Privacy Policy

1. Information We Collect

We collect information in the following ways:

• Account Information: When you register, we collect your name, email address, and password. If you sign up via a third-party provider, we receive your profile information from that provider.
• Project Data: Content you create using the Service, including ideas, PRDs, designs, generated code, and deployment configurations.
• Usage Data: Information about how you interact with the Service, including pages visited, features used, session duration, and device information.
• Payment Information: Billing details processed securely through Stripe. We do not store your full credit card number on our servers.
• Communications: Messages you send to us via support channels, feedback forms, or email.

2. How We Use Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Process transactions and manage your subscription
• Send transactional emails (account verification, password resets, billing receipts)
• Analyze usage patterns to improve user experience and product features
• Detect, prevent, and address security issues and abuse
• Comply with legal obligations
• Communicate product updates, new features, and promotional offers (with your consent)

3. Data Storage

Your data is stored securely using industry-standard encryption at rest and in transit. We use Supabase as our primary database and authentication provider, which hosts data on secure cloud infrastructure. Project data, including generated code and designs, is stored in encrypted databases with access controls. Backups are maintained to ensure data durability and are encrypted using AES-256.

4. Third-Party Services

We use the following third-party services that may process your data:

• Supabase: Authentication, database storage, and real-time functionality. Supabase processes your account data and project information. Supabase Privacy Policy
• Stripe: Payment processing and subscription management. Stripe handles your billing information in accordance with PCI DSS standards. Stripe Privacy Policy
• PostHog: Product analytics and usage tracking. PostHog collects anonymized usage data to help us understand how the Service is used and improve the experience. PostHog Privacy Policy

5. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate personal data
• Erasure: Request deletion of your personal data ("right to be forgotten")
• Portability: Request a machine-readable export of your data
• Objection: Object to processing of your data for certain purposes
• Restriction: Request restriction of processing of your data

To exercise any of these rights, please contact us at privacy@orbitor.space. We will respond to requests within 30 days.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. If you delete your account, we will remove your personal data within 30 days, except where we are required to retain it for legal, accounting, or security purposes. Anonymized usage data may be retained indefinitely for analytics and product improvement. Backup copies are purged within 90 days of account deletion.

7. Security

We implement appropriate technical and organizational measures to protect your personal data, including encryption in transit (TLS 1.3) and at rest (AES-256), regular security audits, access controls, and monitoring. However, no method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security. We encourage you to use strong passwords and enable two-factor authentication on your account.

8. Changes to Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by posting the updated policy on our website and, where possible, via email. Your continued use of the Service after changes take effect constitutes acceptance of the revised policy. We recommend reviewing this page periodically.

9. Contact

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at privacy@orbitor.space.