Privacy Policy

1. Who is responsible for your data

The data controller is:

For any question about this policy or about your personal data, write to [email protected]. We answer data subject requests within 30 days.

2. What Orbit is

Orbit is a cloud application for organizing notes and records about companies, vehicles, people and properties. You create an account, you add records, and those records stay in your account until you delete them or delete the account.

3. The public website

The website at https://orbit.management is a presentation page. It sets no analytics cookies and no advertising cookies. It does not profile visitors, does not run third-party tracking pixels, and does not build audiences for remarketing. It remembers your light or dark theme choice in your browser's local storage, and that choice is never sent to us.

The only cookies the application at https://app.orbit.management sets are strictly necessary ones: a session cookie that keeps you signed in and a CSRF token cookie that protects form submissions. Both expire when your session ends or shortly after. Neither is used for tracking across sites.

4. Account information

When you create an Orbit account we store:

• your email address
• your display name
• a password hash, if you registered with a password (we never store the password itself)
• the date your account was created
• a profile picture, if you upload one
• your Telegram chat identifier, if you connect Telegram notifications

We use this data to authenticate you, to keep your account secure, to detect abuse, and to contact you about the service when it matters (security notices, changes to terms, service interruptions).

5. Signing in with Google

Orbit offers sign-in and registration with a Google Account. This section describes exactly what happens to Google user data.

5.1 What we request

When you choose to sign in with Google, Orbit requests three standard OAuth scopes and nothing else:

All three are classified by Google as non-sensitive scopes.

5.2 What we do not request

Orbit does not request, and therefore cannot access, any of the following: Google Drive, Google Calendar, Gmail, Google Contacts, Google Photos, Google Chat, YouTube data, Google Cloud resources, or any other Google service or API.

5.3 What we store

From the data Google returns we store only:

• the Google account identifier (the sub claim)
• the email address, marked as verified when Google confirms it
• the name

Orbit does not store your Google profile picture. Orbit does not store the OAuth access token or refresh token: the access token is used once, during sign-in, to read the data above, and is then discarded. We do not store your Google password and never have access to it.

5.4 How we use it

Google user data is used for one purpose: to create your Orbit account and to authenticate you when you return. Your name and email address are shown inside your own account and, if you join a shared workspace, to the other members of that workspace.

Google user data is never used for advertising, never used for marketing, never sold, never rented, and never shared with data brokers. Orbit does not use Google user data to develop, improve or train generalized artificial intelligence or machine learning models.

5.5 Limited Use

Orbit's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

5.6 Revoking access

You can disconnect Orbit from your Google Account at any time at https://myaccount.google.com/permissions. Once you do, Orbit receives no further data from your Google Account unless you sign in with Google again. Revoking access does not by itself delete the Orbit account or the records you created; to delete those, see section 9.

6. Content you add to Orbit

The records you create in Orbit (companies, vehicles, people, properties, notes, files and any other content) belong to you. We process them only to operate the service: to store them, to show them back to you, to index them so search works, and to back them up.

We do not read your content for advertising purposes, we do not sell it, and we do not use it to train machine learning models. Our staff do not access it except where you explicitly ask for support that requires it, or where we are legally compelled to.

If you enter personal data about other people into Orbit (for example a client's contact details), you act as the controller of that data and you are responsible for having a lawful basis to process it. We act as your processor for that content.

7. How data is shared

We share personal data only in these situations:

• Infrastructure providers. Orbit runs on servers and services operated by third parties that host the application, store the database, deliver email, and protect against network attacks. These providers act as processors under written agreements, may process data only on our instructions, and are bound by confidentiality.
• Legal obligations. We disclose data where required by applicable law, by a valid court order, or by a lawful request from a competent authority, and only to the extent required.
• Business transfer. If RECWEB SRL is acquired, merged, or sells the assets behind Orbit, personal data may transfer to the acquiring entity. You would be notified before any such transfer takes effect and before your data becomes subject to a different privacy policy.

We do not sell personal data. We do not share personal data with advertising networks.

8. Storage, location and security

Data is stored on servers located within the European Union. Where a processor operates outside the EU or the European Economic Area, the transfer is covered by an adequacy decision of the European Commission or by Standard Contractual Clauses.

Security measures in place include encryption in transit (HTTPS/TLS for every connection), password hashing with a modern algorithm, access controls limiting who inside the company can reach production systems, and regular backups.

No system is perfectly secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we notify the Romanian supervisory authority within 72 hours and notify affected users without undue delay.

9. Retention and deletion

We keep your account data and your content for as long as your account is active.

You can delete your account at any time from the account settings inside the application, or by writing to [email protected] from the email address of the account. When your account is deleted:

• your account, records and files are permanently deleted from the live database immediately
• the data disappears from encrypted backups within 30 days, as those backups rotate
• we retain only what the law requires us to retain, such as invoicing records where a payment was made, for the period the law prescribes

10. Your rights

If you are in the European Economic Area, the GDPR gives you the right to:

• access the personal data we hold about you
• rectify data that is inaccurate or incomplete
• erase your data (the right to be forgotten)
• restrict processing in certain circumstances
• object to processing based on legitimate interest
• receive your data in a structured, machine-readable format and have it transmitted to another controller (portability)
• withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal

To exercise any of these, write to [email protected].

You also have the right to lodge a complaint with the Romanian supervisory authority, the National Supervisory Authority for Personal Data Processing (ANSPDCP), at https://www.dataprotection.ro.

Legal basis for processing

11. Children

Orbit is not directed at children under 16 and we do not knowingly collect personal data from them. If you believe a child has created an account, write to [email protected] and we will delete it.

12. Changes to this policy

We may update this policy as the service changes or as the law requires. The "Last updated" date at the top always reflects the current version. For changes that materially affect how we handle your personal data, we notify registered users by email at least 14 days before the change takes effect.

13. Contact