Privacy Policy

1. Who we are

Orevox is a geopolitical risk intelligence API based in the Netherlands. For any privacy-related questions, you can reach us at orevox.admin@gmail.com.

2. What data we process

We process the following personal data:

• Email address — used to create your account and send your magic login link.
• API usage logs — which endpoint was called, timestamp, and IP address. Used for quota enforcement and abuse prevention.
• Session token — a short-lived JWT stored in your browser to keep you logged in. It contains your email address and role.

We do not process names, payment information, location data, or any other personal data beyond what is listed above.

3. Why we process it (legal basis)

• Email address: Performance of contract — you cannot use the service without an account.
• API usage logs: Legitimate interest — we need this data to enforce quotas and detect abuse.
• Feedback: Consent — if you submit feedback via our feedback form, we process that data with your explicit consent.

4. How long we keep your data

• Account data (email, API key): retained for the duration of your account, and deleted within 30 days of account deletion upon request.
• API usage logs: retained for a maximum of 12 months.
• Session tokens: expire after 8 hours and are not stored server-side.

5. Third parties (sub-processors)

We share data with the following third parties, strictly to deliver the service:

We do not sell your data to any third party. External data sources (EU Sanctions, OFAC, GDELT, World Bank) supply risk data only — no personal data is sent to them.

6. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your account and associated data.
• Object to processing based on legitimate interest.
• Data portability — receive your data in a machine-readable format.

To exercise any of these rights, email us at orevox.admin@gmail.com. We will respond within 30 days.

7. Complaints

If you believe we are not handling your personal data correctly, you have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

8. Changes to this policy

We may update this privacy policy from time to time. When we do, we will update the effective date at the top of this page. Continued use of the service after changes constitutes acceptance of the updated policy.