Privacy Policy

Effective Date: July 17, 2026 Last Updated: July 17, 2026

This Privacy Policy explains how Orato collects, uses, stores, protects, and shares information when you use the Orato website, mobile application, and related services (collectively, the "Services").

The Services are provided by XBLOOM HK LIMITED, registered at ROOM 1701, 17/F, WAI FUNG PLAZA, 664 NATHAN ROAD, MONG KOK, HONG KONG ("Orato", "we", "us", or "our"). XBLOOM HK LIMITED is responsible for the personal information processed by Orato.

Orato V1.0.0 is free to use and does not require an account or login. By using the Services, you acknowledge that you have read this Privacy Policy. Where consent is required, we ask for it separately before the relevant processing begins.

1. Information We Collect and How We Collect It

We collect information directly from you, automatically from your device when you use the Services, and from the results generated by the Services.

Information You Provide

Practice information, including the scenario you select, custom scenario text, speaking preferences, and feedback.
Audio, video, photos, recordings, file names, and other files that you actively record, select, or upload.
Communications you send to us, including support requests and product feedback.

We access media only when you record it in Orato or select it through the system file picker, camera, microphone, or photo library. We do not scan or transmit media that you have not selected for use with the Services.

Information Collected Automatically

Device and app information, such as device type, operating system, app version, language, region, and technical identifiers needed to operate the Services.
Usage and task information, such as features used, task status, processing time, errors, and interactions with the Services.
Network and diagnostic information, such as IP address, request time, server logs, crash information, and network errors.

Purchase and Entitlement Information

When you make or restore an Apple In-App Purchase, Orato may receive or generate information needed to verify and provide the purchase, including the product identifier, transaction identifier, purchase and expiration dates, subscription status, renewal status, storefront, price and currency information returned by Apple, and the availability or use status of a Video Pass.

Apple processes payment and billing information. Orato does not receive or store your full payment-card number or Apple Account password.

Information Generated by the Services

Speech-to-text transcripts and timing information.
Speaking analysis, feedback, scores, summaries, and improvement suggestions.
Improved scripts, optimized audio, subtitles, and generated videos.
Safety, moderation, and quality signals.
Voice characteristics and facial imagery needed to provide voice cloning, presenter generation, or lip synchronization.

2. Data Processing Overview

Information	Purpose	Typical Retention	User Choice
Selected scenario and custom scenario text	Configure the requested analysis	Retained with the related task until you delete it	You may edit or delete a custom scenario or task
Audio or video	Safety review, transcription, speaking analysis, improved content, optimized audio, and voice cloning	Retained while the related task remains in Profile; deletion rules are described in Section 9	You choose whether to record or upload it and may delete the task
Photo used for Create Video	Safety review and AI presenter video generation	Retained only as needed to process and deliver the related video task; deletion rules are described in Section 9	Create Video is optional
Transcript, analysis, improved script, optimized audio, subtitles, and generated video	Display and replay your results in Profile	Retained while the related task remains in Profile; deletion rules are described in Section 9	You may delete the related task
Device, usage, network, crash, and diagnostic information	Operate, secure, troubleshoot, and improve reliability	Normally retained for no more than 90 days unless needed for security, fraud prevention, or legal compliance	You may limit device permissions; essential server logs cannot be disabled while using online features
AI processing consent version and time	Demonstrate and manage your permission	Stored on the device until app data is removed, consent is withdrawn, or a new notice replaces it	You may refuse or later withdraw consent
Support communications	Respond to requests and resolve issues	Normally retained for up to 24 months after the request is closed	You may choose what information to include

Depending on where you live, we process information to perform the service you request, based on your consent, for our legitimate interests in security and reliability, or to comply with legal obligations. We do not use consent as a condition for features that do not require the relevant personal information.

3. AI Processing, Voice, and Facial Information

Orato uses AI systems to transcribe and analyze speech, generate feedback and improved scripts, create optimized audio, clone a voice selected by the user, and generate AI speaking videos.

Audio, video, and photos may contain voice, face, likeness, and other sensitive personal information. Orato processes these elements only to provide the feature you request, perform safety checks, prevent misuse, and troubleshoot the related task. Orato does not use voice or facial information to identify you or build an identity profile.

Orato does not use your uploaded audio, video, photos, transcripts, or generated results to train Orato-owned AI models. We also do not authorize our AI service providers to use Orato user content to train or improve their general AI models. HeyGen model-training use has been disabled through Orato's account configuration or contractual arrangements.

AI-generated results may be incomplete, inaccurate, unsuitable, or similar to results generated for other users. You are responsible for reviewing any result before relying on, publishing, or sharing it. Orato does not guarantee any interview, employment, sales, presentation, academic, or communication outcome.

4. Third-Party AI Services

Before the first AI task is submitted, Orato displays an in-app notice that identifies the information to be sent, the recipients, and the purposes, and asks for your permission. No selected media is sent to the providers below before you agree.

Provider	Information Sent and Collection Method	Purpose	Trigger
Alibaba Cloud Computing Co., Ltd. (Alibaba Cloud)	Audio or video you record or upload; audio extracted from video; voice, facial imagery, and spoken content contained in the file; selected scenario, transcript, language, duration, format, and limited task information	Content safety review, speech transcription, speaking-performance analysis, feedback and improved-script generation, optimized-audio generation, and voice cloning	After you agree and submit a task from Create
HeyGen Technology Inc. (HeyGen)	Photo, audio, or video you select for Create Video; optimized audio, speech text, subtitles, timing information, and limited task information	Content safety review, AI presenter generation, speaking-video generation, and lip synchronization	Only after you actively start Create Video

Alibaba Cloud

Alibaba Cloud processes the submitted content on Orato's behalf to provide cloud and AI services. Processing may include secure transmission, temporary storage, analysis, generation, safety review, and troubleshooting required to complete the task.

HeyGen

HeyGen processes content only when you choose Create Video. Automated moderation may review uploaded and generated content. Material flagged by automated systems may be reviewed by authorized personnel and may be rejected, removed, or restricted under applicable safety policies.

Orato has disabled use of Orato user content for HeyGen model training through account configuration or contractual arrangements. HeyGen may still process limited information as necessary to provide the requested service, maintain security, prevent abuse, comply with law, and perform authorized support.

5. Consent and Withdrawal

The AI data notice appears after you tap Continue on Create and before upload or third-party processing begins.

If you choose Agree & Continue, Orato records the notice version and time and submits the task.
If you choose Not Now, Orato does not upload the selected media or create the AI task.
Information is not sent to HeyGen unless you later choose Create Video.
If the provider, data categories, or purposes materially change, Orato will show an updated notice and ask again.

You may withdraw consent for future AI processing by contacting us at xbloom2025@outlook.com. Withdrawal does not affect processing lawfully completed before withdrawal, but AI analysis, voice cloning, and Create Video will no longer be available unless you provide consent again.

6. User Content and Other People

You retain ownership of the content you upload or record. Orato does not make your media, transcripts, or generated results public unless you choose to share them.

To provide the Services, you permit Orato and the providers identified in Section 4 to host, copy, transmit, transcribe, analyze, transform, moderate, and generate results from your content only as necessary to provide, secure, support, and troubleshoot the requested feature, comply with law, and enforce our policies.

Do not upload another person's voice, image, likeness, private information, or copyrighted material unless you have the rights and permissions required to do so. You are responsible for obtaining consent from people who appear or can be heard in your content.

7. How We Share Information

Orato does not sell your personal information, audio, video, photos, or generated results. We may disclose information only in the following circumstances:

To Alibaba Cloud and HeyGen as described in Section 4 and only after the required permission.
To infrastructure providers that host or securely deliver files and task results on Orato's behalf.
When required by law, legal process, or a valid government request.
To protect users, Orato, service providers, or others from fraud, abuse, security threats, or unlawful activity.
In connection with a merger, acquisition, financing, reorganization, or asset transfer, subject to appropriate confidentiality and notice requirements.
When you direct us or separately consent.
In aggregated or de-identified form that does not reasonably identify you.

8. Purchases, Analytics, Cookies, and Mobile Permissions

Apple In-App Purchases

Orato Pro is an auto-renewable subscription, and Video Passes are consumable In-App Purchases. Purchases are processed by Apple under Apple's terms and privacy policy. Orato uses StoreKit purchase information only to verify payment, unlock or restore subscription access, record unused or consumed Video Passes, provide support, prevent fraud, and comply with applicable accounting or legal requirements.

You can manage or cancel an Orato Pro subscription through your Apple Account or App Store subscription settings. Deleting Orato or deleting a task does not cancel a subscription. App Store billing and refund decisions are handled by Apple.

Analytics and Permissions

Orato does not use user media for advertising or cross-app tracking. If Orato adds or changes advertising, attribution, or analytics providers, we will update this Privacy Policy and any required App Store privacy disclosures before the new collection begins.

The website may use essential cookies or local storage for security, language, display preferences, and basic operation. It may also use limited first-party measurements to understand page reliability. You can control website cookies through your browser, although essential functions may be affected.

The mobile app may request:

Microphone, to record speech practice.
Camera, to record practice video.
Photos or Media Library, to select media for a task.
Photo Add Only, to save recordings created in Orato to your device.
Notifications, to provide task-status notices if this optional permission is enabled.

You can manage permissions in iOS Settings. Denying a permission prevents only the feature that requires it.

9. Retention and Deletion

Orato applies the following retention rules:

Active tasks, source media needed for those tasks, and generated results remain available while the task appears in Profile.
When you delete a task, it is removed from Profile immediately. Associated active-system files are deleted or irreversibly de-identified within 30 days.
Encrypted backup copies may remain for up to an additional 30 days before being overwritten, unless a longer period is legally required.
Intermediate files from rejected or failed AI tasks are deleted within 24 hours unless temporarily required to investigate abuse, security, or a user-reported error.
Operational logs and diagnostics are normally retained for no more than 90 days.
We may retain limited records longer where reasonably necessary to meet legal obligations, resolve disputes, prevent fraud or abuse, or protect legal rights. Such records are restricted to those purposes.

Third-party providers retain information only as permitted by Orato's service configuration, instructions, and agreements, or as legally required. Orato uses available deletion and retention controls and does not permit HeyGen to retain Orato content for general model training.

Deleting a recording from your device does not automatically delete a submitted task from Orato. To delete the server-side task and related results, use Delete in Profile.

10. Security and Incident Response

We use encrypted transmission, access controls, least-privilege permissions, logging, and organizational measures designed to protect information against unauthorized access, loss, misuse, alteration, and disclosure. Access is limited to personnel and providers who need it for an authorized purpose.

No transmission or storage method is completely secure. If we become aware of a personal-data incident, we will investigate, contain, and remediate it and notify affected users and authorities when required by applicable law.

11. International Processing

Orato is operated by a Hong Kong company and uses providers that operate internationally. Information may be processed outside your country or region, including where Alibaba Cloud, HeyGen, or their authorized subprocessors operate. Those locations may have different data-protection laws.

Where required, we use contractual, technical, or other legally recognized safeguards for international transfers. Provider-specific information is available through the policies linked in Section 4.

12. Your Rights and Requests

Depending on where you live, you may have the right to:

Request access to or a copy of personal information we hold about you.
Request correction of inaccurate information.
Request deletion of personal information.
Request a portable copy of information where applicable.
Restrict or object to certain processing.
Withdraw consent for future processing.
Lodge a complaint with a competent data-protection authority.

Submit a request to xbloom2025@outlook.com and describe the device, task, and request sufficiently for us to locate the information. Because V1.0.0 has no account, we may ask for reasonable task or device details to verify that the request relates to you. We aim to acknowledge requests within 7 days and complete valid requests within 30 days, unless applicable law permits or requires a different period. We will explain any extension or lawful refusal.

You will not be discriminated against for exercising an applicable privacy right.

13. Children

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. A user who is under the age of legal majority must use the Services only with the permission and supervision of a parent or legal guardian where required by law.

If you believe a child has provided personal information without appropriate permission, contact xbloom2025@outlook.com. We will investigate and delete the information when required.

14. Third-Party Links

The Services may link to third-party websites, app stores, or provider policies. Their independent services are governed by their own terms and privacy policies. Orato remains responsible for its own collection, instructions, disclosures, and provider selection as described in this Privacy Policy.

15. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in the Services, providers, law, or security practices. We will update the date above and provide additional in-app notice where required. If a change materially affects the provider, information, or purpose covered by AI consent, we will request consent again before the new processing begins.

16. Contact Information

If you have questions, requests, or complaints about privacy, contact us:

Company: XBLOOM HK LIMITED

Address: ROOM 1701, 17/F, WAI FUNG PLAZA, 664 NATHAN ROAD, MONG KOK, HONG KONG

Privacy Email: xbloom2025@outlook.com

Support Email: xbloom2025@outlook.com

Website: https://oratoaifly.com