Privacy Policy

Account data: your name, email address, and hashed password when you create an account. Passwords are never stored in plain text.

Organization data: the operational information you enter — module assessments, KPIs, decisions, and notes — for each organization you manage.

Billing data: subscription status and plan tier. Card details are handled entirely by our payments processor (Stripe) and never touch our servers.

Technical data: log and audit records such as sign-in events, IP address, and timestamps, used for security and to maintain a compliance trail.

To provide and maintain the service, including running assessments, computing maturity scores, and generating recommendations.

To authenticate you, secure your account, enforce rate limits, and detect abuse.

To process subscriptions and send transactional email such as email verification and password resets.

To meet legal, accounting, and compliance obligations, including maintaining an immutable audit log.

We do not sell your personal information. We share data only with subprocessors that help us operate the service, under contract and only as needed.

Subprocessors include our database and infrastructure providers, our payments processor (Stripe), and our transactional email provider.

We may disclose information if required by law or to protect the rights, safety, and security of our users and the service.

We retain your organization data for as long as your account is active. You can export or delete your data at any time from within the product.

Audit records are retained for the period required to meet our compliance commitments, even after other data is removed.

We apply industry-standard safeguards including encrypted transport, hashed credentials, scoped database access, distributed rate limiting, and brute-force protection on sensitive endpoints.

No system is perfectly secure, but we work continuously to protect your information and to limit the blast radius of any incident.

Depending on your jurisdiction, you may have the right to access, correct, export, or delete your personal data, and to object to certain processing.

You can exercise most of these rights directly in the product, or by contacting us using the details below.

Questions about this policy or your data can be sent to privacy@orbitalos.online.