to object to processing. To exercise any of these, contact us and we will respond within the statutory timeframe. You can delete your cockpit data at any time; model assumptions you enter are stored locally in your browser and can be removed by clearing site data.

You also have the right to lodge a complaint with a supervisory authority in the country where you live or work. Exercising any of these rights is free, and we will never restrict your access to the service because you used them.

The operator is established in Quebec, so Quebec's private-sector privacy law applies to everything described in this policy. The person in charge of the protection of personal information is the operator of Ormeval, reachable through the contact route at the end of this policy.

Before communicating personal information outside Quebec we assess whether it will receive adequate protection, taking account of the sensitivity of the information, the purpose of its use, the protections it will be given and the legal framework of the destination. Our current providers and their processing regions are listed on the sub-processor register.

We do not make decisions about you based exclusively on automated processing. If that ever changes we will tell you at the time of the decision, explain the personal information and principal factors it relied on, and give you the opportunity to submit observations to a person able to review it. You may also ask us for a copy of the personal information you have provided in a structured, commonly used technological format.

If a confidentiality incident affects personal information we hold, we record it in the register of confidentiality incidents that Quebec law requires us to keep. Where the incident presents a risk of serious injury we notify the Commission d'accès à l'information du Québec and each affected person with diligence, and we take reasonable measures to reduce the risk of injury and to prevent a recurrence. You may also complain to the Commission d'accès à l'information directly.

Where the EU or UK GDPR applies to the same incident, the equivalent duties apply: we notify the competent supervisory authority within 72 hours of becoming aware of a personal-data breach, unless it is unlikely to result in a risk to people's rights and freedoms, and we tell affected individuals without undue delay where the breach is likely to result in a high risk to them.

Ormeval has an optional assistant that uses a third-party large language model. The optional AI assistant is currently disabled, so no question of yours reaches a model provider today. The following terms apply when it is enabled, and our sub-processor list shows the current state. When you use it you are interacting with an AI system, and it is labelled as such in the product. Its answers are generated text and are marked as AI-generated.

The assistant is deliberately constrained: it answers only from Ormeval's own indexed and cited data, it does not produce figures, every number it quotes comes from our deterministic forecast engine, and it declines questions about securities, valuation or investment decisions. Your question, the retrieved passages from our own index, and up to six previous turns of the conversation are sent to the model provider. Nothing else about you is sent, and your questions are not used to train anyone's model.

Ormeval is a professional tool intended for use in the course of a trade or profession. It is not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us and we will delete it.

We use browser local storage to keep the service working, for example, remembering the assets you follow, your display preferences and which notices you have dismissed. This stays on your device. We do not use advertising cookies or third-party cross-site trackers. You can clear this data through your browser at any time; doing so will reset your saved preferences.

The usage analytics described above are gated on your consent, no analytics events are sent unless you accept. When you accept, events are recorded in our own first-party event store. PostHog is our named analytics sub-processor and receives a copy only while third-party analytics is switched on, on EU-hosted infrastructure; it is not enabled today, so today those events go no further than our own store. The sub-processor list shows the current state. You can change your choice at any time by clearing this site's data (which brings the consent banner back) or by contacting us. For the full breakdown of what we store and why, see our Cookie Policy.

We hold each category of data for a stated period rather than indefinitely:

• Account & cockpit records, for as long as the account is open, then 90 days after you close it or ask us to delete it, to allow for accidental deletion and to complete any billing reconciliation.
• Early-access interest & contact messages - 24 months from your last contact with us, then deleted.
• Alert & digest subscriptions, until you unsubscribe, then 30 days to honour the unsubscribe across in-flight sends, then deleted.
• Usage-analytics events, 14 months, which is one full annual cycle plus a comparison period, then deleted.
• Product-use records (the four actions described above), 13 months, one annual cycle plus a comparison month, then deleted.
• Billing records, 7 years, because tax and accounting law requires it; this period is not shortened by a deletion request.
• Security & error logs, 90 days.

Assumptions you set in a forecast are stored in your browser, not on our servers, and are removed when you clear site data. If you have an account we record that a driver was changed, never the value you put in it.

Proactive alert and digest emails are strictly opt-in. If you turn them on, we create one record for you on our servers holding your email address, the public asset names you follow, your role and alert preferences (so we can frame each move for your work), the date you opted in, and a per-recipient unsubscribe token. We also keep a small record of which alerts we've already emailed you, so you don't get the same move twice.

We only email you about material, publicly-sourced moves on the assets you chose to follow, never bought lists, never unrelated marketing. Every email carries a one-click unsubscribe (no login needed), and native “unsubscribe” in Gmail/Outlook works too. Unsubscribe and we stop sending immediately; ask us and we delete the record. If you never opt in, none of this data is created.