Privacy Policy
Orient • Last updated: 24 February 2026
This policy explains what personal data Orient (operating TeXposit) collects, why, and how it is used. Orient is a Finnish company incorporated in the EU and subject to the GDPR.
1. What data do we collect?
TeXposit collects the following personal data:
- Account data: your first name, last name, and email address, provided when you register.
- Credentials: your password, stored as a one-way cryptographic hash. We cannot read it.
- Content data: LaTeX documents, project files, and AI chat conversation history that you create within the service.
- Usage data: timestamps of logins and service interactions, used for security and abuse prevention.
We do not collect payment card data (handled by our payment processor), precise location data, or any special-category data under GDPR Article 9.
2. How do we collect your data?
You directly provide most of the data we hold. We collect data when you:
- Register for an account or update your profile.
- Create, edit, or share documents and projects.
- Use the AI assistant (your messages and relevant document excerpts are sent to the AI).
- Contact us by email.
We also collect a session cookie automatically when you log in. See Cookies.
3. How will we use your data?
TeXposit uses your data to:
- Create and manage your account.
- Store and serve your documents and projects.
- Provide the AI assistant features.
- Send essential service emails (e.g. password reset, security alerts).
- Diagnose bugs and improve the service.
We do not use your data for advertising, sell it to third parties, or use your documents or conversations to train AI models.
4. Legal basis for processing
Contract performance (Art. 6(1)(b))
Processing your account data, documents, and usage data is necessary to deliver the service you signed up for.
Legitimate interests (Art. 6(1)(f))
We process minimal usage and log data to detect abuse, maintain security, and improve the service. This does not override your rights. You can object at any time.
Legal obligation (Art. 6(1)(c))
In certain limited cases (e.g. responding to a lawful court order), we may be required to process or disclose data.
We do not rely on consent as a legal basis for your core account or document data. Where consent is used for any optional feature, we will make this clear at the time.
5. How do we store your data?
All user data is stored on servers located exclusively in Finland and Germany, inside the European Economic Area. Data never leaves the EEA as part of normal service operations.
Personal data and documents are encrypted at rest and in transit using industry-standard TLS. Access to production systems is limited to authorised personnel.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the Finnish Data Protection Authority without undue delay, and in any case within 72 hours of becoming aware of it.
6. AI processing
TeXposit provides an AI assistant powered by large language models. Here is how your data flows:
Default: cloud AI via OpenRouter
When you use the AI assistant with the default setup, your messages and relevant document excerpts are routed through OpenRouter to one of several underlying model providers. We select only providers that contractually guarantee they will not use API inputs to train their models. Your content is not retained by any provider beyond returning a response.
Ollama (local AI)
You may run AI models locally using Ollama. Your prompts and document content are processed on your own machine and never leave your device. No data is sent to us or any third party for AI inference.
No AI training: Neither Orient nor any AI provider we use trains their models on your documents or conversations.
8. Data retention
We retain your personal data only for as long as your account is active, or as required by law.
- Active account: all data is retained while your account exists.
- Account deletion: when you delete your account (via account settings or by emailing us), your personal data and all documents are permanently removed from our primary systems.
- Backups: deleted data may persist in encrypted backups for up to 90 days before being fully purged.
Anonymised or aggregated data that cannot be linked back to you (e.g. total number of registered users) may be retained indefinitely.
9. Third parties
TeXposit shares data with the following categories of third parties, strictly to operate the service:
Netcup (infrastructure / hosting)
Our servers are hosted with Netcup GmbH, a German provider with data centres in Germany. Netcup acts as a data processor under GDPR and is contractually bound to process data only on our instructions.
OpenRouter (AI routing)
When you use the default AI assistant, prompts and relevant document excerpts are routed through OpenRouter to underlying model providers. We use only providers that guarantee no training on API inputs. See the AI processing section above.
Stripe (payment processing)
Payment card data is handled directly by Stripe and never touches our servers. We receive only the outcome of a transaction and a subscription identifier. Stripe's privacy policy applies to payment data.
We do not sell personal data, share it with advertising networks, or disclose it to any third party beyond what is listed above.
10. Your data protection rights
Every TeXposit user has the following rights under the GDPR. To exercise any of them, email [email protected]. We will respond within one calendar month, free of charge. For a full description, see our GDPR compliance page.
- Right to access: request a copy of the data we hold about you.
- Right to rectification: correct inaccurate data (many fields editable in account settings).
- Right to erasure: request deletion of your account and all associated data.
- Right to data portability: receive your data in a machine-readable format.
- Right to restrict processing: ask us to pause processing in certain circumstances.
- Right to object: object to processing based on legitimate interests.
- Right to lodge a complaint: with your national data protection authority.
11. Other websites
TeXposit may contain links to other websites. This privacy policy applies only to TeXposit. When you follow a link to another site, we are not responsible for their data practices.
12. Changes to this privacy policy
We keep this policy under regular review. When we make material changes, we will update the “Last updated” date at the top of this page and, for significant changes, may notify you by email. Continued use of TeXposit after an update constitutes acceptance of the revised policy.
13. How to contact us
For questions about this policy, to exercise a data right, or to report a concern:
Orient
Kaitoväylä 20, Oulu 90570, Finland
[email protected] (privacy & data requests)
[email protected] (general enquiries)
TeXposit does not have a formally appointed Data Protection Officer (DPO), as one is not required for our scale and type of processing.