This Privacy Policy explains how Orata Ltd (company number 12019287, registered office C/O Armstrongs Accountants, Alexandra House, Queen Street, Leek, Staffordshire, England, ST13 6LP), trading as REI Vantage (Orata, we, us), collects and uses personal data.
1. Who this policy covers, and our role
We handle personal data in two different roles:
- As a controller. We decide how and why personal data is used for our own business. This covers visitors to our website, people who contact us, prospective customers, and the people who manage our customers' accounts. This policy covers that data.
- As a processor (service provider). Each REI Vantage customer runs its own instance and decides whose data goes into it, such as the property owners and leads it contacts. For that data the customer is the controller, and we act only on its instructions under our Data Processing Addendum. If your details are in a customer's instance, see section 9.
UK data protection law, including the UK GDPR and the Data Protection Act 2018, applies to our processing. Where US state privacy laws apply, we also follow them.
2. Personal data we collect
When you visit our website or app
- Technical data: IP address, browser and device type, pages requested, referring page, and date and time. This is collected in server and security logs by our hosting provider.
- Security checks: our signup and login forms use Cloudflare Turnstile to tell people from bots. It processes device and interaction signals for that purpose only.
When you contact us or book a call
- Name, business name, email address, phone number, and anything you tell us about your business.
- Recordings and notes of onboarding or sales calls, if we tell you at the start of the call that it is being recorded.
When you become a customer
- Account owner and User details: name, business email, phone number, role, login credentials (passwords are stored only as a secure hash), and account activity.
- Billing details: billing contact, company details, invoices and payment status. Card payments are handled by our payment provider; we do not store full card numbers.
- Support data: messages, screenshots and diagnostic information you send us.
- Service data: error reports and technical logs from the Software, which may include limited personal data where it appears in an error.
When you connect an AI assistant
- The OAuth client, the scopes you approve, and an audit log of the tools called, so you can review and revoke access.
3. How we use it and our legal bases
| Purpose | Legal basis (UK GDPR) |
|---|---|
| Providing the Service, setting up and supporting your instance, and managing your account | Performance of our contract with you or your business |
| Billing, accounting and tax records | Legal obligation, and performance of contract |
| Security, fraud prevention, abuse and bot detection, and enforcing our policies | Legitimate interests in protecting our customers, our service and the public |
| Responding to enquiries and running sales conversations | Legitimate interests in growing our business, or steps taken at your request before a contract |
| Improving the Service using error reports and usage metrics | Legitimate interests in a reliable, improving product |
| Sending service and policy notices | Performance of contract, and legal obligation |
| Sending marketing emails to business contacts | Legitimate interests (you can opt out at any time), or consent where the law requires it |
| Recording calls | Legitimate interests in accurate records, with notice at the start of the call |
| Complying with law and responding to lawful requests | Legal obligation |
We do not make decisions about you that have legal or similarly significant effects based solely on automated processing.
4. Text messages from us
If you give us your mobile number and agree to receive text messages from REI Vantage, we use it only for the messages you agreed to, such as account alerts and support updates. Message frequency varies and message and data rates may apply. Reply STOP to opt out or HELP for help.
We do not sell, rent or share mobile numbers or SMS opt-in consent with any third party for their marketing purposes. Mobile information is shared only with the service providers that deliver our messages, and is never shared for marketing.
5. Who we share personal data with
- Service providers who process data for us under contract, such as hosting, database, email, error monitoring, accounting and payment providers. The current list is on our Sub-processors page.
- Professional advisers, such as accountants, lawyers and insurers, under duties of confidentiality.
- Authorities, regulators and carriers, where the law requires it, to respond to lawful requests, or to protect the rights, safety or property of Orata, our customers or others.
- A buyer or successor, if all or part of our business is sold or reorganised, under equivalent protections.
We do not sell personal data, and we do not share it for cross-context behavioural advertising.
6. International transfers
We are based in the United Kingdom and most of our customers are in the United States. Some of our service providers process data in the United States and elsewhere. When we transfer personal data outside the UK, we rely on one of the following:
- UK adequacy regulations, including the UK Extension to the EU–US Data Privacy Framework (the UK–US data bridge) for certified US organisations;
- the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses; or
- another safeguard permitted by UK law.
7. How long we keep it
| Data | How long |
|---|---|
| Account, contract and billing records | 6 years after the end of the customer relationship (UK tax and limitation periods) |
| Support correspondence | 2 years after the ticket closes |
| Error reports and technical logs | Up to 90 days |
| Security logs | Up to 12 months |
| Sales enquiries from people who do not become customers | 2 years after our last contact |
| Call recordings | 12 months, unless needed for a dispute |
We delete or anonymise data when it is no longer needed.
8. Your rights
Under UK data protection law you have the right to:
- access your personal data;
- correct it;
- erase it;
- restrict or object to our processing (including an absolute right to object to direct marketing);
- receive it in a portable format; and
- withdraw consent where we rely on consent.
Some rights have exceptions. We will respond within one month.
If you live in a US state with a consumer privacy law, you may have similar rights to know, access, correct, delete and opt out. We honour those requests to the extent the law applies to us.
To exercise any right, email [email protected]. We may need to verify your identity first.
If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk or 0303 123 1113.
9. If an REI Vantage customer contacted you
Real estate investors use REI Vantage to manage their own outreach. If you received a text, call, voicemail or letter from one of them, that business is responsible for it. It chose to contact you and decides how your details are used.
- To stop texts, reply STOP to the message. To stop calls, tell the caller you do not want to be contacted again.
- To ask what data a business holds about you, or to have it deleted, contact that business directly.
- If you cannot reach the business, email [email protected] with the phone number that contacted you and what you are asking for. We will pass your request to the customer, and we will help it respond where we hold data on its behalf.
Where a customer uses our Data Services, we may process property and contact information about you as that customer's processor. This information comes from licensed third-party data providers and public records. The customer's privacy notice applies, and the request route above works for this data too.
10. Cookies and similar technologies
We use only what the website and app need to work and stay secure:
| Name | Purpose | Type |
|---|---|---|
| Session cookie | Keeps you signed in to the app | Strictly necessary |
| Cloudflare Turnstile and security cookies | Bot and abuse protection on forms | Strictly necessary |
cookie_consent (browser storage) |
Remembers that you have seen our cookie notice | Strictly necessary |
We do not currently use advertising or third-party analytics cookies. If we add any non-essential cookies, we will ask for your consent first and update this table.
11. Security
We protect personal data with appropriate technical and organisational measures. These include encryption in transit, hashed passwords, access controls with least privilege, audit logs, and secrets management. Each customer's lead data is held in that customer's own infrastructure rather than a shared database. No system is perfectly secure. If we become aware of a breach that affects you, we will tell you and the regulator where the law requires it.
12. Children
The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect personal data from children.
13. Changes
We may update this policy from time to time. We will post the new version here with a new date and, where the change is significant, tell our customers by email.
14. Contact
Email: [email protected]
Post: Orata Ltd, C/O Armstrongs Accountants, Alexandra House, Queen Street, Leek, Staffordshire, England, ST13 6LP