Privacy

Privacy policy

Updated: 28 September 2026

1. Controller

The controller for personal data processing on orive.co is heybotti, proprietor Robert Linke, Stiftsgasse 17, 07407 Rudolstadt, Germany.

Email: robert.linke@me.com

2. What this policy covers

This policy covers visits to orive.co, seeker and facilitator accounts, ORIVE bookings, the facilitator desk (dezk), shop handoff to Shopify, and contact requests. Partner listings link to external providers; their privacy practices sit with the partner.

3. What data we process

Usage data: IP address (possibly truncated), timestamps, browser/device, pages viewed, referrer — to run the site securely.
Account data: name, email, authentication data, roles (seeker/facilitator), profile fields.
Booking data: offering, slot, price, status, booking-related messages, booking pass.
Payment metadata: Stripe customer/payment IDs, amounts, status — no full card numbers on orive.co.
Facilitator data: profile, listings, Stripe Connect status, payout-related details.
Intake / health-related answers: only when a facilitator requests them for a booking; used to deliver that booking. We treat them as sensitive and share them only with that facilitator.
Shop: product browsing on orive.co; checkout and customer data for purchases run on Shopify.

4. Purposes and legal bases

Art. 6(1)(b) GDPR — contract: account, booking, payment initiation, facilitator desk, support for the booked service.
Art. 6(1)(c) GDPR — legal obligation: commercial and tax retention, responses to authorities.
Art. 6(1)(f) GDPR — legitimate interests: IT security, abuse and fraud prevention, platform stability, aggregated product improvement.
Art. 6(1)(a) GDPR — consent: optional cookies/tracking or newsletters where used and separately obtained.
Art. 9(2)(a) GDPR — where special-category data (e.g. health answers in intake) is processed: explicit consent or necessity for the service the guest requested as part of the booking.

5. Recipients and processors

The facilitator of the booked service — name, contact, booking and intake details as needed to deliver.
Stripe Payments Europe, Ltd. — payments and payouts (Stripe Connect). Privacy: stripe.com/privacy.
Vercel Inc. — hosting and delivery of the site; transfers to the USA under appropriate safeguards (including SCCs).
Supabase — database and authentication (EU regions where configured).
Email / notification providers — transactional mail (booking, reminder, facilitator notices).
Shopify — only if you complete a purchase in the ORIVE Shop.
Authorities — only when legally required.

6. Retention

Account data lasts while the account exists and thereafter as long as legal retention or defence of claims requires. Booking and payment records typically up to 10 years (commercial/tax law). Logs shorter unless security needs longer. Intake answers: as long as needed for the booking and any aftercare/disputes, then deletion or anonymisation.

7. Cookies and local storage

We use technically necessary storage (e.g. session, language, theme, cart/checkout helpers) under § 25(2) TDDDG. Non-essential cookies or tracking are used only with consent where applicable. You can clear browser storage and cookies at any time; some features may then be limited.

8. Security

Transfers use TLS/HTTPS. Access to booking and facilitator data is role-restricted. Full card data sits with Stripe, not on orive.co. No one can guarantee absolute internet security; we apply appropriate technical and organisational measures.

9. Your rights

Access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), objection (Art. 21).
Withdraw consent at any time with effect for the future.
Lodge a complaint with a supervisory authority, in particular the Thuringian Commissioner for Data Protection and Freedom of Information (TLfDI), Häßlerstraße 8, 99096 Erfurt, Germany, tlfdi.de.

Requests to: robert.linke@me.com

10. Fairness for seekers, facilitators and ORIVE

Seekers: booking data is used to deliver and support the booking; no sale to unrelated third parties for advertising without consent.
Facilitators: guest and intake data only for the booked service and legal duties; no selling of guest lists.
ORIVE: the platform runs intermediation and infrastructure; stores only what operations, payment and law require; partner listings stay under the partner’s privacy regime.

11. Changes

We update this policy when services, recipients or the law change. The current date is at the top. Material changes will be indicated on orive.co.