Close

Orilo Privacy Policy

Effective date: September 29, 2026
Last updated: October 27, 2026

This Privacy Policy describes how Echotime Technology (a Cayman Islands exempted company) and its affiliates (collectively, "Orilo," "we," "us," or "our") collect, use, and disclose personal information when you use Orilo, our voice-first AI Host application (the "Service"), our websites, and other services that link to this policy.

Please read this Privacy Policy carefully. By using the Service you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

1. Personal Information We Collect

We collect personal information in the following ways.

1.1 Information you provide to us

  • Account information. First name or nickname, date of birth, and any other profile information you enter during onboarding. We use your date of birth to confirm that you meet the minimum age requirement for the Service.
  • Voice input and User Content. Recordings and transcripts of the voice conversations you have with your AI Host, including any files, images, or text you submit through the Service.
  • User Content. text, messages, voice recordings, and other data you submit to or generate through the Services, including content processed by third-party Al Providers as described in Section 1.3.
  • Memories. Preferences, interests, routines, and other facts you tell your Host, which the Service stores as "Memories" to personalize future sessions. You can review and update your Memories at any time in Settings, or delete them and turn Memory off.
  • Communications. Records of your communications with us, including support requests, feedback, survey responses, and correspondence.
  • Connected-account data. information you authorize third-party services to share with us through integrations you enable.
  • Third-party sign-in data. If you sign in through Google or Apple, we receive limited profile information from that provider, such as your name, email address, and a unique identifier, in accordance with your authorization.
  • Health and fitness data. on Android, when you enableHealth Connect, when you authorize Apple Healthkit categories. See Section 1.2 below for the categories, how we use this data, and how to revoke access.

1.2 Health and fitness data (Android — Health Connect)

The Orilo Android app integrates with Android Health Connect. We only read health data after you explicitly grant access, and only the categories below — we do not write data back to Health Connect. You can revoke access at any time from Android Settings → Health Connect → App permissions → Orilo.

  • Steps: Daily total step counts.
  • Sleep: Sleep session start and end times, used to calculate daily sleep duration.
  • Exercise: Exercise type, start time, and duration.

We access users' health data in two scenarios:

  • On-demand assistance: When users ask about their sleep, steps, exercise, or other health information, Orilo uses their authorized health data to respond.
  • Proactive assistance: With users' permission, Orilo may include health and wellness insights in their personalized Morning Coffee briefings.

Readings are processed by our AI inference and cloud providers under written confidentiality and data-protection obligations, and may be stored as part of the chat or agent task history that you can view and delete at any time. See also Section 1.4.

We never use Health Connect data, or data derived from it, for advertising, marketing, or re-marketing; sell or transfer it to data brokers, ad networks, or any other party for advertising purposes; or use it for credit-worthiness, insurance, employment, or similar eligibility decisions. Health Connect data is encrypted in transit and at rest, and we do not knowingly read it from users under 18.

1.3 Connect Orilo to Apps and Services

You can choose to connect Orilo to some apps and services provided by third parties. We call these "connectors". Once you set up a connector, Orilo gains new capabilities, such as checking your calendar.

By default, Orilo won't take important actions, such as writing calendar, without your approval. Many connectors can also be configured to allow Orilo to retrieve information without taking actions. You can change when Orilo needs to ask for your approval in Settings.

When you connect a connector, you authorize Orilo to exchange information with that connector to perform tasks on your behalf. Each connector has its own terms and privacy policy governing how it uses the information it receives.

We've designed Orilo to exchange only the data necessary to provide its services. For example, when you connect your outlook mail account, Orilo can search your emails but won't download your entire inbox unless you explicitly ask it to. Some connectors may also proactively share information with Orilo. For example, a calendar connector may automatically notify Orilo when your schedule changes. We'll let you know which connectors support this feature before you connect them.

You can disconnect a connector at any time. Once disconnected, Orilo will stop exchanging data with that connector.

1.4 Information we collect automatically

  • Log data. IP address, browser or app version, and information about your requests and how you interact with the Service.
  • Usage data. Features you use, the times you use them, session duration, and aggregate patterns of interaction with Orilo.
  • Information from Connectors. Information that Orilo retrieves or receives from connected services, such as emails and calendar events. Information used to perform tasks is considered part of your interactions with Orilo.
  • Device information. Device model, operating system, unique device identifiers, mobile network information, language, and time zone.
  • Location information. Approximate location inferred from your IP address and, when you explicitly grant permission for a feature that requires it, precise GPS location.
  • Permission information. Whether you have granted or denied permissions such as microphone access, precise location access, and notifications, together with information needed to operate those features.
  • Microphone data. When you grant microphone permission and use voice features, the Service processes audio captured through your device microphone to provide voice interaction.
  • Background Microphone Access. When you enable background playback in Lounge, Orilo may continue accessing your microphone while the app is running in the background, allowing you to interact with your AI Host without keeping the app open. Microphone access continues only during an active voice session. You can stop microphone access at any time by ending the voice session or disabling microphone access in your device settings.
  • Notification data. When you enable notifications, we may process a device push token and notification preferences to deliver service-related notices, reminders, security alerts, and marketing messages where permitted.
  • Cookies and similar technologies. We and our service providers use cookies, SDKs, and similar technologies to operate the Service, remember preferences, measure performance, prevent fraud, and support analytics. You can control cookies through your browser or device settings.

1.5 AI features and third-party model providers

When you use AI-powered features in the Services (including chatvoice messages, automations, tasks, personalized summaries or health insights), we process the information needed to generate a response on Orilo's systems. We may also use third-party artificial intelligence andcloud inference providers ("AI Providers") that process personal information on our behalf to run those features. Depending on product configuration and region, AI Providers may include companies such as Amazon Web Servicess, OpenAI and Openrouter.

Categories of information we may send to AI Providers include:

  • Messages and prompts you submit, and AI-generated outputs returned to you;
  • Context you authorize for a specific request, including data frorm connected third-party integrations you enable and, where permitted, Health Connect or HealthKit data as described in Section 1.2;
  • Account and session metadata reasonably necessary to operate the feature (for example user identifiers, timestamps, feature flags, and security signals). We do not include message bodies in routine error logs unless you contact support and we need that information to investigate a specific issue.

How we use this information: solely to provide, operate, secure, and improve the AI features you request; to prevent fraud and abuse; and to comply with law. We require AI Providers to process personal information under written confidentiality and data-processing obligations that are no less protective than this Policy.

Model training: We do not permit AI Providers to use your identifiable chat content to train their public foundation models. We may use aggregated or de-identified information to improve reliability and safety of the Services where permitted by law.

Retention and control: AI-related content is stored as part of your account history (for example chat or agent task history) that you can view. When you delete your account, we delete or anonymize associated data within a reasonable time, except where retention is required by law.

Your choice: Some AI features require sending personal information to AI Providers. Where we rely on consent, you may decline or withdraw consent as described. If you decline, you may still use non-AI parts of the Services, but AI features may not work. Where required by applicable law, we also provide an in-app disclosure before you send your first AI message.

1.6 Usage analytics and attribution

Orilo uses its own analytics service and AppsFlyer to understand app usage, installation sources, registration conversions and returns through Orilo links. We use these insights to measure channel effectiveness and improve the experience. Usage events include app launches, page views, control selections, onboarding progress, permission results, settings changes and sharing actions.

Our analytics records include installation and session identifiers, timestamps, relevant feature identifiers, device and app information, language, time zone, device-locale region, network type and, where available, installation-referrer information. Our servers also receive IP addresses when requests are delivered. AppsFlyer may process installation and account identifiers, IP addresses and approximate location inferred from them, device and app information, selected events and campaign parameters, and the Android Advertising ID where available.

The app sends the AppsFlyer installation identifier to our account service during supported registration or sign-in flows and includes it in our own analytics records. These records can be associated with your account and are not anonymous. AppsFlyer conversion events include sign-ins, onboarding completion and sharing-channel selections.

When advertising integrations are enabled, AppsFlyer may share relevant attribution data with advertising and measurement partners for campaign attribution and measurement. Sharing follows applicable permissions and legal requirements.

Our own usage events may be temporarily stored in private app storage and sent over HTTPS to Orilo's collection service, including through background delivery when connectivity is available. Our hosting providers process these records on our behalf.

Usage analytics is enabled by default, without a separate in-app participation switch. Previously saved choices to disable Orilo's own usage analytics remain effective. AppsFlyer starts automatically in the production Android app, without a separate attribution switch. You can manage available advertising-ID controls in Android settings; these do not necessarily stop other analytics or attribution processing or delete previous records. Where additional consent is legally required, device settings or acknowledging this Policy do not replace it. You can exercise applicable privacy rights through support@orilo.live, as described in Section 4.

Our usage events and the event parameters we send to AppsFlyer do not include passwords, verification codes, authentication tokens, names, dates of birth, contact details, conversation content, recordings, onboarding answers, feedback text, precise GPS location, health information or connected-app content. The health-data restrictions in Section 1.2 remain applicable. Service-provider protections, retention and deletion, and international transfers follow Sections 3, 5, 7 and 8. See also AppsFlyer's customer-data processing notice.

2. How We Use Personal Information

We use personal information for the following purposes.

  • Providing, maintaining, and improving the Service, including operating your AI Host, generating personalized morning briefs, and remembering your preferences. We also use account information, including date of birth, to verify eligibility and enforce age restrictions.
  • Processing voice input, providing speech recognition and speech synthesis, and enabling microphone-, location-, and notification-based features that you choose to use.
  • Developing and evaluating features, products, and services, including research on voice interaction, natural-language understanding, safety, and personalization.
  • Communicating with you, including sending service-related notices, security alerts, reminders, and marketing messages, which you can opt out of at any time where applicable.
  • Preventing fraud, abuse, and illegal activity, and enforcing our Terms of Service and other policies.
  • Complying with legal obligations, responding to lawful requests from public authorities, and protecting our rights and the rights of others.
  • Creating aggregated or de-identified information that cannot reasonably be used to identify you, and using it for any lawful purpose.
  • Operate, secure, and improve Al-powered features you use, ircluding processing your content through A Providers on our behalf, as described in Section 1C, and improve the Services using aggregated or de-identified data where permitted by law.

3. How We Disclose Personal Information

We do not sell your personal information. We disclose personal information in the following circumstances.

  • Service providers. Third-party vendors and service providers that perform services on our behalf, including cloud hosting, AI processing, speech-to-text and text-to-speech, analytics, customer support, communications, app-store billing support, fraud prevention, and security. These providers are permitted to process information only for the services they provide to us, subject to applicable contractual and legal restrictions.
  • Business transfers. If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or a portion of our assets, your information may be transferred as part of that transaction.
  • Legal requirements. We may disclose personal information to government or law-enforcement authorities, or to private parties, if we believe in good faith that disclosure is necessary to comply with applicable law, respond to legal process, protect the rights or safety of any person, or investigate suspected fraud or misuse of the Service.
  • Affiliates. We may disclose personal information to our subsidiaries and affiliates for the purposes described in this policy.
  • With your consent. We may disclose information with your consent, or at your direction.

4. Your Rights and Choices

Depending on where you live, you may have the following rights regarding your personal information.

  • Access a copy of the personal information we hold about you.
  • Correct information that is inaccurate or incomplete.
  • Delete your personal information, subject to certain exceptions.
  • Object to or restrict certain processing of your personal information.
  • Withdraw consent where we rely on consent as our legal basis for processing.
  • Port your personal information to another controller in a machine-readable format.
  • Lodge a complaint with a data-protection authority in your country.

To exercise these rights, contact us at the address in Section 10. You may also manage your account, review your Memories or delete them and turn Memory off, and delete your entire account directly from the Service's Settings menu, or follow the instructions on our Delete Your Account page. Deletion of your account will delete your Memories and content, except where we are required to retain records to comply with legal obligations, resolve disputes, prevent fraud, protect security, or enforce agreements.

You can manage microphone, precise location, and notification permissions through your device settings. You can opt out of marketing messages by using the unsubscribe method provided in the message or by contacting us.

5. Account deletion

You can delete your account at any time by going to Settings → Manage account → Delete account in the Orilo app and confirming your choice.

Once account deletion is complete, your account and all asssociated data-including your chat history, memories, tasks, and data synced from connected apps-are permanently deleted from Orilo's systems and are no longer stored in Orilo's cloud. Account deletion is permanent and cannot be undone.

Deleting your Orilo account removes the synced copies stored by Orilo. It does not delete your accounts or original data in the connected third-party apps.

6. Age Restrictions and Children's Privacy

The Service is intended only for individuals who are 18 years of age or older. Individuals under 18 may not create an account, access, or use the Service, even with the consent of a parent or legal guardian. We do not knowingly collect personal information from anyone under 18. If you believe that an individual under 18 has provided personal information to us or is using the Service, please contact us at support@orilo.live. If we learn that we have collected personal information from an individual under 18, we will take reasonable steps to suspend or close the account and delete the personal information, except where retention is required by law or necessary for security, fraud prevention, or legal compliance.

7. Security and Retention

We implement commercially reasonable technical and organizational measures to protect personal information against unauthorized access, disclosure, alteration, and destruction. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We retain personal information for as long as necessary to provide the Service, comply with legal obligations, resolve disputes, prevent fraud, protect security, and enforce our agreements. When we no longer need to retain personal information, we will delete or de-identify it.

Content processed for AI features (Section 1.4) is retained according to the same rules as your account and chat history unless a shorter period is required by law or your deletion request.

8. International Data Transfers

Orilo is provided by a Cayman Islands entity and processes information globally. When we transfer personal information across borders, we take steps to ensure the information receives an adequate level of protection, including through contractual safeguards such as the European Commission's Standard Contractual Clauses where applicable.

9. Links to Other Websites

The Service may contain links to third-party websites or services. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you use.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the Service or by other means before the changes take effect. Your continued use of the Service after the changes take effect constitutes your acceptance of the revised policy.

11. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us at:

Echotime Technology

Registered office:

Grand Pavilion, Hibiscus Way

802 West Bay Road

P.O. Box 31119

Grand Cayman KY1-1205

Cayman Islands

Email: support@orilo.live

Appendix A — Additional Disclosures for Residents of the European Economic Area, United Kingdom, and Switzerland

Controller

The controller of your personal information is Echotime Technology, the Cayman Islands entity identified above.

Legal bases for processing

We rely on the following legal bases under the EU/UK General Data Protection Regulation:

  • Performance of a contract with you, to provide the Service and honor the Terms of Service.
  • Our legitimate interests, including operating and improving the Service, preventing fraud, protecting security, and communicating with you, where these interests are not overridden by your rights.
  • Compliance with legal obligations.
  • Your consent, where required for specific processing such as marketing communications or optional device permissions.

Data-protection authority

You have the right to lodge a complaint with your local data-protection authority. We will always be happy to hear from you first, and encourage you to contact us before filing a complaint.

Appendix B — Additional Disclosures for United States Residents

This appendix supplements the Privacy Policy for residents of U.S. states with applicable comprehensive privacy laws.

Categories of information collected

In the past 12 months, we have collected the categories of personal information described in Section 1, including identifiers, account information, voice recordings and transcripts and usage data, device and permission information, approximate and precise location where authorized, notification data, and inferences drawn from that information.

Sale or sharing of personal information

We do not sell personal information in exchange for money. We do not share personal information for cross-context behavioral advertising.

Your rights

Depending on your state of residence and subject to applicable legal thresholds and exceptions, you may have rights to access, correct, delete, or obtain a copy of personal information, and to opt out of certain uses of personal information.

You may exercise applicable rights by contacting us at support@orilo.live. We will not discriminate against you for exercising your privacy rights.