Privacy Policy

Ormalin collects only the data you enter through intake plus the information necessary to operate your account: name, email, role, and the firm you belong to. We log timestamps and IP addresses for security and audit purposes (sign-ins, role changes, view-as impersonation, household assignments).

We do not link your accounts to outside financial institutions, we do not request Social Security Numbers, and we do not collect payment information at this stage.

Website visits.We use Vercel Analytics to count visits to our public pages and demos. It records anonymous page-view statistics: the page, the referring site, and the visitor’s country, browser, and device type. In the demo and planner it also counts anonymous actions such as adding a life event or copying a share link; these counts never include amounts, names, or dates.

Early-access list. If you join the early-access list, we receive what you submit through our Tally form: first name, email address, age range, main planning concern, and how you heard about us. We use it to contact you about access to Ormalin and to understand which topics matter to people. Tally processes the submission under its own privacy policy.

Intake data and projections are stored in a managed Postgres database hosted by Supabase, with row-level security policies that restrict access to your firm, your advisor, and yourself. The database is encrypted at rest and in transit.

• You can see your own intake, plan, and documents.
• Your primary advisor (if assigned) can see the same, plus enter a recorded “view as client” session that is logged in your firm’s audit log.
• Administrators in your firm can manage users and assign advisors. An administrator may also open a read-only “Support View” of your account to investigate a support request. Support View requires the administrator to record a reason before it starts, expires automatically after 60 minutes, cannot change any of your data, and writes an entry to your firm’s audit log every time it is used.
• Vercel, Supabase, Tally, and any other infrastructure providers may access encrypted data as required to operate the service, subject to their own privacy policies.

• Sell, rent, or share your personal data with advertisers
• Use your financial data to train AI models
• Send marketing emails without your opt-in

We retain your data while your account is active. If you close your account, we will deactivate it and retain the underlying records as required for audit and reporting purposes for up to seven years, after which they are deleted. You may request earlier deletion of identifying information through your administrator.

If we discover a security incident that affects your data, we will notify you and your firm administrator promptly, in accordance with applicable law.

We may revise this Policy from time to time. The effective date above reflects the most recent revision. Continued use of Ormalin after a revision indicates acceptance.

If you use Ormalin through a firm, questions about your data can be directed to the administrator listed in your firm settings. If you are not part of a firm, or you want to see or delete an early-access submission, contact us through the early-access form and mention “privacy”.