Oratio is operated by Lukas Toys SRL, a company registered in Romania.
Privacy Policy
This policy clearly explains what data Lukas Toys SRL processes when you use the Oratio website or send us a message.
Last updated: 23 July 2026
1. Who controls your data
The data controller is Lukas Toys SRL, a company registered in Romania and the operator of the Oratio ecosystem.
For privacy questions or to exercise your data rights, use the contact form and select the Privacy category.
2. Data we process
The website does not create user accounts or sell products directly. We may process:
- contact form data: name, email address, category, and message content;
- limited technical data required for security, such as an IP address temporarily used to rate-limit automated submissions;
- your language preference, cookie choice, and, if you accept analytics, aggregated and anonymised website usage data;
- for in-app purchases, limited order information made available to the developer by Google Play, but not your full card details.
3. Purposes and legal bases
We process data only as needed to:
- answer enquiries and provide support — steps at your request, service delivery, and our legitimate interest in communicating;
- prevent abuse and protect the website — legitimate interests and security duties;
- remember requested preferences and optionally measure website usage — providing the requested feature and consent;
- meet legal, accounting, and consumer-protection obligations.
4. Recipients and providers
Data may be accessed only by authorised personnel and providers that help us operate the service: Vercel for hosting and Web Analytics, Resend for message delivery, and Upstash for contact-request numbering. Digital purchases are processed through Google Play under Google's own terms and policies.
Some providers may process data outside the European Economic Area. Where this happens, we use applicable safeguards such as adequacy decisions or standard contractual clauses, as appropriate.
5. How long we keep data
Contact messages are kept as long as needed to respond and resolve the matter, usually no longer than 24 months unless a legal duty or dispute requires longer retention. IP addresses used for automated rate limiting remain in server memory for no more than 15 minutes. Aggregated Web Analytics data is available for the reporting window of the Vercel plan. Cookie durations are listed in the Cookie Policy.
6. Your rights
Subject to the GDPR's conditions, you may request:
- access to your data and a copy;
- correction or deletion;
- restriction of processing or an objection;
- data portability, where applicable;
- withdrawal of consent without affecting earlier lawful processing.
7. Complaints
We encourage you to contact us first. You may also complain to Romania's National Supervisory Authority for Personal Data Processing or the competent authority where you live.
ANSPDCP website (Opens in a new tab)8. Children
The public website does not intentionally request children's data. If you are a minor, ask a parent or legal guardian for help before submitting personal data. If we learn that data was received without an appropriate legal basis, we will delete it.
9. Security and changes
We use reasonable technical and organisational safeguards, but no online transmission can be guaranteed to be entirely risk-free.
We may update this policy as our services or legal duties change. The current version and update date are published on this page.