Privacy policy.
Last updated: 3 November 2026
The short version
- We only collect what you send us: what you type into a form, a booking, a WhatsApp message or an email.
- We use it to reply to you, prepare your audit, report or demo, and work with you if you become a client or partner.
- We never sell or rent your data.
- No tracking or advertising cookies. Our visitor statistics are cookieless; advertising tags would only ever load after you say yes.
- Client project data is handled under a separate agreement with each client.
- Ask us any time to see, correct or delete your data: elias@oravelstudio.com.
- Who we are
- What we collect
- Why we use it
- Who processes it for us
- International transfers
- How long we keep it
- Cookies
- Your rights
- Security
- Changes
- Contact
1. Who we are
Oravel Group ("Oravel", "ORVL", "we", "us") builds and runs AI systems for businesses. Oravel Group is run by Elias Bounenni from Dubai, United Arab Emirates. We are responsible (the "controller") for the personal data described in this policy, which covers orvl.ai, our booking page, and the ways you can contact us.
Questions about your data: elias@oravelstudio.com.
2. What we collect
Information you give us
- Website forms. When you use our contact or audit form, the free AI report (scan), the AI readiness scorecard, the ROI calculator, a demo request, the partner application or a resource download, we receive what you fill in: usually your name, email address, company, phone or WhatsApp number (if you give it), your answers or inputs, and the page you were on. Forms are sent through this site's own /api/lead function (hosted by Vercel), stored in our database at Supabase, and then copied into our own CRM so we can follow up.
- Bookings. When you book a call on our booking page (bounenni-book.vercel.app): your name, email address, your answers to the booking questions and the time you picked.
- WhatsApp. If you message us on WhatsApp (+971 55 969 2472): your phone number, profile name and the messages and files you send. WhatsApp (Meta) also processes these under its own terms and privacy policy.
- Email. Anything you send to us by email, including attachments.
- Client project data. If you become a client, we may process data from your business (for example customer conversations or CRM records) to build and run your AI systems. We do that only on your instructions, under a separate data processing agreement or contract with you. That agreement, not this policy, governs that data.
Information collected automatically
- Technical logs. Our hosting provider records standard technical information when you visit, such as your IP address, browser type and the pages requested, to run and protect the site.
- Visitor statistics. We use Vercel Web Analytics to count page views in aggregate. It is cookieless: it sets no cookies, builds no personal profile and doesn't store your IP address as such. We also count, without your details, that a form was sent successfully.
Apart from that, we don't use analytics trackers or fingerprinting. Advertising and measurement tags (from Google, Meta or LinkedIn) are only ever loaded after you give explicit consent, and none are active right now (see section 7).
3. Why we use it (and our legal basis)
If you are in the EU (for example the Netherlands or Belgium), the GDPR applies to how we handle your data. If you are in the UAE, the UAE Personal Data Protection Law (PDPL) applies. We use the bases below.
| Purpose | Data | Legal basis |
|---|---|---|
| Replying to your request and preparing your audit, report, scorecard, ROI result, demo or download | Form details, booking details, messages | Your request (steps before a possible contract with you) |
| Reviewing partner applications and running the partner programme | Partner form details | Your request / our contract with you |
| Following up with relevant offers after your request | Name, email, company, what you asked about | Your consent, or our legitimate interest in a reasonable business follow-up; you can opt out any time |
| Delivering client projects | Client project data | Our contract with the client, under a separate data processing agreement |
| Counting visits to improve the site | Cookieless, aggregated page views | Our legitimate interest in knowing which pages are useful |
| Keeping the site secure and working | Technical logs | Our legitimate interest in a safe, working website |
| Meeting legal duties (for example invoices) | Billing details | Legal obligation |
4. Who processes it for us
We use a small number of service providers. They process data only on our instructions and under their own data processing agreements.
| Provider | What for | Data |
|---|---|---|
| Vercel Inc. (USA) | Hosting this website, its form function (/api/lead), our booking page, and cookieless Web Analytics | Technical logs, aggregated page views; your form details pass through on their way to the database |
| Supabase Inc. (USA) | The database that stores form submissions and bookings | Name, email, company, phone, your answers, the page and time |
| Our email provider (Microsoft 365, or Google Workspace where used) | Sending and receiving email | Your email address and what you write to us |
| Google (Google Fonts) | Loading the fonts on this site | Your IP address and browser information |
If you contact us on WhatsApp, WhatsApp (Meta) processes those messages under its own terms. We may also disclose data if the law requires it. If Oravel Group is ever sold or merged, your data may move to the new owner under this same policy.
5. International transfers
We are based in the UAE and some of our providers are in the United States. When personal data from the European Economic Area, the UK or the UAE goes to these providers, we rely on the safeguards they offer, such as the European Commission's Standard Contractual Clauses included in their data processing agreements, as allowed by the GDPR and the UAE PDPL. The region of our Supabase database has not been confirmed as being in the EU, so for that database we rely on Supabase's data processing agreement and its Standard Contractual Clauses.
6. How long we keep it
- Form submissions, bookings and enquiries: until you ask us to delete them, or at the latest 24 months after our last contact with you.
- Client project data: as set out in the contract or data processing agreement with that client.
- Invoices and accounting records: as long as the law requires.
- Technical logs: kept by our hosting provider for a short period under its own policy.
7. Cookies
By default this site sets no tracking or advertising cookies, and our visitor statistics are cookieless. If we ever add advertising or measurement tags (from Google, Meta or LinkedIn), a consent banner will ask you first, and those tags only load after you click "Accept". None are active right now, so you won't see the banner yet. You can change your choice at any time via Cookie settings.
Once the banner is in use, your choice is remembered in your browser's local storage. You can clear it any time in your browser settings.
8. Your rights
Depending on where you live (for example under the GDPR or the UAE PDPL), you can:
- Access the personal data we hold about you
- Correct data that's wrong
- Delete your data
- Object to or restrict how we use your data, including follow-up messages
- Withdraw your consent at any time, where we rely on it
- Receive a copy of your data in a common format
Email elias@oravelstudio.com and we'll respond within 30 days. You can also complain to a data-protection authority: in the Netherlands that is the Autoriteit Persoonsgegevens; elsewhere, your local authority (for example the authority in your EU country or the UAE Data Office).
9. Security
The site runs over encrypted HTTPS, forms are protected against automated spam, our database only accepts new submissions from the public site, and access to stored data is limited to us. No method is 100% secure, but we take reasonable steps to protect your data.
10. Changes to this policy
If we change how we use your data, we'll update this page and the date at the top.
11. Contact
Oravel Group · run by Elias Bounenni · Dubai, United Arab Emirates
Email: elias@oravelstudio.com · WhatsApp: +971 55 969 2472