Privacy Policy

Last updated: May 7, 2026

1. Controller

Represented by: Stefan Veit (Managing Member)

Email: [email protected]
Phone: +49 163 6198195

2. General Information

We take the protection of your personal data very seriously. This Privacy Policy transparently informs you about which data we process, for what purpose, and on what legal basis.

The core application (dashboard, video generation, etc.) and the temporary processing of uploaded files run on servers located in Germany.

3. Website Data Processing

When you visit our website (hosted on Cloudflare Pages), technical data such as IP address, browser type, operating system, and access time is automatically recorded in server logfiles. This data serves the technical provision, security, and optimization of the website.

4. Google Analytics 4 (GA4)

This website uses Google Analytics 4, a service provided by Google Ireland Limited. We have enabled IP anonymization. Data is transferred to the United States. Google is certified under the EU-US Data Privacy Framework.

Legal basis: Your consent (Art. 6(1)(a) GDPR). You may withdraw your consent at any time via the cookie banner.

5. Registration and Use of Our Services

To use our plans (Free, Bronze, Gold, Platinum) we collect the information you provide, such as name, email address, company name, and any further details required to perform the contract.

We process this data for the performance and administration of the contract with you (Art. 6(1)(b) GDPR).

6. Payment Processing with Paddle

Payments and subscriptions are processed via Paddle (Paddle.com Market Limited) acting as Merchant of Record. Paddle is your direct contracting partner for the purchase and processes all data required for payment.

We do not receive full payment data from Paddle, only confirmation of successful payment.

Further information: Paddle Privacy Policy

7. Storage of Videos and Texts

Your uploaded videos and texts are stored primarily in your own Google Drive. For processing, we load these files only temporarily onto servers located in Germany and delete them immediately after processing is complete. See Section 8 for the specific Google API scopes we use and the sub-processors involved in the processing flow.

8. Google API Services User Data

8.1 Data Accessed

When you connect your Google account to OrvienLabs, our application requests the following OAuth scopes:

• https://www.googleapis.com/auth/userinfo.email: your email address, used solely to identify your OrvienLabs account and to display it.
• https://www.googleapis.com/auth/drive.file: per-file access restricted to files you explicitly select via the Google Drive picker or that our application creates on your behalf. We do not see, list, or access any other files in your Drive.

8.2 Data Usage

Your Google Drive is the primary storage location for all user-specific data that OrvienLabs needs to operate. Within the drive.file scope (see Section 8.1), OrvienLabs creates a dedicated folder structure in your Drive at first connection, and from then on reads and writes only files within that structure. The drive.file scope means OrvienLabs has no access to any other files in your Drive.

The data stored in this OrvienLabs-managed area covers all aspects of the application's functionality, including (but not limited to):

• Personalization and configuration
• Customer / lead records you create or import
• Scripts and other text content you upload or generate
• Email and message templates
• Screenshots and other user-uploaded media
• Generated output (voice files, videos, and other artifacts produced by the application)

One concrete user-initiated pipeline that involves the external sub-processors named in Section 8.3 is voice-intro generation:

• Voice generation: when you trigger a voice intro, the generated text (e.g. "Hello Mr. Smith") is sent to ElevenLabs, which returns a voice file.
• Lipsync: the short (~3 second) intro video that you have stored in your Drive is fetched via drive.file, combined with the generated voice file, and sent to sync.so, which returns a lipsynced video.
• The final output video is written back to your own Google Drive. We do not retain copies on our servers beyond the temporary processing window described in Section 8.4.

8.3 Sub-Processors

The following sub-processors may receive content derived from your Google Drive in the course of fulfilling your video-generation requests:

• ElevenLabs (ElevenLabs Inc.) receives generated text snippets (such as personalized greetings) and returns synthesized audio. ElevenLabs receives only the text required for synthesis, never the original Drive files. See the ElevenLabs Privacy Policy.
• sync.so (Sync Labs, Inc.) receives the short intro video fetched from your Drive together with the generated audio and returns a lipsynced video. See the sync.so Privacy Policy.

8.4 Storage & Retention

Files derived from your Google Drive are processed transiently on our servers in Germany only for the duration required to complete the requested operation, and are deleted immediately after the operation finishes. The final output video is written back to your own Google Drive; we retain no persistent copy of your Google user data on our servers. Logs that may incidentally reference filenames or operation metadata are kept only as long as required for debugging and security purposes, in line with the retention rules described in Section 11.

8.5 No AI/ML Training

Google user data accessed via the scopes listed in Section 8.1 is never used to develop, improve, or train generalized or non-personalized AI or machine-learning models, neither by OrvienLabs nor by our sub-processors. The only sub-processors that handle Google-derived content are ElevenLabs (which receives generated text derived from your leads for voice synthesis) and sync.so (which receives a Drive-fetched intro video together with the generated audio for lipsync), as described in Sections 8.2 and 8.3. All other use of Drive content by OrvienLabs is plain file I/O without any AI/ML processing.

8.6 Google API Services Limited Use Disclosure

OrvienLabs's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

8.7 Revoking Access

You can revoke OrvienLabs's access to your Google account at any time directly in your OrvienLabs settings. When you do, the access token we hold is deleted from our database and OrvienLabs can no longer access your Google Drive in any form. As an alternative, you can revoke access from your Google Account permissions page at https://myaccount.google.com/permissions.

Revoking access does not delete content already stored in your own Google Drive, nor does it affect non-Google account data (such as your registration record and payment history), which we retain on the legal bases described in Sections 5 and 6 independently of your Google authorization.

9. Newsletter and Transactional Emails

For sending newsletters or automated emails, we use an external email service provider. Your email address is processed only with your consent or to perform the contract. You can unsubscribe at any time.

10. Your Rights

You have the right at any time to:

• access the personal data we have stored about you;
• have inaccurate data corrected or incomplete data completed;
• request erasure of your data (the "right to be forgotten");
• request restriction of processing;
• object to processing;
• data portability;
• withdraw any consent you have given.

Contact: [email protected]

You also have the right to lodge a complaint with a data protection supervisory authority.

11. Storage Duration

We store your personal data only as long as necessary for the respective purpose or as required by statutory retention obligations.

12. Changes to this Privacy Policy

We reserve the right to update this Privacy Policy as needed. The current version is always available on this page.