Privacy Policy

This policy applies to the Oratessa website, application, team programs, and related support. It does not govern third-party websites or services that have their own privacy policies.

Depending on how you use the service, we may collect:

• Account information: name, email address, authentication identifiers, account role, and profile settings. Optional practice preferences include job function, experience, industry or business type, learning goals, and company name. You can edit or clear these in Settings.
• Practice content: selected scenarios, conversation messages, custom scenario inputs, coaching preferences, scores, rubric results, feedback reports, and session history.
• Team information: workspace membership, invitations, assignments, seat usage, administrator role, and team-level activity.
• Subscription information: plan, status, Stripe customer and subscription identifiers, and billing events. Stripe processes payment card details; Oratessa does not store complete card numbers.
• Technical and usage information: browser and device details, IP address, request logs, timestamps, security events, feature use, AI provider and model, task type, token counts, estimated cost, and latency.
• Support communications: information you include when contacting us for help, reporting a problem, suggesting a feature, or discussing a team program. The in-app report tool prepares an email draft for you to review and send through your chosen email service. It can include a general page area, time, safe error code, and request reference. It does not automatically attach account details, full URLs, conversation or document content, recordings, or browser logs, and does not send a report merely because an error occurs.

We use information to:

• create and secure accounts, authenticate users, and maintain profiles;
• run role-play sessions, generate feedback, provide hints, and save progress;
• operate team workspaces, assignments, invitations, and permitted reporting;
• process subscriptions, enforce plan limits, and prevent misuse;
• respond to support, privacy, billing, and team inquiries;
• monitor reliability, diagnose errors, protect the service, and improve features; and
• meet legal, accounting, security, and regulatory obligations.

Practice messages and scenario context are sent through our server-side AI gateway to OpenRouter and the selected model providers to generate character replies, feedback, hints, summaries, and scenario drafts. AI output is probabilistic and may be inaccurate.

Voice playback is optional. When you select Listen or enable automatic playback, the selected AI reply is sent through our gateway directly to Google Cloud Text-to-Speech (Chirp 3 HD). Conversation and coaching playback use Google only. Listen to coaching sends the saved coaching note or concise feedback summary to Google. Generated audio is kept in your browser's memory while that page is open and cleared when you leave or reload it. Oratessa does not save the audio to your account. Your chosen character voice is saved with the practice session; the coach uses a separate voice. Guided Practice notes are saved with their learner messages so playback uses the original feedback. We keep aggregate monthly character counts to enforce the speech service's usage limit, without storing text or audio in those counters.

Custom Team Pro administrators may import documents for text extraction. Original files are processed temporarily, not stored. Only reviewed text, filenames, fingerprints, and paragraph identifiers are saved. Document-grounded generation sends only explicitly selected and approved excerpts to OpenRouter and its model provider. Those excerpts may also be retained as references in the resulting scenario and report and sent to the AI providers again when that scenario is used for practice and feedback. They can be visible to authorized team members through the resulting scenario and reports. Owners and administrators should minimize personal data and obtain all necessary permissions before importing. Removing a source document does not erase references already copied into a saved scenario, frozen assessment, or report. Each approved source-based generation records the administrator account, server time, disclosure version, purpose, and selected paragraph fingerprints before excerpts are sent. The approval log does not duplicate excerpt text, filenames, or original files. An approval does not mean generation succeeded.

Assessment attempts and team analytics use saved practice and scoring data. Matched comparisons require completed attempts using the same assessment configuration and model; they are not employment ratings or validated measures of competence.

Speech input is optional and starts only when you select Record response and allow microphone access. Your browser may send audio to its speech recognition service.Oratessa does not store microphone recordings. The transcript stays in the response editor until you choose to send it, after which it is handled like a typed message.

Do not include real confidential business information, trade secrets, health data, financial account information, or personal information about another person unless you are authorized to use it for this purpose. Use fictional or de-identified details where possible.

We do not use practice results to make employment decisions. Organizations using team features are responsible for appropriate human review and for communicating their own workplace policies to learners.

We may share information only as needed with:

• Supabase for authentication and application data storage;
• the sign-in provider you choose, such as Google, Microsoft, LinkedIn, GitHub, or Apple, when that option is available, and your browser or device's speech service when you choose dictation;
• OpenRouter and the selected model providers for text AI model inference. A restricted owner diagnostic tool can test separately selected speech models through OpenRouter; it is not the conversation or coaching playback path;
• Google Cloud and Firebase for application hosting and request delivery, the secured AI gateway, secret management, optional speech generation, and related service infrastructure;
• Stripe for checkout, subscription billing, and customer billing management;
• Resend for transactional account emails, including confirmation and password recovery messages;
• Cloudflare Turnstile for security checks on authentication forms. Cloudflare processes technical information needed for those checks, as described in its Turnstile Privacy Addendum;
• team owners and administrators, who can access membership, assignments, completion, scores, feedback reports, conversation transcripts, and activity for practice sessions associated with their workspace; and
• authorities, advisers, or transaction participants when reasonably necessary to comply with law, protect rights and security, or complete a corporate transaction.

We do not sell personal information or use it for third-party behavioral advertising.

We use browser storage and similar strictly necessary technologies to maintain sign-in sessions, selected plans, onboarding state, and application preferences. Clearing browser storage may sign you out or reset local preferences; it does not itself delete practice records saved to your account.

If you choose Remember Unsent Draft, the response you have not sent is kept only in that browser tab's session storage for up to 24 hours. It is removed after sending or signing out and is not shared with our AI providers until you send it. This option is off by default; you can turn it off to remove the saved draft.

We retain account and practice information while your account is active and for as long as reasonably needed to provide the service, resolve disputes, maintain security, and meet legal or financial obligations. Retention periods may differ by data type. We delete or de-identify information when it is no longer required, subject to backups and legal requirements.

Reviewed team document text remains in the source library until a team administrator removes it or the workspace is deleted. Administrators can manage retained sources even after a downgrade. Removal stops new source-based drafts; existing scenario excerpts, frozen assessment snapshots, and report references remain with their records. Contact support if those copies also need removal. Minimal source-sharing approvals remain with the workspace after source removal. Account deletion removes the actor link; workspace deletion removes its approval log. No automatic age-based deletion period for these records is currently configured. Backup copies and legally required records may persist separately; contact us about a deletion or consent-withdrawal request.

We use access controls, encrypted network connections, server-side credentials, row-level database policies, and service monitoring intended to protect information. No online service can guarantee absolute security. Contact us promptly if you believe your account or information has been compromised.

You may update certain profile details in account settings and manage a paid subscription through the billing portal. You may also ask to access, correct, or delete personal information, withdraw consent where applicable, or challenge our privacy practices. Identity verification may be required before we complete a request.

Our service providers may process information outside your province, state, or country. Information may therefore be subject to the laws of the jurisdiction where it is processed. We use service-provider controls appropriate to the nature of the information.

Oratessa is designed for workplace learning and is not directed to children under 16. Do not create an account if you are under 16. Contact us if you believe a child has provided personal information without appropriate authorization.

We may update this policy as the service and legal requirements evolve. We will post the revised version here and change the last-updated date. We may provide additional notice when a change materially affects how personal information is handled.

Send privacy questions or requests to Minerva Cloud Solutions Inc. at apasi@minervacs.com. Please use the subject line "Privacy request" and do not include passwords or sensitive practice content in your email.