GDPR & Data Processing

1. Data Controller

Orleia is an independent, non-profit project. As the application does not collect, store, or process personal data on any server, Orleia does not act as a data controller in the traditional sense. All data processing occurs locally on your device.

2. Data We Collect

Your workspace data stays on your device. Orleia stores everything you create - habits, journal entries, notes, tasks, spreadsheets, decks, and settings - exclusively in your browser's IndexedDB and localStorage on your device. We do not build advertising profiles. The only data that leaves your device is what you deliberately send: Noor prompts (to NVIDIA), search queries (to keyless search providers), and optional sign-in identity (to Supabase for authentication only). The site host (Vercel) receives standard, anonymized request metrics. Orleia is intended for users aged 16 and over, and we do not process personal data relating to minors.

3. Lawful Basis for Processing

As we process no personal data, there is no lawful basis required. The data you create is processed locally by your own browser for the sole purpose of providing the application's functionality. Where you choose to use Noor’s AI features, your prompts are sent to NVIDIA’s NIM API on the basis of your consent (Article 6(1)(a) GDPR), given through the explicit act of sending a message. You can withdraw consent at any time by simply not using AI features.

4. Your GDPR Rights

Under the GDPR, you have the following rights, all of which are inherently respected:

• Right to Access - All your data is already on your device. Export it anytime via Settings.
• Right to Rectification - Edit or delete any data directly within the application.
• Right to Erasure - Clear your browser data or use the "Clear All Data" option in Settings.
• Right to Data Portability - Export your workspace as JSON from Settings anytime.
• Right to Object - Stop using the application at any time. No data remains with us.
• Rights Related to Automated Decision-Making - AI features are optional and assistive, not decision-making.

5. International Transfers

No personal data is transferred internationally because no personal data leaves your device. If you use AI features via Noor, your prompts are sent to NVIDIA's NIM API servers which may be located outside the EEA. This is done with your explicit action (sending a message) and can be avoided by not using AI features.

6. Data Processing Agreement (DPA)

As Orleia processes no personal data on its servers, a formal Data Processing Agreement is not required. For AI features via Noor, the processing is governed by NVIDIA's own terms. Optional profile information you provide (name, preferences, etc.) stays on your device and is not processed by us.

• NVIDIA acts as a data processor when you send prompts to Noor
• Prompts are handled under NVIDIA’s own API terms after processing; Orleia cannot control NVIDIA’s internal logging
• You can avoid this processing entirely by not using AI features
• All core tools (habits, journal, notes, tasks) work fully offline without AI

7. Contact for GDPR Inquiries

For GDPR-related questions, email us at orleia.workspace@gmail.com (opens Gmail) or reach out via the Buy Me a Coffee page. Since we process no personal data, formal Data Subject Access Requests are not applicable, but we are happy to address any concerns.