Privacy Policy

Last updated: September 24, 2026

1. Data Controller

The controller of personal data collected through the Orbitmap platform is:

2. Data We Collect

We collect the following personal data:

• Early Access form: email address, signup date.
• Account registration: email address, username, profile data.
• Technical data: IP address, browser type, operating system, and activity data within the Service (collected automatically).

3. Purposes of Processing

Personal data is processed for the following purposes:

• Providing the services available through the platform (Art. 6(1)(b) GDPR — performance of a contract).
• Notifying you about the Service launch and updates under the Early Access program (Art. 6(1)(a) GDPR — consent).
• Fulfilling legal obligations of the Controller (Art. 6(1)(c) GDPR).
• Analyzing and optimizing the Service (Art. 6(1)(f) GDPR — legitimate interest).
• Contacting registered users about their account, onboarding and changes to the Service (Art. 6(1)(b) and 6(1)(f) GDPR).

4. Cookies

The Service uses cookies for the following purposes:

• Essential: ensuring proper operation of the Service (session, CSRF token).
• Analytical: collecting data about how the Service is used through Google Analytics — only with your consent. In the application, product usage events tied to your account identifier (never your name or email) are sent to Google Analytics regardless of cookies, under Art. 6(1)(f) GDPR.
• om_v: remembers which of three landing page versions you were shown, so the site looks the same on your next visit. Contains no identifier, functional (set regardless of your analytics choice), kept for 1 year.
• om_dev: set only when the Service is opened via an internal preview link, to enable a prototype view. Ordinary visitors never receive it. Kept for 24 hours.

You can manage your cookie preferences using the cookie banner displayed on your first visit. You can also change cookie settings in your browser at any time.

5. Data Retention

• Early Access form data — until the Service launches or until you withdraw your consent.
• Account data — for the duration of your use of the Service and 30 days after account deletion.
• Technical data — up to 26 months.

6. Your Rights

You have the right to:

• Access your personal data.
• Rectify your data.
• Erase your data ("right to be forgotten").
• Restrict processing.
• Data portability.
• Object to processing.
• Withdraw consent at any time (without affecting the lawfulness of processing carried out before withdrawal).
• Lodge a complaint with a supervisory authority. For users in Poland: the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.

To exercise any of these rights, contact us at: [email protected].

7. Data Sharing

Personal data may be shared with third-party service providers acting on behalf of the Controller (e.g., hosting, Google Ireland Ltd. (Google Analytics)), only to the extent necessary to fulfill the purposes described in this Policy. We do not sell personal data to third parties.

8. International Data Transfers

When using service providers located outside the European Economic Area (e.g., cloud services), data transfers are based on Standard Contractual Clauses approved by the European Commission or on an adequacy decision.

9. Data Security

We implement appropriate technical and organizational measures to protect personal data, including encryption in transit (SSL/TLS), encryption at rest, and access controls.

10. Changes to This Policy

We reserve the right to update this Privacy Policy. Users will be notified of changes through a notice in the Service. The current version is always available at orbitmap.ai/privacy.