Privacy Policy

This policy applies to the Olurai website, application, creator and affiliate accounts, sponsor catalogue, connected or managed sponsorship inboxes and related support.

Devantai, trading as Olurai, is the UK-based operator of the Service and the data controller for the processing described below. Our postal address is Roman Road, Basingstoke, Hampshire, RG23 8EP. A connected email, social, payment or infrastructure provider may also act as a separate controller under its own notice.

• Account information: name, email address, authentication identifier, account status and support correspondence.
• Creator profile: country, niche, biography, social or website handle, audience and engagement figures, content formats and organisations you ask us to exclude.
• Creator-prospect information: professional contact email, public Instagram handle and profile URL, public biography, follower count, publicly presented name where available, recent public content and limited inferences about content category and primary publishing format. We do not use this process to infer sensitive personal information or private income.
• Connected inbox information: email address, provider, encrypted authorisation tokens or credentials, message and thread identifiers, recipients, subjects, message content, sending status and reply signals needed to provide the selected email features.
• Olurai-managed email information: requested address or domain, availability checks, provider references, mailbox status and messages handled through that inbox.
• Sponsor and professional contact information: organisation, industry, website, professional name, role, business email, source and campaign history. We do not intend the catalogue for private or household contact details.
• Billing information: selected plan, Stripe customer and subscription references, payment status, invoices, promotions and limited transaction details. Olurai does not receive full card or bank-account numbers.
• Affiliate information: application details, referral codes and activity, acceptance records, commission and payout status, and Stripe Connect readiness. Stripe handles identity, bank and tax information in its hosted service.
• Technical and usage information: IP address, browser or device information, security and request logs, feature activity, error information and local browser preferences.

Firebase Authentication handles your Olurai password. We do not add the raw password to your Olurai profile.

We receive information directly from you, from your use of the Service, from integrations you choose to connect, from payment and email providers, and from public or licensed business sources used to build and verify the sponsor catalogue.

For our own limited creator introductions, Olurai may manually collect professional contact details from publicly accessible United States Instagram creator profiles. We may then review a small amount of the creator’s recent public content and public creator website or channel to understand the type of content they publish and personalise the introduction. We do not use automated scraping or purchased third-party creator lists for this campaign.

If another account holder includes a professional contact in outreach, we may receive message and reply information relating to that business conversation.

• Contract: create and secure your account; provide profiles, sponsor matches, drafts, email connections, sending, reply tracking, billing, support and affiliate features you request.
• Legitimate interests: maintain and verify a relevant professional sponsor catalogue; prevent fraud and misuse; keep the Service reliable; measure feature performance; and improve matching and usability. We balance these interests against the rights of affected people.
• Legal obligation: keep financial or compliance records, respond to lawful requests, protect legal rights and meet tax, accounting and data-protection duties.
• Consent: where consent is required for an optional integration, non-essential technology or marketing communication. You may withdraw consent at any time without affecting earlier lawful processing.

For creator prospects, our legitimate interests are to identify suitable professional creators and send a limited, relevant introduction to Olurai and its affiliate programme. We use only information made public for professional creator activity, restrict the campaign to eligible United States contacts, provide source information and an immediate opt-out, and suppress anyone who objects. You may object at any time.

Olurai does not use profile or sponsor matching to make decisions that produce legal or similarly significant effects about an individual.

For account and catalogue administration, Olurai acts as a controller. When Olurai handles a user’s connected-inbox data solely to send, organise or monitor messages under that user’s choices, Olurai also performs those operations on the user’s instructions.

Users remain responsible for the audience, content and lawful basis of their own outreach. Professional contacts may object or opt out by replying to the sender or emailing hello@olurai.io. We may retain a minimal suppression record so an opt-out is respected.

We share only what is reasonably necessary with:

• Google Cloud and Firebase for hosting, authentication, databases, logs and security;
• Anthropic's commercial pay-as-you-go API for creator analysis, sponsor insights and requested email drafts. We send only the fields needed for the feature, and Anthropic states that commercial API inputs and outputs are not used to train its generative models by default;
• OpenAI's commercial pay-as-you-go API for Olurai's own research into public creator-prospect content. This system is isolated from connected Gmail, YouTube and Google Photos data, and OpenAI states that API data is not used to train its models by default;
• Stripe for subscription payments, billing portals and affiliate payouts;
• Google when you connect Gmail, Google Workspace or YouTube;
• Microsoft when you connect Outlook or Microsoft 365;
• Nylas and the selected domain, mailbox or registrar provider when Olurai provisions or operates a managed sponsorship inbox;
• your own email host when you connect a supported mailbox;
• professional advisers, insurers, auditors or authorities where necessary for legal, security or compliance reasons; and
• a buyer or successor if Olurai is reorganised, sold or transferred, subject to appropriate safeguards.

We do not sell account-holder personal information. We do not permit sponsor contact data to be used for unrelated consumer advertising.

Some providers may process information outside the United Kingdom, including in the United States. Where required, we rely on a UK adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful safeguard. Contact us if you would like more information about the safeguard relevant to your data.

• Account, profile, integration and campaign information is generally kept while the account is active and then deleted or anonymised when it is no longer reasonably needed to close the account, resolve disputes or meet legal duties.
• Connected access tokens are removed or made unusable when the integration is disconnected or the account is deleted, subject to secure backup expiry.
• Billing, invoice, commission and tax-related records are generally kept for up to six years after the relevant financial period where needed for UK accounting, tax or legal obligations.
• Security and operational logs are kept for a limited period appropriate to detecting abuse, investigating incidents and maintaining reliability.
• Professional sponsor data is reviewed and retained while it remains relevant to legitimate business outreach. Suppression data may be kept longer so opt-outs continue to be honoured.
• Creator-prospect contact and research information is deleted or anonymised after no more than 12 months if no account, affiliate or other relationship begins and no shorter period is required. A minimal hashed suppression record may be retained longer so an opt-out is not undone by a future import.
• Backups expire on a controlled schedule and are not used for ordinary product activity.

Depending on where you live and the circumstances, you may have rights to access, correct, erase, restrict or receive your personal information; object to processing based on legitimate interests; withdraw consent; and complain to a regulator.

Creator prospects can use the unsubscribe link in any Olurai introduction to stop future creator-marketing emails immediately. You may also send an objection or request to hello@olurai.io. We may need information to verify identity and scope the request. UK users may also complain to the Information Commissioner’s Office.

We use access controls, encryption in transit, restricted service identities, secret management, logging and provider safeguards designed to protect information. No internet service is completely secure, so please use a strong unique password and tell us promptly about suspected misuse.

The application uses cookies or browser storage that are necessary for sign-in, security, referral attribution, preferences, previews and service operation. If we introduce non-essential analytics or advertising technology that requires consent, we will present the required choice before using it.

Olurai is intended for people aged 18 and over. We do not knowingly offer accounts to children or include known or suspected minors in creator-prospect outreach. Contact us if you believe a child’s information has been included.

We will update this notice when our processing changes and will bring material new uses to affected users’ attention before they begin where required.

For questions or requests, email hello@olurai.io. You can also review the Terms of Service.