Privacy Policy

1. Information we collect

We collect the following categories of data:

• Account data: name, email address, and password hash when you register.
• Business data: agency name, branding assets, and billing information (processed by Stripe — we never store raw card numbers).
• Usage data: pages visited, features used, and error logs to help us improve the product.
• Content data: files, messages, project data, and invoices you create within the Service.

2. How we use your data

We use your data only to:

• Provide, operate, and improve the Service
• Process payments and send billing notifications
• Respond to support enquiries
• Send product updates (opt-out available)
• Comply with legal obligations

We never sell your data to third parties or use it for advertising purposes.

3. Data sharing

We share data only with the sub-processors required to deliver the Service:

• Supabase — database and file storage (AWS us-east-1)
• Stripe — payment processing
• Resend — transactional email delivery
• Vercel — hosting and edge compute

Each sub-processor is bound by a Data Processing Agreement and operates under appropriate data protection standards.

4. Data retention

We retain your data for as long as your account is active. On account deletion or termination, data is retained for 30 days to allow export before permanent deletion.

5. Security

We employ industry-standard security measures including encryption in transit (TLS), encryption at rest, row-level security on all database tables, and signed file URLs that expire automatically. Access to production systems is restricted to authorised personnel only.

6. Your rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict certain types of processing
• Data portability (receive your data in a machine-readable format)
• Lodge a complaint with your supervisory authority

To exercise any of these rights, email privacy@orbinly.com.

7. Cookies

We use strictly necessary cookies to maintain your session and ensure the Service functions correctly. We do not use tracking or advertising cookies.

8. Changes to this policy

We will notify you by email of material changes to this policy at least 14 days before they take effect. The “Last updated” date at the top of this page reflects the most recent revision.

9. Contact

Privacy questions or DPA requests: privacy@orbinly.com.