Oria Marine
Privacy

Privacy policy.

Last updated 20 July 2026

This policy explains what personal data Oria Marine (the data controller) collects through the website and the Oria service, why we collect it, how long we keep it, and what rights you have over it. We follow the General Data Protection Regulation (EU 2016/679) and the French Data Protection Act of 1978 as amended.

1. Data controller

Oria Marine, 229 rue Saint-Honoré, 75001 Paris, France. Contact for any privacy question: antoine@oria-marine.com.

2. Data we collect

We only collect what we need.

When you start the onboarding flow

First name, email, boat model. Used to set up your order and pre-configure your dashboard: sent to our team by email and passed to Stripe (purchase) or Cal.com (fleet conversation). Nothing else.

When you contact us

Name, email, message content. Used solely to reply to you.

When you browse the site

Standard server logs (IP, timestamp, user-agent, requested URL) kept by the host (Google Cloud) for security and abuse prevention.

Audience measurement (only with your consent)

If you accept our cookie banner, Google Analytics 4 helps us understand how the site is used — pages viewed, approximate location (from a shortened IP), device and browser type — so we can improve it. It sets cookies (e.g. _ga) that last up to 13 months. It never loads before you consent, it is never used for advertising, and you can withdraw at any time via “Cookie settings” at the bottom of every page.

Local storage

We store up to two items: oria.lang (your preferred language) and oria.consent (your cookie choice). Neither holds personal data or an identifier.

3. Legal basis

Onboarding & order
Performance of the contract you ask us to enter into (GDPR art. 6(1)(b)).
Contact replies
Legitimate interest in answering your message (art. 6(1)(f)).
Audience measurement
Your consent (art. 6(1)(a)), which you can withdraw at any time.
Server logs
Legitimate interest in operating a secure service (art. 6(1)(f)).

4. Retention

  • Onboarding data: 30 days unless an order is placed; then kept under the commercial relationship for 5 years.
  • Contact emails: 1 year after last exchange, then archived for 2 more years if needed for evidence.
  • Server logs: 12 months maximum.

5. Sub-processors

We use a small number of trusted services to run Oria. They are bound by data-processing agreements and only act on our instructions.

Google Cloud (Ireland & France)
Hosting and storage. Data stays in the EU.
Google Analytics — Google Ireland Ltd.
Audience measurement, loaded only after you consent. IP addresses are shortened; some data may be processed in the US under the EU-US Data Privacy Framework.
Stripe (Ireland)
Payment processing for your subscription. Card data is handled directly by Stripe; we never see it.
Cal.com (United States)
Booking calls for fleet customers. Personal data limited to name, email, and meeting details.
Resend (Ireland) and SendGrid (Twilio, EU)
Transactional email — onboarding leads, order confirmations, dispatch notes. We send from Oria Marine; the providers don't use the data for their own purposes.

6. International transfers

Stripe, Cal.com and Google Analytics may process data in the United States under the EU-US Data Privacy Framework. Where this is not in place, transfers rely on the European Commission's standard contractual clauses.

7. Your rights

You can, at any time:

  • Access the personal data we hold about you,
  • Have it rectified or erased,
  • Restrict or object to its processing,
  • Receive it in a portable format,
  • Withdraw any consent you previously gave,
  • Define directives for what happens to your data after death.

Email antoine@oria-marine.com — we reply within one month. If you believe we have not handled your request properly, you have the right to lodge a complaint with the CNIL (3 place de Fontenoy, 75007 Paris — www.cnil.fr).

8. Cookies

The site uses two things. First, essential items in your browser's local storage (oria.lang for your language, oria.consent for your cookie choice) — no personal data, no consent required. Second, audience-measurement cookies set by Google Analytics — but only if you accept our cookie banner. No analytics cookie is set before you consent. You can accept, decline, or change your mind at any time via “Cookie settings” at the bottom of every page; declining (or simply ignoring the banner) means Google Analytics is never loaded.

9. Security

Data in transit is encrypted (HTTPS). Internal access is limited to staff who need it. We notify the CNIL and affected users in case of a personal data breach within 72 hours, where required by law.

10. Changes to this policy

We may update this policy to reflect changes in our practices or in the law. The new version applies as of the date shown at the top.