Privacy policy

Effective from 29 October 2026. Please read this document carefully before using the service.

1. Data controller

This policy describes how ora. processes the personal data of the people who use its platform. The controller is SO Group Sàrl, the company operating ora. ("ora.", "we"), whose details are given in the "Contact us" section.

It applies in compliance with the Swiss Federal Act on Data Protection (FADP) and, where relevant, the European Union's General Data Protection Regulation (GDPR).

Each lawyer is, for their part, the controller of the data they receive from a client in the course of a mandate, in accordance with their professional obligations.

For payment data, ora., which collects the payments, and our payment provider Stripe are each controllers for their own part. ora. is also the controller of all other data described in this policy.

2. The data we process

The service processes the following categories of data.

Account: email address, name, language, time zone and, where applicable, company name, VAT number and billing address.
Lawyer profile: registration number, canton, practice areas, languages, hourly rate, published services, biography, photograph, declared career, and the history of verification decisions.
Enquiries and mandates: the conversations, fee offers, bookings, uploaded documents, consultation notes, time entries and reviews linked to a relationship between a client and a lawyer.
Payments: amounts, their status, invoices, ora. receipts and the identifiers passed on by our payment provider. For practitioners, this also includes the IBAN and the account holder’s name they provide to receive their payouts. We never store a full card number.
Video consultations: the start and end time of each consultation and its participants, and nothing of its content, which is neither recorded nor transcribed.
Saved lawyers: visible to you alone, and never disclosed to the lawyer concerned.
Technical data: error and security logs, IP address, browser type, without the content of your searches.

3. Purposes and legal bases

We process this data for the following purposes.

Providing the service and performing our contract with you, including matching, transmitting messages and documents, tracking payments, issuing ora. receipts, issuing weekly invoices and paying out to practitioners the fees collected on their behalf.
Verifying lawyers' registration with the cantonal register and maintaining trust in the platform.
Ensuring security, preventing fraud and abuse, and meeting our legal obligations, including accounting requirements.
Sending you notices about your account, your enquiries and your mandates. No marketing message is sent without your consent.
Improving the service using aggregated statistics that do not identify you.

4. Your searches are not recorded

What you type into the search box can reveal a health problem, a family dispute or criminal proceedings. The text of your search is never written to our logs. We keep only the fact that a search took place and the number of results returned.

5. Professional secrecy and matter content

The content of an enquiry or a mandate is covered by the lawyer's professional secrecy. It is readable only by the two parties, and that rule is enforced by the database itself on every read.

There is no general administrative access at ora. Exceptional access to content, for example at the request of an authority, requires a written justification, approval by a second person, a limited duration, and leaves a permanent trace.

Video consultations are neither recorded nor transcribed by the platform.

We do not sell your data and share it only with the providers needed to run the service, bound by a data processing agreement, or where the law requires. Our subprocessors are currently the following.

Supabase: database, authentication and file storage, Zurich region, Switzerland.
Vercel: hosting and rendering of the application, Frankfurt region, European Union.
Stripe: processing of the payments ora. collects in its own Stripe account, including on behalf of practitioners. Stripe alone processes your card data.
LiveKit: transport of the audio and video streams of consultations, encrypted in transit and not recorded.
Resend: delivery of notification emails.

6.1 Other recipients

The lawyer you contact receives the data needed for your enquiry or mandate. An authority may receive data where the law obliges us. An acquirer may receive data in the context of a reorganisation or transfer of business, under the same protection conditions.

6.2 Payments

When you pay on ora., Stripe processes the payment on ora.’s behalf, and ora. collects it on behalf of the practitioner. ora. and Stripe are each responsible for payment data for their own part. ora. then pays the fees to the practitioner by bank transfer from its bank account. The practitioner’s IBAN is never passed to Stripe.

7. Where data is processed

The database and files are hosted in Switzerland, in the Zurich region. Pages are rendered from the European Union, which offers a level of protection recognised as adequate by the Federal Council.

Where a provider processes data outside Switzerland or the European Union, we ensure appropriate safeguards, in particular standard contractual clauses, before any transfer.

8. Security

Data is encrypted in transit and at rest. Access to every database table is controlled row by row according to the identity of the signed-in person, and documents are reachable only through short-lived signed links, after a technical check of the file.

Every document download is logged. Administrative keys are never exposed to the browser and are rotated periodically.

No measure is infallible. In the event of a data security breach likely to harm you, we inform you and the Federal Data Protection and Information Commissioner, as the law requires.

9. Retention

We keep your data for as long as your account is open and the service needs it. A closed account is deactivated rather than erased immediately.

Accounting data, including invoices and payments, is kept for ten years, as Swiss law requires.
The content of a mandate is kept for as long as either party may need it as evidence, then deleted.
Technical and security logs are kept for at most twelve months.
The data of a closed account with no mandate and no payment is deleted within thirty days.

10. Cookies and local storage

ora. uses no advertising cookies and no third-party trackers. The only cookies set are those needed to run the service, mainly to keep your session open.

Some preferences, such as the display theme or the background chosen for video consultations, are stored in your browser and never leave your device.

11. Your rights

You have the following rights over your data, which you can exercise from your account or by writing to us.

Access the data we hold about you and obtain a copy in a common format.
Have inaccurate or incomplete data corrected.
Request erasure of your data, within the retention limits set out above.
Object to a processing operation or ask for it to be restricted, where the law allows.
Withdraw a consent you gave, without effect on earlier processing.
Lodge a complaint with the Federal Data Protection and Information Commissioner if you believe your rights are not being respected.

11.1 Response time

We answer every request within thirty days. We may ask you to prove your identity before acting on it.

12. Minors

The service is intended for people aged eighteen and over. We do not knowingly collect data about a minor. If you learn that a minor has created an account, write to us and we will delete their data.

13. Changes to this policy

We may change this policy to reflect a change in the service or in the law. The effective date appears at the top of the document, and any substantial change is announced to you in the platform or by email before it takes effect.

14. Contact us

For any question about this policy or to exercise your rights, write to us at support@hello-ora.ch or from your account.

The controller is SO Group Sàrl, Rue de l’Arquebuse 22, 1204 Genève, Switzerland, UID CHE-424.769.174 (full postal address in the legal notice).

15. Firms

When a practitioner founds a firm on ora., becomes a member of one or is invited to one, we also process the following data.

Firm: its name, city, canton, description and, if given, its UID number and business address. Once the firm has been checked by ora., its name, city, canton, description and the list of its verified members are public. The UID number and the address are never published.
Members: who joined the firm, when, in what role, and when that link ended. This history is kept after a member leaves, so that it can be established who was a member on a given date.
Invitations: the person invited, identified by their account or by their email address, the person who invited them and the state of the invitation. An invited person’s email address is erased thirty days after the invitation closes, whether it was accepted, declined, withdrawn or expired.
Payments: the firm gives ora. an IBAN and the account holder’s name to receive its members’ fees. ora. collects clients’ payments in its own Stripe account and pays them out to the firm by bank transfer. The IBAN is never passed to Stripe. Only the firm members authorised to manage its payments and the ora. staff authorised to make payouts can view it.

15.1 What a firm does not share

Membership of a firm gives no access to another member’s clients, messages or documents. The conflict-of-interest check compares the names of the parties against the matters of every member of the firm, without revealing the matter or the client concerned to any of them.

For each payment paid out to the firm, its owner sees a reference, the member concerned and the amounts, never the client’s name or the mandate’s title.

A mandate passes to another member of the firm only with the client’s agreement. The matter, its messages and its documents then become accessible to that member and stop being accessible to the original practitioner.