Privacy Policy

Last updated: 1 September 2026

Ormax (“Ormax”, “we”, “us”) operates the website ormax.ai, the application at dashboard.ormax.ai, and related services (the “Service”). This policy explains what personal data we collect, why, how long we keep it, and what you can do about it.

The data controller is ECODEV LIMITED, registration number ΗΕ 434314, Kypranoros 13, EVI BUILDING, Floor 2, Flat/Office 201, 1061 Nicosia, Cyprus. You can reach us at [email protected] with any question about this policy or your data.

1. What we collect

Account data. Name, email address, and password credentials or the identifier supplied by your sign-in provider when you register.

Financial account data. When you connect a financial institution, our data provider (Plaid Inc.) grants us read-only access and transmits to us the account holder name, account balances, holdings, and transaction history for the accounts you select. We never receive or store your online banking credentials, and our access cannot be used to move money or change anything at your institution. Plaid processes your credentials under its own privacy policy.

Data you enter. Assets, positions, valuations, notes you add manually, and statements you upload.

Usage and device data. IP address, browser and device type, operating system, pages viewed, and actions taken within the Service.

Traffic source data. When you arrive from an advertisement, a search engine, an email, or a partner link, we record where you came from: the URL parameters of that visit (including utm_source, utm_medium, utm_campaign and similar), the domain of the referring site, and advertising click identifiers such as Google’s gclid. We keep the first source that brought you to us and the most recent one before you registered.

2. Why we process it, and on what basis

We do not use your financial account data or the contents of your portfolio for advertising, and we do not share either with advertising networks.

3. Cookies

We use cookies and comparable browser storage in four categories — Necessary, Preferences, Statistics, Marketing. Where consent is required, Preferences, Statistics and Marketing storage stays switched off until you allow it, and you can change or withdraw your choice at any time using the privacy trigger shown on every page.

Our Cookie Policy describes each category, provides the Cookiebot declaration, and explains how consent is recorded and how to change it.

4. Analytics and advertising

Google Analytics 4. We use Google Analytics to understand how visitors reach and use the Service. Where consent is required and not given, analytics cookies are not read or written. Depending on the consent configuration, Google tags are blocked or send limited cookieless measurements. These measurements can include technical information such as the time of the visit, browser information and referrer; cookieless does not mean that no data is transmitted.

Google Ads and conversion measurement. We advertise on Google. When you arrive from one of our advertisements and later create an account or start a paid subscription, we send Google a record of that event together with the click identifier that brought you, so that we can tell which campaigns work. The conversion record may include the event type, time, subscription value, click identifier and an internal reference used to identify the event. We do not include your name, email address, phone number, financial account data or portfolio contents.

Google Consent Mode. Your choices in the consent banner are passed to Google’s tags and govern whether Google may use cookies and identifiers for analytics and advertising.

Google Ireland Limited and Google LLC may process data in Ireland and the United States. Their role as a processor or an independent controller depends on the service, the applicable terms and the data use. Disclosures for cross-context behavioural advertising or targeted advertising may constitute sharing or a sale under applicable U.S. state privacy laws, even where no money is exchanged. Section 12 explains your opt-out rights.

We do not exchange personal data for money, and we do not share it with data brokers. Advertising-related disclosures are described above and in section 12.

5. Who else receives your data

Where personal data is transferred outside the European Economic Area, we rely on the European Commission’s Standard Contractual Clauses or on an adequacy decision, as applicable to the recipient.

6. How long we keep it

7. Deleting your account

You can delete your account from within the Service, or by email if you can no longer sign in. Our Data Deletion policy sets out both routes, what is removed, what we are required to retain, and how long it takes. Deletion also removes the traffic source record associated with you.

Deleting your account does not automatically retract conversion records previously sent to Google. These records are pseudonymous personal data and may link a click identifier to an internal reference and the value and time of an event. We handle requests concerning previously disclosed personal data under applicable law, including notifying recipients where required. Conversion-report adjustments are distinct from deletion of personal data. These conversion records do not include your name, email address, postal address or financial account information. See section 12 for how this transfer is characterised under U.S. state privacy law.

8. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, to correct it, to delete it, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent you have given. Withdrawing consent does not affect processing carried out before you withdrew it.

To exercise any of these rights, contact [email protected]. We will respond within the period the applicable law allows.

If you are in the European Economic Area or the United Kingdom and believe we have handled your data improperly, you may lodge a complaint with your national data protection authority.

9. Children

The Service is not directed to, and may not be used by, anyone under 18. We do not knowingly collect personal data from children.

10. Security

We apply technical and organisational measures appropriate to the sensitivity of the data we hold, including encryption of data in transit and at rest, access control, and logging. No system is perfectly secure, and we do not claim otherwise.

11. Changes to this policy

We will post any change on this page and update the “Last updated” date. Where a change materially affects how we use your data, we will tell you before it takes effect.

12. Your U.S. state privacy rights

This section applies to residents of California and of other U.S. states with comprehensive privacy laws, including Colorado, Connecticut, Virginia, Texas and Utah. Where a state law gives you a right that is broader than the one described here, that broader right applies.

Categories of personal information we collect. The categories covered by this policy are described in Section 1: identifiers (name, email address, account identifier, IP address, cookie and advertising identifiers); commercial information (plan, subscription and payment status, obtained from our payment processor); internet and network activity (pages viewed, events within the Service, referring website, campaign parameters of the advertisement you arrived from); financial account information you choose to connect (read-only access, described in Section 1); and inferences drawn from the above solely to operate and improve the Service.

We do not sell your personal information for money. We have not done so and we do not intend to.

We do share advertising identifiers, and we say so plainly. When you arrive at our website from an online advertisement, your browser carries an advertising click identifier. If you subsequently register or subscribe, we transmit that identifier, together with the fact and value of that event, to Google so that we can measure which advertisements produce customers. We do not transmit your name, your email address, your financial account data or any information about your holdings. Depending on how the recipient uses the data, this disclosure may constitute sharing for cross-context behavioral advertising, targeted advertising, or a sale under applicable state law. These terms can apply even when no money changes hands. You can opt out as described below.

Your right to opt out. You may direct us to stop any sale or sharing of your personal information for cross-context behavioral advertising or targeted advertising at any time. We offer two methods, and both are free:

1. The link titled "Do Not Sell or Share My Personal Information" in the footer of this website. Selecting it opens your privacy settings, where you may withdraw the "Marketing" category.
2. An opt-out preference signal. We recognize the Global Privacy Control (GPC). If your browser or extension transmits that signal, we treat it as a valid request to opt out of sharing, and we apply it automatically, without any action on your part and without requiring you to create an account.

An opt-out applies to future sharing and targeted advertising; it does not stop processing needed to provide the Service. Changing your browser settings does not automatically delete data already disclosed. To request deletion of previously disclosed personal data, contact [email protected]. We handle these requests under applicable law, as described in Section 7. Browser choices apply to that browser; contact us to exercise rights relating to your account or other devices. You do not need an account to submit an opt-out request.

Your other rights. Subject to the exceptions permitted by applicable law, you may have the following rights. We verify identity where required for access, correction or deletion; we do not require identity verification for an opt-out of sale or sharing:

• know what personal information we have collected about you, the categories of sources, the purposes for which we use it, and the categories of third parties to whom we disclose it;
• access a copy of that information in a portable form;
• correct inaccurate personal information;
• delete your personal information. You may initiate deletion from within the application; see Section 7 and our Data Deletion policy. Certain records may be retained where a law, a tax obligation, or the establishment or defence of a legal claim requires it;
• limit the use of sensitive personal information. We do not use or disclose sensitive personal information for any purpose that would trigger this right, and we do not use it to infer characteristics about you;
• opt out of sharing for cross-context behavioral advertising, as described above.

How to exercise these rights. Write to [email protected] from the email address associated with your account, or use the deletion control inside the application. We will acknowledge your request within ten business days and respond within forty-five calendar days. Where a request is complex we may extend that period once by a further forty-five days, and we will tell you the reason before we do. For requests that require identity verification, we will verify your identity in a manner proportionate to the sensitivity of the information requested; we will not ask you for more information than that verification requires, and we will not use what you give us for verification for any other purpose.

Authorized agents. You may designate an authorized agent to make a request on your behalf. Where permitted by applicable law, we may ask for evidence of the agent’s authority and, for access, correction or deletion requests, confirmation from you. Opt-out preference signals do not require a signed authorization or identity verification.

No discrimination. We will not deny you the Service, charge you a different price, provide a different level of quality, or suggest that we will do any of these things, because you exercised a privacy right. We operate no financial-incentive programme in exchange for personal information.

Automated decision-making and profiling. We do not make decisions producing legal or similarly significant effects concerning you by automated means. Analytical outputs the Service presents to you are informational and do not restrict your access to the Service or alter its terms.

Appeals. If we decline your request, we will tell you why. Residents of states that provide a right of appeal, including Colorado, Connecticut, Virginia and Texas, may appeal our decision by replying to our response or writing to [email protected] with the word "Appeal" in the subject line. We will respond to an appeal within forty-five days. If we deny the appeal, we will provide you with the means to contact your state Attorney General.

Notice at collection. This section, together with Sections 1, 2, 4, 5 and 6, summarizes our data practices. Please read this policy together with any notices presented when you provide personal data. We collect the categories described above at the point of registration and while you use the Service, for the purposes described in Section 2, and we retain them for the periods described in Section 6.

13. Contact

ECODEV LIMITED, registration number ΗΕ 434314, Kypranoros 13, EVI BUILDING, Floor 2, Flat/Office 201, 1061 Nicosia, Cyprus

Email: [email protected]