Privacy notice

1.1 The controller of your personal data is [operating company name, registration number and address to be confirmed] ("Orisma", "we"). Contact for anything about privacy: hello@orisma.co. [Data protection officer: confirm whether one is appointed and add the contact]

1.2 This notice covers the Orisma website and app, and everyone whose data we handle: founders who use the app, every shareholder, director, secretary and beneficial owner they add, advisers they invite and visitors to the website. It applies under the EU General Data Protection Regulation (GDPR) and the Cyprus Law 125(I)/2018 on the protection of natural persons with regard to the processing of personal data.

1.3 Our partner law firm ([partner law firm name to be confirmed]) and partner accounting firm ([partner accounting firm name to be confirmed]) decide themselves how they use your data to meet their own professional and anti-money-laundering duties. For that use they are separate controllers and their own privacy notices apply.

We do not make decisions about you based solely on automated processing, and we do not build marketing profiles.

Most data comes from you. Data about other people in your company comes from you and from those people when they use their private upload link. Results such as the company registration number, tax number and certificates come from the Registrar of Companies, the Tax Department and our partners. Payment status comes from Stripe.

If you add another person, please show them this notice before you give us their details.

4.1 We share data only as needed for the service and the law:

• our partner law firm, which prepares, signs and files the incorporation documents and performs customer due diligence;
• our partner accounting firm, for tax registration, VAT and yearly filings;
• the Registrar of Companies, including the register of beneficial owners, and the Tax Department of the Republic of Cyprus;
• only the providers you choose in the app: a bank or electronic money institution, the registered office and company secretary provider, a certification or apostille provider, an accountant;
• advisers you add yourself, when you forward them a letter or document;
• authorities, courts or regulators where the law requires it.

4.2 Service providers that process data on our instructions under a data processing agreement:

Stripe also acts as a separate controller for its own legal duties, such as fraud prevention and financial regulation.

4.3 We never sell personal data and do not share it with advertisers.

Our email provider sends messages from a United States region, and our hosting and payment providers belong to groups based in the United States, which may access data for support or security. These transfers rely on the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission's standard contractual clauses with additional safeguards. Emails contain only what a notification needs, such as your name, the company name and a link back to the app. Documents are never attached to our emails. You can ask us for a copy of the safeguards.

If you connect an AI assistant (for example through MCP or our API), the assistant can read and, if you allow it, change the data that its key covers, including details of the people in your company. What it reads is sent to the provider of that assistant under your own agreement with them, and that provider is responsible for it. Only connect assistants you trust, and revoke keys you no longer use under Connect your AI. The assistant cannot sign or pay.

At the end of the period we delete the data or make it anonymous.

Data is encrypted in transit (HTTPS with HSTS) and at rest. Documents are kept in a private storage bucket with server-side encryption and are only reachable through short-lived links after we check who is asking. Access to company data is limited to you, the people you added (each only for their own documents), and the members of our team who handle formation cases. Sign-in uses one-time email links instead of passwords, and keys for AI assistants are stored only as a hash. Every action is written to an audit log.

9.1 You have the right to ask for access to your data and a copy of it, correction, deletion, restriction of processing, a copy in a portable format, and to object to processing based on our legitimate interests.

9.2 Some rights are limited by law. For example, we and our partners cannot delete due diligence records before the retention period in section 7 ends, and the anti-money-laundering law may stop us from telling you about some processing.

9.3 To use your rights, write to hello@orisma.co. We may ask you to confirm your identity. We answer within one month, which can be extended by two months for complex requests.

9.4 You can complain to the supervisory authority: Office of the Commissioner for Personal Data Protection, Iasonos 1, 1082 Nicosia, Cyprus (postal address: P.O. Box 23378, 1682 Nicosia), telephone +357 22818456, email commissioner@dataprotection.gov.cy, website dataprotection.gov.cy. You can also complain in the EU country where you live or work.

We send transactional emails only: sign-in links, signing codes, notices about open items and updates on your company, at most one update summary per company every 30 minutes. Our emails have no tracking pixels and no click tracking. We do not send marketing emails.

We use only cookies that are needed for the app to work, and no analytics or advertising cookies. See the Cookie policy.

The service is for adults. Every director must be at least 18, and we do not knowingly collect data about children.

We will publish changes on this page with a new version date, and tell you in the app or by email about changes that matter.