Privacy Policy

1. The Short Version

We do not collect, transmit, or store your dataset content — not a single cell value, column name, or row count. Section 2 below describes, in full, every network contact the Software makes with servers we operate, and none of it includes the data you process with the Software. Two things derived from your data can leave your computer, and both are described there: a support bundle, only if you choose to send one (its column names are replaced before it is sent, but it shows file paths and can contain a value the engine wrote into its log); and, during a free trial only, one-way fingerprints of the trial dataset and of the run's saved intermediate results, computed with a secret that never leaves your computer, so that the single trial run can be resumed but not repeated on other data. A fingerprint cannot be turned back into any value, column name or row count. Separately, if you point the Software at a database or a cloud storage location you specify, it connects directly to that source to read your data — never through us, and never through any server we operate, as explained at the end of Section 2.

2. What We Collect — and What We Never Collect

The Software makes network contact with servers we operate only for the following purposes:

• Licence heartbeat — a check that your licence key is still valid, sent to our licence server every three minutes, whatever the result. Only the notice you actually see in the Software waits for a change — the check itself runs on this fixed schedule the whole time the Software is open, so that a revoked licence takes effect quickly rather than at your next launch.
• Automatic activation — whether you signed up inside the Software or on our website and then opened the activation link we sent you, the Software exchanges the single-use token in that link for your licence key. If the signup itself was started inside the Software, it also sends a one-time random value the Software generated when it started that signup — proof to us that the redemption is coming from the same copy of the Software that began it, so a link someone else sends you cannot silently activate on your computer. When the signup instead started on our website, no such value exists to send, and the Software asks you to confirm before activating rather than proceeding silently. The token is used once and then expires, and neither the token nor this one-time value reveals anything else about you.
• Machine activation — when the Software activates on a computer, it sends your licence key together with one-way, salted digests of that machine's hardware and operating-system identifiers (never the raw identifiers themselves), and whether the computer is a virtual machine, read from the maker and model its firmware reports (a free trial runs only on a physical computer; a paid licence works on a virtual machine too). Our server stores each digest only after keying it again with a secret that never leaves the server, so a copy of our records cannot be matched back to a machine's identifiers. Activation also registers a public key created inside the computer’s security chip (the Software requires Windows 11 with a TPM 2.0 chip): the chip keeps the matching private key and never lets it leave the chip, so we receive only the public key — never the private key, and nothing about your data. That public key lets a later licence check confirm a request comes from the same physical computer, so a copy of an installation moved to another computer can be told apart from the original. A computer whose security chip the Software cannot use is not activated, on any plan. Activation also proves the security chip is genuine — each chip starts one free trial, and a licence is recorded against the chip that proved it: the Software sends the chip’s endorsement key (the public key its maker certified) and the maker’s certificate for it; our server checks that certificate against the chip makers’ published certificates and answers with a one-time challenge only that chip can open, and activation returns the challenge’s identifier and the value the chip opened. We keep a one-way digest of the endorsement key, keyed with a secret that never leaves our server, and the chip maker’s name — not the key and not the certificate. A computer without a certified chip gets no free trial. This happens as a routine part of every activation — so that a single seat cannot be shared across many machines — not only when a problem is suspected.
• Machine deactivation — when you free a seat so the licence can move to another computer, the Software tells the licence server which machine to release, and records the release in our licence ledger.
• Trial usage — during a free trial, the Software asks our server for permission before the single trial run starts, and tells it as the run progresses and when it finishes. With those requests it sends one-way fingerprints of the trial dataset and of each saved intermediate result of the run, computed on your computer with a secret that never leaves it — so the run can be resumed after a crash on the same data, but not repeated or pointed at other data. A fingerprint cannot be reversed into any value, column name, row count or file name, and is not sent at all for a paid licence. Each of these requests, and the request for the run’s methodology key, also carries the same security-chip signature as a check-in, so the trial’s run is given only to the computer it was activated on.
• Offline check-in — when the Software starts, then once a day while it is open (every hour unless the Software has confirmed the computer is physical, and in a remote desktop session), once more when a run first needs the Software's protected settings on that computer, and again if a check-in did not get through, after a successful licence check, the Software tells our server that this machine still holds the licence. It sends your licence key, the same machine digest as an activation, whether the computer is a virtual machine, whether the Software is running in a remote desktop session, a random number made fresh each time the Software starts (it says nothing about you or your computer; it lets our server tell two copies running at the same time — two copies of one virtual machine, or two remote desktop sessions on one computer — apart from one copy restarted), and a counter that goes up by one with every check-in (so our server can tell when the computer is running from an earlier saved copy of itself, such as a restored backup or virtual-machine snapshot), the public half of a key the computer uses to receive the Software's protected settings; the check-in also carries a short signature made by the computer’s security chip, with the key registered at activation, over a one-time value our server provides — proof that the request comes from the same physical computer. Whenever the chip can make it, the check-in also repeats the proof activation made (the chip’s endorsement key, the maker’s certificate and the value the chip opened), so our server can tell the activated computer from a copy of it. The signature reveals nothing about you or your data. If the chip cannot make the signature at that moment, the Software sends a short code saying why instead; the check-in is not refused for it. The server uses the days on which it heard from a paid machine to decide how long that machine may keep working without a connection (two days for a trial or a new installation, up to seven once the installation is established); that window is sent back inside the licence server's signed answer. A computer that is not recorded as a physical computer and is seen running from an earlier saved copy of itself gets no offline window for 30 days. Before a signed check-in, the Software asks our server for the one-time value it signs; that request carries your licence key and the machine digest.
• Licence-key recovery — only if you choose "I lost my licence key", the Software sends the email address you type to our server, which emails the key to that address if it holds a licence.
• Support bundle — only if you choose to create and send one (Settings → Privacy & Data, or the recovery banner, which both show this list before the button): a summary of your computer (operating system, processor count, graphics card and memory, the OreML version, which of your computer's identity readings were available — yes or no for each, never the value — how each step of the last run ended, and this installation's anonymous id); OreML's speed measurements for your processor and graphics card; the last part of OreML's own app log; and, for the run you choose, its report, its run log and its audit files. Before anything leaves your computer, every column name in those files is replaced by a neutral placeholder (column_1, column_2 …), and the engine's catalogues of category values and identifier columns are left out. The files still show the data source and file and folder paths on your computer, and can contain a single value a step wrote into its log (for example the value used to fill gaps in a column); a column name that is only a number or a single character is not replaced. The upload carries your licence key and the same machine digest as an activation, so the bundle is filed under your licence and links this installation's anonymous id to it. Your data files, exports, charts and reports are never included. Bundles are deleted 90 days after we receive them.
• Billing links — when you choose to pay, subscribe, add or update a payment method, or cancel, the Software asks our server for the correct link to open in your browser (or, for Pay now, asks our server to take the payment already authorised for your subscription). No card details ever pass through the Software.
• Cancellation feedback — after cancelling, you're offered a short, optional panel asking why you're leaving. If you choose to answer, it sends the reason you picked from a short list, together with anything else you typed. Nothing is sent if you skip it.
• Integrity notice — if the Software detects that its own installed files have been altered, it locks its licensed features locally and tells our server, so that the licence can be reviewed. It sends your licence ID, the same digests as an activation, a short summary of the reason, and a count of how many files were affected — never a file name, a file path, or the contents of any file. The same notice is sent, with a count of the records concerned, if the Software finds that its own licence records on your computer (the files in which it keeps your licence's last answer and its offline record) were changed after it wrote them; the licence can then be locked until you contact support. It is also sent, as an alert that never locks, with a short description of each (never a file name or a path), when a setting or record the Software keeps for itself on your computer — its measured speed and memory profiles, its update record, its list of notices — is changed or removed outside the Software. Like a check-in, the notice carries a short signature made by the computer’s security chip over a one-time value our server provides, so our server places a lock only for a notice that comes from the activated computer.
• Environment notice — if the Software detects that another program has attached to it — a file loaded into its process from outside its own folders, a debugger or tracer attached to it, its remote-attach interface switched on, or its own program code changed in memory — it locks its licensed features locally until you close that program and restart it (where the only finding is a file loaded into its background processing component — which graphics drivers and overlays commonly do — it does not lock and only tells us), and — only if you allowed it in the Software (asked when you activate it, unticked by default, and changeable at any time in Settings → Privacy & Data) — tells our server at once, so that we can tell security software from a real problem. If you did not allow it, nothing is sent; the local lock works the same either way. It sends your licence ID, the same digests as an activation, a code for each kind of thing it found (chosen from a fixed list), the file name — never the folder or the path — of up to eight files that other program loaded or of the Software's own files whose code was found changed, the Software's version, and your operating-system family (Windows, Linux or macOS). Like a check-in, it also carries a short signature made by the computer’s security chip over a one-time value our server provides, so our server places a lock only for a notice that comes from the activated computer. It never sends the contents of any file, a path, a column name, or anything about your data. The check looks only at what has been loaded into, or attached to, the Software's own process on your computer — it does not read your files or any other program's data; to check the Software's own code it compares that code in memory with the Software's own file on your computer, and only the result leaves your computer. The lock it triggers is applied automatically; you can ask a person at support@oreml.com to review it and to hear your point of view. We keep these notices with your licence record for as long as needed to administer the licence, investigate misuse and meet legal obligations.
• Downloads — fetching the installer, an update, or the optional GPU acceleration package.
• Update check — a check for a newer version of the Software: a minute and a half after launch, then every six hours, and when you choose Check now. It sends your operating system, processor type and installed version, plus your licence key and the same machine digest as an activation, so that an update is offered only to a licensed computer; the engine sends the same when it starts, with its own version.
• Trial and account emails — the welcome, mid-trial and trial-ending emails, and a short note after a subscription ends, are sent by our email service provider. To send them at the right time we give it your email address, your trial’s start and end dates, and which of a fixed list of account moments has happened (trial started, trial over, paid, licence locked) — never anything about your data or your files. Each of these emails carries an unsubscribe link. Licence-key, receipt and other service emails are sent by us directly and are not marketing.
• Opt-in diagnostics — diagnostic and usage information that never includes anything from your files: a random install identifier; the product version; your operating system and Python interpreter version; which GPU acceleration backends your machine could support; how long each pipeline step took; an overall completion rate; a per-step acceleration-backend field that is currently always empty, reserved for future use; a count of errors encountered; which step failed, a bounded error code, and a general reason the run ended, each drawn from a fixed list rather than free text; and a crash-grouping signature — a one-way fingerprint of the failing code location, never the error message itself, a file path, or a local variable; the engine build the run used, which updates independently of the product version; the total physical memory of your machine, in whole gigabytes; and the peak memory the OreML process itself used during the run. Nothing in that list describes your data: not its size, not its shape, not the number of rows or columns, not a column name, and not a value. Sent as a single batch at the end of a run, only if you explicitly enable it in Settings, and never while a run is in progress. This is off by default.
• Usage events — when your licence is active, the Software tells our server which of a fixed list of actions you performed and when: opening the Software; starting, completing or stopping a pipeline; a step failing; answering a review prompt; opening a report, export or settings window; changing the diagnostics setting; requesting an update; and deactivating a machine. Each event carries your licence ID and the same machine digest as an activation. It never carries a file name, a value, a column name, a row count, or anything you typed. We use these events to operate the service, support you, and administer your licence; they are recorded against the account that holds the licence.

Because each of the contacts above is an ordinary network request, it necessarily carries your device's source IP address. We use the IP address only to secure your licence and detect abuse — for example, one licence appearing from many different locations at once — and it is never combined with, and never reveals, anything about the data you process.

Database and cloud sources you specify. If you configure the Software, from the Database or Cloud tabs, to read from a database or a cloud storage bucket you specify, the Software connects directly to that source — using the connection details and credentials you provide — to load your data. That traffic runs only between your computer and the source you chose; it is not one of the contacts listed above, it never passes through us or any server we operate, and we never see it, its credentials, or its contents.

We never collect, transmit, or store the content of any dataset you process with OreML — no cell values, no column names, no row counts, no file contents, and no file names. The only items derived from your data that leave your computer are the trial fingerprints described above, which reveal none of those things, and — only if you choose to send one — a support bundle as described above. This is a structural property of how the Software is built, not a configurable setting.

3. The Persistent Identifier in Your Exported Files

Separately from the network contacts above — and never transmitted anywhere — the Software embeds a persistent, one-way identifier in the file metadata of every Parquet, Feather and Excel file you export (in Excel, as a document property, never as a cell). It is not written into CSV, JSON, or any other format without a file-metadata layer, which are left unmarked.

It identifies your licence, not you as an individual; it cannot be reversed to recover your licence key or any personal data; it touches no cell, column, or row of your actual data; and it survives table-level rewrites of the file, so it persists into files you build from your export and forward to someone else — though not through a dataframe library, which discards file metadata when it writes a new file. We disclose it here because, even though it never travels over a network and is never received by us, it is information about your licence that rides along inside output files you control and may choose to share.

4. Legal Basis for Processing

Where the UK/EU GDPR applies, we rely on the following legal bases:

• Legitimate interests (GDPR Recitals 47, 49, and 50) for the licensing, activation and abuse-prevention contacts and usage events described above — necessary for fraud prevention, network and information security, and reporting unauthorized access to a competent authority.
• Consent for opt-in crash/usage telemetry, which you may withdraw at any time by disabling it in Settings.
• Performance of our contract with you (GDPR Article 6(1)(b)) for creating your trial or subscription, sending your licence key, the confirmation link and the account emails described in Section 9, and administering your licence.

5. Payment Data Is Handled Separately by Paddle

Purchases are processed by Paddle.com Market Ltd ("Paddle"), which acts as the Merchant of Record and an independent data controller for your payment information (name, email address, billing address, and card details). OreML does not receive, process, or store your payment card details. We do receive from Paddle the email address and name on your Paddle account and the state of your subscription (for example trialing, active, past due or cancelled), so that we can send you your licence key and account notices, link your licence to your subscription, and lock or restore your licence when your subscription changes. Paddle's own privacy practices are described at paddle.com/legal/privacy.

6. Data Retention

Licence and machine-fingerprint records — including the security-chip (TPM) public key registered at activation, and the one-way digest of the security chip’s endorsement key that a free trial and a computer’s licence are recorded against — are retained for as long as needed to administer your licence, prevent abuse of the free trial, and comply with legal obligations. Opt-in telemetry, if enabled, is retained only as long as necessary for diagnostic purposes and is never linked to your dataset content, which we do not receive in the first place. Usage events are retained for 90 days. Single-use confirmation and activation tokens are deleted 30 days after they are used or expire. The record that you accepted our Terms and this Privacy Policy (which version, when, and a one-way hash of your email address and of your IP address) is kept for as long as you hold a licence and for the limitation period afterwards, because it is the evidence of what you agreed to.

7. Your Rights

Depending on your location, you may have the right to request access to, correction of, or deletion of personal data we hold about you (such as your licence ID, machine fingerprint, or the usage events recorded for your account), to object to or restrict certain processing, and to lodge a complaint with your local data-protection authority. To exercise any of these rights, contact support@oreml.com. If you are in the United Kingdom you may also use our UK representative — see Section 14. You may lodge a complaint with your local supervisory authority; in the United Kingdom that is the Information Commissioner's Office (ico.org.uk). For requests concerning your payment or billing data, please contact Paddle directly, as they are the controller for that information.

8. Data Security

Licence-related data is encrypted in transit, stored on access-restricted infrastructure in the European Union, and backed up nightly to encrypted storage. Because we never receive your dataset content, the security of your underlying data is governed by your own device's security, not by us.

9. Cookies and This Website

This website (oreml.com) does not itself set any cookies. It uses your browser's session storage only — cleared automatically when you close the tab — to remember standard advertising campaign parameters (source, medium, campaign) if you arrived here via a marketing link, so a signup completed later in the same visit can be attributed to that campaign. This is not a cookie, is not combined with any other identifier, is never sent to any third party, and disappears on its own. It is used only to tell us which marketing channel a signup came from — never to identify you individually or to track you across other websites.

We do not use advertising or cross-site tracking cookies of our own, and we run no analytics on this website today.

Signing up on this website. When you start a free trial (or a subscription) from the form on this website, we receive the email address you type, whether you are signing up as an individual or a business, the Terms version you accepted, the campaign parameters described above if any, and — from the network that carries the request — your approximate country and postal area and your IP address. We send a confirmation link to your email address; for a new trial, only after you open it do we ask Paddle to create the trial, passing your email address and that approximate country and postal area (Paddle needs a location to apply the right tax). We keep a one-way hash of your email address (in a form that treats different spellings of the same mailbox as one, so that a trial is offered once per person) and a one-way hash of your IP address; we do not keep your IP address itself. If you start the signup from inside the Software, the Software adds a one-time random value to the page address, as described under "Automatic activation" in Section 2. On the download page, if your licence-key email has not arrived, you can choose to have the key shown in the page once; it is not stored by the page.

The emails we send you. Because you hold a licence, we send you the emails needed to run it: the confirmation link, your licence key, notices about your trial, payments, cancellation, locks and your licence, and replies to messages you send us. These are sent from licence@oreml.com through Cloudflare's email service. We also send a few short onboarding emails from hello@send.oreml.com through an email-delivery provider: during a free trial, up to three (a welcome, a mid-trial check-in and a reminder before the trial ends); when you first pay, one welcome; and if a paid subscription ends, one follow-up a few days later; you can ask us to stop these at any time at support@oreml.com, without affecting the emails needed to run your licence.

10. International Transfers

Our licence server and machine ledger are hosted in the European Union, in Germany. We use service providers to run the Service on our behalf: a network and hosting provider (which carries requests to us, runs our server logic, stores files and sends our licence and account emails), a managed database provider (the ledger, hosted in Frankfurt, Germany), a server provider (the licence server, hosted in Nuremberg, Germany) and an email-delivery provider (the onboarding emails described in Section 9). Each processes personal data only to provide its service to us, and we will name any of them on request at support@oreml.com. Requests reach them through a global content-delivery network, which may process the request in transit outside the EU/UK under its own safeguards. Paddle, as the Merchant of Record and an independent controller for your payment data, may process and transfer that data outside the EU/UK under its own safeguards — see Paddle's privacy policy for how it handles international transfers of your payment data.

11. Children's Privacy

The Service is not directed at, and is not intended for use by, children. We do not knowingly collect personal data from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated "Last updated" date above.

13. Who We Are, and How to Contact Us

The data controller for the personal data described in this policy is OBSITH, trading as OBSITH / OreML — a sole proprietorship (Ατομική Επιχείρηση) established and registered in Greece, identified by the registration numbers below.

• Registered address: Ag. Lavras 42, 18450 Nikaia, Attica, Greece — Αγ. Λαύρας 42, 18450 Νίκαια, Αττική
• General Commercial Registry (ΓΕΜΗ) number: 195473709000
• Tax identification number (ΑΦΜ): 134747475 — EU VAT: EL134747475
• Contact: support@oreml.com

Questions about this Privacy Policy, about the Software, about your licence or subscription, and any request concerning your personal data can all be sent to support@oreml.com. That is the fastest route and the correct one for every country.

14. Our Representative in the United Kingdom

We are established in Greece and have no establishment in the United Kingdom. Under Article 27 of the UK GDPR we have appointed DataRep as our Data Protection Representative in the United Kingdom. If you are an individual in the United Kingdom, or a UK authority, you may reach us about the processing of your personal data through DataRep, in any of these ways:

• Email: datarequest@datarep.com — quote OBSITH / OreML in the subject line
• Online form: www.datarep.com/data-request
• Post: DataRep, 107-111 Fleet Street, London, EC4A 2AB, United Kingdom

When writing by post, address your letter to "DataRep" and not to OBSITH / OreML — mail addressed to us rather than to DataRep may not reach them. Please also name OBSITH / OreML clearly in your correspondence so that it can be routed to us. We may ask you to evidence your identity before acting on a request, so that your personal data is never disclosed to anyone but you.

This representative route is for individuals and authorities in the United Kingdom only, and only for matters concerning the processing of personal data. For every other country, and for anything else — support, billing, or the Software itself — please write to support@oreml.com instead. DataRep handles the personal data it needs in order to act for us in line with its own privacy notice at www.datarep.uk/privacy-policy.