oro — Published by BCL. How oro collects, uses and protects your information — and the choices you have.
This Privacy Policy describes how BCL, a société par actions simplifiée (SAS) incorporated under French law, registered with the Registre du Commerce et des Sociétés of Paris under 885116467, having its registered office at 200 rue de la Croix Nivert, 75015 Paris, France ("BCL", "we" or "our"), acting as data controller, collects and processes your personal data in connection with your use of the oro service (the "Service"). BCL processes personal data in accordance with Regulation (EU) 2016/679 ("GDPR"), French Law n° 78-17 of 6 January 1978 as amended (the "French Data Protection Act"), the UK GDPR and Data Protection Act 2018 (where applicable), the CCPA/CPRA (where applicable), and any other applicable regulation.
Data controller (Article 4(7) GDPR): BCL, SAS au capital de [CAPITAL] €. Registered office: 200 rue de la Croix Nivert, 75015 Paris, France. RCS Paris [SIREN] / VAT FR [VAT]. Contact: sean@oro-ai.co.
Data Protection Officer (DPO): sean@oro-ai.co — Postal: DPO oro, BCL, 200 rue de la Croix Nivert, 75015 Paris, France.
We build oro to be respectful of your data:
When you take a photo for a check, it is transmitted to be analysed and to generate a mood reading and matching affirmation. The resulting mood signals (e.g. calm, bond, energy) concern your animal, not your own health, and are retained to show trends over time in your app.
Where the Service uses cookies or similar technologies, a consent mechanism compliant with CNIL recommendations and the ePrivacy directive lets you accept, refuse or configure non-essential purposes. Strictly necessary cookies (authentication, session, security) are exempt from consent. Detailed analytics or marketing technologies require your prior, revocable consent. No advertising tracker is used on surfaces intended for children.
We do not sell your data. We share it only with service providers acting on our behalf under Article 28 GDPR, bound by written sub-processing agreements. These may include:
An up-to-date list may be obtained at sean@oro-ai.co. Your data is never sold, rented or exchanged for commercial purposes.
We prioritise processing within the European Economic Area. Where a transfer outside the EEA is necessary, we rely on the mechanisms of Articles 44 et seq. GDPR — an adequacy decision (e.g. the EU-U.S. Data Privacy Framework where the importer is certified), the European Commission's Standard Contractual Clauses (Decision 2021/914), and supplementary technical measures (encryption, pseudonymisation, access controls) in line with EDPB Recommendations 01/2020.
Mood readings are produced by automated analysis of your photo. This supports a wellness feature and does not produce legal or similarly significant effects concerning you within the meaning of Article 22 GDPR. Outputs are estimates, may be inaccurate, and are not a diagnosis; you remain free to disregard them and to consult a veterinarian. In line with the EU AI Act (Regulation 2024/1689) transparency obligations, we inform you that oro uses an AI-driven system. We do not use your content to train our own models without your separate opt-in consent.
We apply appropriate technical and organisational measures given the state of the art and the risks, including: encryption in transit (TLS 1.2+) and at rest where applicable; password hashing with Argon2id or equivalent; least-privilege access controls and MFA for personnel accessing production; logging; regular backups and a tested incident-response procedure; and breach notification to the supervisory authority within 72 hours under Article 33 GDPR where required.
Under Articles 12–22 GDPR you have rights of access, rectification, erasure, restriction, portability, objection (including at any time to direct marketing), and withdrawal of consent, as well as the right to set post-mortem directives (Article 85 French Data Protection Act). To exercise them, contact the DPO at sean@oro-ai.co, providing proof of identity where necessary. We respond within one (1) month, extendable by two (2) months for complex requests.
If you believe processing of your data is non-compliant, you may lodge a complaint with a competent authority, in particular the French Data Protection Authority (CNIL): 3 Place de Fontenoy, TSA 80715, 75334 PARIS CEDEX 07, France — +33 1 53 73 22 22 — www.cnil.fr. Users in another Member State may contact their local authority.
United Kingdom — we process UK data under the UK GDPR and Data Protection Act 2018; UK users may complain to the ICO (ico.org.uk).
California — we recognise the CCPA/CPRA rights to know, delete, correct, opt out of the sale/sharing of personal information (we do not sell or share for cross-context behavioural advertising), limit use of sensitive information, and non-discrimination. Contact sean@oro-ai.co.
Other US states — residents of states with applicable privacy laws (Virginia, Colorado, Connecticut, Utah, etc.) have equivalent rights, exercisable at sean@oro-ai.co.
oro is intended for adults (18+) and is not directed to children. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact sean@oro-ai.co and we will delete it, in accordance with Article 17 GDPR.
We may update this policy to reflect legal, regulatory or technical developments; material changes will be notified at least thirty (30) days before they take effect. For any question relating to this policy or your data, contact sean@oro-ai.co (also DPO, legal notifications and support), or write to BCL — DPO oro — 200 rue de la Croix Nivert, 75015 Paris, France.
oro draws on veterinary research for wellness and educational purposes. It is not a diagnostic tool — see a veterinarian for any health concern.