Trust and privacy
Privacy Policy
This page explains, in plain language, how Oredra handles information submitted through the public website and the Oredra application.
Information you provide
Oredra may receive account details, company profile information, security documentation, questionnaire files, support messages, and other information you choose to submit.
How information is used
Information is used to provide the service, maintain your approved company security profile, draft documents and questionnaire responses, support users, protect the platform, and improve reliability.
Google sign-in
If you choose Continue with Google, Oredra receives the basic Google account information needed to authenticate you, including your email address and basic identity information presented by Google such as your name or profile information. Oredra uses this information for account authentication and sign-in. This sign-in flow does not request access to your Gmail, Google Drive, Google Calendar, or Google Contacts.
Security documentation
Oredra distinguishes written policies, stated practices, implemented controls, available evidence, tested controls, and independent certifications. Uploaded information is not used to invent or strengthen unsupported claims.
Service providers
Oredra may rely on hosting, authentication, storage, payment, email, and AI service providers to operate the platform. Access should be limited to what is needed to provide those services.
Retention and deletion
After a customer-requested paid subscription cancellation, Oredra provides a 10-day read-only window after paid access ends so the customer can review and download existing workspace information. After that window, normal workspace access is locked and Oredra initiates removal of active workspace records and app user accounts. Oredra's application infrastructure provider may retain deleted custom-table records in a recoverable deletion system for up to 30 days. Oredra's current app-layer storage interface does not provide a verifiable per-file erasure operation for private uploads, so Oredra does not represent provider-side permanent deletion as complete unless that state can be verified. Information may also be retained where reasonably necessary for security, legal obligations, or dispute resolution.
Contact
Questions about this policy can be sent through the Oredra contact page.
Last updated: August 15, 2026