Privacy Policy

Account data. When you create an Orbilex account we collect your name, email address, and company name. This is required to provide the service.

Usage data. We log actions you take within the platform (provisioning events, billing operations, ticket updates) in an immutable audit trail. This data is stored on infrastructure you control and is never accessed by us without explicit support consent.

Payment data. We do not store card numbers or bank account details. Payment processing is handled by your chosen gateway (Stripe, Paystack, Flutterwave, or PayPal) under their respective privacy policies.

Technical data. We collect IP addresses, browser type, and access timestamps in server logs for security and abuse-prevention purposes. Logs are retained for 90 days.

We use the information we collect to:

• Operate and maintain the Orbilex platform
• Send transactional emails (password resets, license renewal reminders, invoice receipts)
• Respond to support requests
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations

We do not sell, rent, or share your personal data with third parties for marketing purposes.

If you are located in the European Economic Area (EEA) or the United Kingdom, we rely on the following legal bases under GDPR Article 6 to process your personal data:

• Contractual necessity (Art. 6(1)(b)). Account data, usage data, and billing data are processed to perform our contract with you (providing the Orbilex platform).
• Legitimate interests (Art. 6(1)(f)). Technical/log data is processed for security monitoring, abuse prevention, and platform integrity. Our interests do not override your fundamental rights.
• Legal obligation (Art. 6(1)(c)). We may process data to comply with applicable law, including retaining records for tax and audit purposes.

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

We engage the following third-party sub-processors to operate the platform. Each has been assessed for GDPR compliance and is bound by appropriate data processing agreements:

• Supabase Inc. — Authentication, database, and file storage (EU Frankfurt region by default).
• Stripe, Inc. — Payment processing (when the Stripe gateway is enabled by an operator).
• Paystack Inc. / Flutterwave Inc. / PayPal Holdings, Inc. — Alternative payment gateways (only when enabled by the operator; governed by their respective data processing terms).

For self-hosted deployments, Palladium Innovations does not process your end-client data — you are the sole data controller for that data. Sub-processors above apply only to operator account data (your account, billing, and support interactions with us).

A full sub-processor list and Data Processing Agreement (DPA) is available on request at legal@orbilex.app.

Orbilex is a self-hosted platform. Your data resides on infrastructure you provision and control. We do not store client or end-user data on Palladium Innovations servers unless you are using a managed hosting arrangement explicitly agreed in writing.

If you use our cloud-hosted option, data is stored in the EU (Frankfurt) region by default. You may request a different region at the time of account creation.

International transfers. Where personal data is transferred outside the EEA or UK, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or other lawful transfer mechanisms, to ensure an adequate level of protection. Our primary infrastructure provider (Supabase) processes data within the EU by default. If you require a specific transfer impact assessment, contact us at legal@orbilex.app.

Account data is retained for the duration of your subscription and for 30 days after cancellation, during which you may export your data. After 30 days, account data is permanently deleted. Audit logs follow the retention policy you configure in the platform (default: 12 months).

Depending on your jurisdiction, you may have the right to access, correct, delete, or export personal data we hold about you. To exercise these rights, email legal@orbilex.app and we will respond within 30 days.

EU and UK residents have additional rights under GDPR and UK GDPR, including the right to lodge a complaint with a supervisory authority.

We implement industry-standard technical and organisational measures including TLS in transit, AES-256 at rest, ECDSA-signed licensing, and role-based access controls. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.

To report a security vulnerability, see our Security Policy.

We use strictly necessary cookies to maintain session state. We do not use advertising or tracking cookies. For details, see our Cookie Policy.

We may update this policy from time to time. We will notify you by email and by posting a prominent notice in the platform at least 14 days before material changes take effect. Continued use of the platform after that date constitutes acceptance of the updated policy.

Palladium Innovations
For privacy matters: legal@orbilex.app