Name, email, ASR identity, authentication identifiers and account status used to operate access.
Data protection
Privacy Policy
A clear account of the personal data used to operate OrunMila, why it is processed, who receives it and how users can exercise their rights.
Privacy centre · updated 30 September 2026
Know what moves through the system.
This overview makes the policy operational: what ASR receives, why it is used, which providers support the service and which controls remain with you.
Files, prompts, notes, datasets and saved research content that you intentionally submit.
Session, feature, reliability and security events needed to run, protect and diagnose the service.
Stripe customer, subscription, invoice and payment-status identifiers; ASR does not need full card numbers.
Account information, research content and support requests enter through the features you use.
Contract, legal obligation, legitimate interests or consent depending on the activity.
Retention follows service continuity, security, disputes and applicable legal record duties.
Access, rectification, erasure, restriction, portability, objection and consent withdrawal where applicable.
Supabase · authentication & backendStripe · payments & subscriptionsGitHub Pages · static hostingCloudflare · delivery & security
Controller
Alpha Stochastic Research (ASR), operated by Alpha Kabinet TOURE, determines the purposes and means of the personal-data processing described here. Privacy requests can be sent to contact@asr-lab.online.
Data we process
- Account and profile data: name, email, ASR identity, authentication identifiers and account status.
- Service activity: feature use, session and security events, saved research views, hypotheses, settings and support interactions.
- Research inputs: prompts, uploaded files, notes, datasets and other content that you intentionally provide to OrunMila.
- Billing data: Stripe customer/subscription identifiers, plan state, invoice/payment status and billing ledger metadata. ASR does not need to store full card numbers.
- Technical data: IP-derived security signals, browser/device information, cookies or local-storage preferences where used.
Purposes and legal bases
- Contract: create accounts, authenticate users, provide OrunMila, save requested research work and administer subscriptions.
- Legal obligation: maintain records required for accounting, tax, fraud prevention and lawful requests.
- Legitimate interests: secure the service, detect abuse, diagnose failures, measure reliability and improve product safety and performance.
- Consent: optional cookies or other processing where consent is the appropriate legal basis. Consent can be withdrawn for future processing.
AI and research processing
Current OrunMila AI features are operated without an external model provider. Prompts and relevant research context are processed through ASR application and infrastructure services needed to perform the requested function. Do not submit information you are not authorised to process. AI output can be probabilistic or wrong and is not treated as an authoritative market observation. If this processing architecture changes materially, this policy will be updated before the new transfer model is relied on.
Recipients and processors
Access is limited to authorised ASR personnel and service providers that need the data to operate the service. Core provider categories currently include:
- Supabase — authentication, application data and backend services
- Stripe — payment processing, subscription billing and billing portal
- GitHub Pages — static website hosting and deployment
- Cloudflare — network delivery, security and performance services
Providers may process data outside France or the EEA. Where applicable, ASR relies on the provider's legally recognised transfer mechanism and contractual safeguards.
Retention
Account and research-service data is retained while the account is active and thereafter only for as long as reasonably necessary for service continuity, security, dispute handling or legal obligations. Billing and accounting records may be retained for the statutory period that applies to the relevant record. Security logs and support records are kept for a limited period proportionate to their purpose. Cookie choices follow the retention described in the Cookie Policy.
Your rights
Subject to the conditions of the GDPR and applicable law, you may request access, rectification, erasure, restriction, portability, or object to certain processing. Where processing relies on consent, you may withdraw that consent. You also have the right to lodge a complaint with the French data-protection authority, the CNIL.
Cookies and local storage
Essential storage may be used for authentication, security, session continuity and user preferences. Optional cookies should be used only according to the choices available through the site's Cookie Settings. See the Cookie Policy for the dedicated cookie notice.
Security and changes
ASR applies technical and organisational controls appropriate to the service, but no internet service can guarantee absolute security. Material changes to this policy will be reflected by a new effective date and, where legally required, additional notice.