Privacy Policy

This policy applies to orbitpage.com, OrbitPage accounts and dashboards, support channels and the managed publication service on orbitpage.net. It does not govern independent self-hosted installations of the open-source OrbitPage software.

The controller for the managed service is Paolo Ronco, operating OrbitPage. Privacy requests can be submitted through the contact page or sent to contact@orbitpage.com. Further operator information appears in the Legal Notice.

OrbitPage is the controller for account administration, platform security, billing and its own website analytics. A page owner decides which content, links, embeds, contact details and optional analytics appear on their public page. For those choices, the page owner may act as a separate controller and must provide any notice or consent required by law.

OrbitPage processes the page owner's hosted content and delivery data to publish the requested page. When a page owner enables newsletters, that owner determines the recipients, message content, purpose and chosen SMTP provider and normally acts as controller for the subscriber list. OrbitPage processes that list and campaign activity on the owner's instructions while remaining controller for platform security, abuse prevention and account administration.

When a page owner enables Shop, that owner is the seller and controller for customer and fulfilment data used for the sale. The seller must publish their identity, contact details and policies. OrbitPage processes catalog, order, consent, delivery and optional booking data to provide the Shop, while Stripe independently processes payment, identity and payout information under its connected-account terms. A seller that connects Cal.com also instructs OrbitPage to exchange the minimum booking lifecycle data with that account.

When a page owner adds a partner block, booking tool, form, map, player or other external service, the page owner selects that recipient and decides the purpose of the integration. OrbitPage keeps consent-gated content blocked until the visitor grants the relevant category, but the external provider independently processes data once its content is loaded or its link is opened.

Visitors and newsletter subscribers should contact the page owner first about content or personal data they supplied directly to that owner, while OrbitPage remains available for infrastructure privacy requests and unlawful-content reports. The Data Processing Agreement governs processing carried out by OrbitPage on the page owner's behalf.

With analytics consent, PostHog processes platform page views, product actions, technical error types and masked dashboard recordings to help us improve activation, usability and reliability. It runs on OrbitPage-owned platform routes, never on hosted customer pages or operator screens. Authenticated events use a purpose-bound hash of the account identifier, not an email address or raw Firebase identifier. Server events follow the account's analytics choice and stop after withdrawal or consent expiry.

Replay is limited to selected editor sections. Inputs, customer text and content attributes are masked; layout, bundled styles, standard icons and static navigation labels remain visible. Images, media and embeds are blocked. Authentication, billing, account management, team, Shop, newsletter and AI panels are excluded from recordings. Network bodies, headers, console messages, page content and AI prompts are not intentionally collected. Error messages are redacted; limited technical stack frames can be retained. These pseudonymous records can still be personal data.

PostHog, Inc. processes this data for OrbitPage through PostHog Cloud EU. Requests pass through our dedicated t.orbitpage.com subdomain using PostHog's managed reverse proxy, operated through Cloudflare. The proxy handles network and request information and removes the Cookie header before forwarding requests to PostHog. A first-party address does not make analytics essential or remove the need for consent. OrbitPage disables analytics IP enrichment and the project discards client IP data; network providers necessarily handle connection information. Provider and transfer details are in the provider notice.

You can refuse or withdraw analytics using Cookie settings without losing account, editing, publishing or paid-plan access. The choice expires after 180 days; an enabled Global Privacy Control signal keeps browser analytics disabled. For a signed-in account, the saved choice also controls server product events. If the account preference cannot be saved, the interface displays a retry message; the browser choice takes effect immediately, while server withdrawal completes only when the account update succeeds. Withdrawal stops future collection but does not itself erase previously collected records. To request access or erasure of PostHog data, contact OrbitPage using the channels below; provider erasure is a separate operator action from deleting the OrbitPage account.

• Account, team and identity data: name, email address, Firebase identifier, authentication method, email-verification status, username, workspace memberships, invitations, roles, session and account-security events. For new accounts we also record the Terms version, acceptance time and language, and the account-eligibility attestation time.
• Workspace and publication data: page settings, links, text, themes, uploaded images or video, connected domains, revision identifiers, publication status and plan usage.
• Public visitor and consent data: requested page, coarse request and delivery information, click events where the active plan includes analytics, security signals, and category choices, policy version, timestamp and random receipt identifier for a public-page consent receipt. The receipt does not intentionally contain a name or email address.
• Device and security data: IP address, browser and device information, request timestamps, App Check or reCAPTCHA signals, rate-limit counters, error logs and suspected-abuse events. Workspace audit history records the time, acting account, action and short description of page and team changes without storing the edited content or request body; it remains for the workspace lifetime and is removed with the workspace. With analytics consent, OrbitPage also computes a pseudonymous browser identifier locally and stores only a purpose-bound server-side hash with a signed-in account to recognize returning customers.
• Billing data: plan, Stripe customer and subscription references, invoice and payment status, cancellation status and billing correspondence. OrbitPage does not receive or store full payment-card numbers.
• Support, contact and service-request data: name, email, selected topic, message, reference number, linked workspace, delivery status and information you provide through support, chatbot, moderation appeals or privacy requests. Online withdrawal declarations additionally contain the contract identifier, declaration, legal version, date, time and email-receipt status.
• Business relationship data: prospect, demo, onboarding, promotion-code and customer-care records entered by the operator, including business contact details, category, notes, follow-up status and communications.
• Moderation data: bounded page text submitted for safety classification, content hashes, categories returned by the moderation service, review status, temporary restrictions and appeal records.
• Newsletter data: subscriber email address and optional name, consent and confirmation timestamps, subscription status, campaign content and schedule, SMTP acceptance or rejection, unique open and click signals, unsubscribe events, and encrypted credentials for the SMTP server chosen by the page owner.
• Optional OrbitPage marketing: account email, explicit opt-in and withdrawal timestamps, selected site language, account activity and page-content status used to select a welcome message or a limited reminder, and send timestamps. No marketing is sent without opt-in.
• Connected-service configuration: the selected provider, public content or share URL, display settings and consent category for partner blocks, players, maps, booking tools and forms. OrbitPage does not ask for the visitor's third-party account password to display these public integrations.
• AI page-editing data: your instruction, recent assistant conversation, current page context and, when you use Launch Kit, the screenshot you submit and any later corrections are sent to OpenAI to generate an answer or proposed edit. OrbitPage requests non-persistent response handling with store: false; Launch Kit screenshots are re-encoded and not stored by OrbitPage. OrbitPage keeps the submitted instruction with the account, workspace, outcome and timestamp for support and quality review, but does not keep the recent conversation history or screenshot in its operational event log. A validated proposal, including any visible or subsequently supplied destinations, remains available for up to ten minutes and becomes page content only if you confirm it; operational records can also include model, token counts, request identifier and estimated cost. Unless a separately approved zero-data-retention setting applies, OpenAI may retain API inputs, outputs and safety metadata for a limited abuse-monitoring period under its published data controls.
• Automation API and connected-app data: personal token name, scope, prefix, one-way hash, expiry, creation, last-use and revocation details; and OAuth client name and identifier, registered return address, selected workspace, granted scopes, connection and last-use timestamps and one-way credential hashes. Raw personal tokens, authorization codes and connected-app credentials are not recoverable after issue.
• Tenant Shop and booking data: public seller identity and policy links, connected Stripe account reference and capability status, product catalog, private delivery files, order and application-fee references, buyer email, seller-terms and digital-delivery consent timestamps and versions, payment, refund and dispute status, delivery expiry, download count, intake answers, booking provider identifier, status, scheduled times and meeting URL where a seller connects Cal.com, and limited request-security signals. OrbitPage does not store full payment-card, Stripe identity-verification or payout-account details.
• Contract evidence: Stripe Checkout references, accepted legal version, terms acceptance and immediate-performance request for paid plans, plus the Shop consent evidence and withdrawal records described above.
• Optional website analytics: consent choice, page and interaction data, approximate location and technical identifiers collected by Google Analytics and PostHog only after consent and only on OrbitPage-owned platform pages. A separate same-origin returning-customer lookup uses the hashed browser identifier described above and sends only a boolean returning-customer event to Google Analytics.

Public AI product guide: the question, up to four previous messages and relevant public documentation are sent to OpenAI when an answer requires generation. No account, workspace or private documentation is accessible to this guide. The browser keeps the conversation in memory and clears it on reset or page closure; OrbitPage does not persist visitor questions or answers in application logs or its audit store. OpenAI receives a purpose-bound hashed safety identifier derived from the request rate-limit subject, rather than an account identifier. Necessary hosting, attestation and abuse controls still process network and device signals. Operational events contain a generated request ID, language, outcome, model, timing, safe error codes and token/cost metadata. Do not submit secrets or unnecessary personal data.

Newsletter open and click measurement requires a separate, optional consent, initially unchecked. Confirmation activates only the choice expressly requested. Existing and imported subscribers have no tracking permission by default. Without permission, OrbitPage omits tracking pixels and remote images and uses direct destination links. Each campaign email contains a tracking-preference link: withdrawal stops new engagement records, including for previously sent messages, without ending the subscription. Later consent does not reactivate old messages. Where authorised, OrbitPage records the first open and click times for the recipient and campaign; reports remain until the campaign or account is deleted. Consent records include the notice version, time, source and sender privacy-policy URL. Email proxies and scanners may distort these metrics. Senders must disclose this processing and disable any independent SMTP-provider tracking unless separately authorised. OrbitPage platform marketing is blocked when its provider tracking is enabled or cannot be verified as disabled.

Public AI product guide: processing is necessary to respond to the product-information request you initiate, including steps at your request before a contract under Article 6(1)(b) GDPR where applicable. Limited service-integrity and abuse-prevention processing relies on Article 6(1)(f), and applicable legal obligations on Article 6(1)(c). Using the guide is optional and does not grant analytics or marketing consent.

Account identity, security, workspace and billing data marked as required is necessary to provide the requested service. Seller identity and policy details are required before a Shop can be published, seller-terms acceptance is required for every Shop checkout and separate express consent is required before immediate digital delivery. Without required data, OrbitPage may be unable to create an account, publish a page, process a subscription or Shop order, deliver a digital purchase or investigate abuse. Optional profile content, partner blocks, AI editing, connected AI apps, chatbot use and website analytics are voluntary.

OrbitPage uses Firebase and Google Cloud for accounts and data; Vercel for hosting; Cloudflare for delivery and storage; Stripe for payments; Google Analytics and PostHog for optional analytics; OpenAI for AI features and automated text and image safety moderation; Resend for optional marketing; configured email providers for service messages; and n8n for contact forms when enabled. The Subprocessors notice lists providers and their roles. Page-owner integrations are described separately and configured by them.

For automated image-safety checks, OrbitPage sends newly uploaded images to OpenAI before storing them for publication. Video uploads are not checked this way.

Newsletter email is submitted to the SMTP provider configured by the page owner. That provider is selected and instructed by the owner, can process subscriber addresses and message content, and is governed by the owner's agreement with it.

For OrbitPage's own optional marketing, Resend processes the consenting account email address, selected language, message content and unsubscribe status. This is separate from both account-security email and newsletters operated by page owners.

A Shop seller may connect Cal.com for booking lifecycle updates; the seller's Cal.com account then receives buyer and order-linked booking data. A page owner may also select an external consent-management platform; that provider receives consent and device data according to the owner's configuration.

When an account holder connects ChatGPT or another MCP client, that selected service receives the workspace data returned by the tools the holder authorises. The client operates under the holder's account and the provider's terms; OrbitPage supplies a revocable, workspace-bound OAuth grant and does not disclose the holder's Firebase password or personal API tokens.

Partner blocks can connect a visitor to independent services such as Instagram, Facebook, YouTube, Spotify, Apple Music, Deezer, SoundCloud, Mixcloud, Vimeo, Loom, TikTok, Giphy, Google Maps, Google Calendar, Calendly, Typeform and Google Forms. Depending on the block, data is disclosed only when the visitor opens the link or after the required consent allows embedded content to load. The provider can then receive the visitor's IP address, browser information, referring page and provider-specific identifiers under its own privacy terms.

Provider purpose, data scope and official privacy documentation are listed in the Subprocessors notice. Data is also disclosed where required by law, to protect rights and safety, or in connection with a lawful business reorganisation. OrbitPage does not sell personal data.

The provider directory identifies provider services, roles, data categories, processing locations or their limits, transfer documentation and official privacy links. A provider may use its own subprocessors listed in its contractual disclosures. The use of a European ingestion endpoint does not establish that all support, security or onward processing remains in Europe.

Some providers operate globally or process certain data in the United States. Where EEA personal data is transferred to a country without an adequacy decision, OrbitPage relies on the provider's data-processing terms, Standard Contractual Clauses or another valid transfer mechanism and applies supplementary safeguards where appropriate.

You may request information about the applicable transfer mechanism and a copy of relevant safeguards through the privacy contact, subject to redaction needed to protect third-party rights and confidential information. OrbitPage does not represent that every provider or optional integration processes data exclusively in the EEA.

Public AI guide metadata: operational events are retained for 30 days. Expired events are excluded from operator views and removed by bounded scheduled cleanup; a backlog can delay physical deletion. Conversation content is not retained by OrbitPage. OpenAI applies the endpoint-specific retention described in the provider directory.

Protected provider backups: the configured provider-backup policy copies R2 objects and Firebase Authentication exports to private European Google Cloud Storage for 30 days. Object-lifecycle deletion is asynchronous and existing soft-delete protection can add a recovery interval. Firestore backups follow their configured managed schedule and retention. These restricted copies are used for recovery, remain protected after active-system deletion and are removed through the backup lifecycle; they are not an ordinary user archive. If restored, outstanding erasure requirements must be reapplied.

New images uploaded through the dashboard undergo automated safety classification before publication. This check can miss prohibited material or incorrectly flag lawful images. It does not review video uploads or determine image ownership, copyright or licensing.

You may contest a restriction and request human review through the contact page. OrbitPage considers the content, context and any supporting information before confirming, changing or removing a restriction.

Publication checks combine local rules, bounded AI safety classification and human review on request. A flag can trigger a publication block or temporary page restriction; it is not a finding that the account holder committed an offence. You may provide context, contest the outcome and request a person to reconsider it. Where Article 22 GDPR applies to a decision producing legal or similarly significant effects, the applicable safeguards, including human intervention and an opportunity to express your view, remain available.

Content published on an OrbitPage profile is intentionally public. It can be viewed without an account, linked, indexed, cached, copied or archived by third parties. Do not publish private, confidential or sensitive personal data unless you have a lawful reason and intend to make it public.

Subject to applicable law, you may request access, correction, deletion, restriction, portability or objection, and may withdraw consent without affecting earlier processing. Account owners can permanently delete their account and hosted workspace directly from Dashboard > Account after a fresh identity check. You may also object to processing based on legitimate interests and request human review of a moderation decision.

Personal API tokens and connected AI apps can be reviewed and revoked from Dashboard > Account. Consumer withdrawal is separate from data-protection rights and can be exercised through the online withdrawal function. OrbitPage may request evidence necessary to verify the requester identity before acting on other requests. GDPR requests are answered without undue delay and normally within one month. If complexity or the number of requests requires an extension of up to two additional months, OrbitPage explains the extension within the first month. Requests are normally free; any lawful refusal or reasonable fee for a manifestly unfounded or excessive request is explained with complaint and judicial-remedy options. Identity verification is limited to what is necessary. You may complain to the Italian Data Protection Authority or to the authority in your habitual EEA residence, workplace or place of the alleged infringement.

You may object at any time to direct marketing and to related profiling. No marketing consent is required to open an account or buy a plan. Consent withdrawal does not affect the lawfulness of earlier processing. Requests about customer-controlled subscriber or buyer data are handled with the relevant controller under the DPA.

The managed service is not directed to children and account holders must be at least 18 years old or otherwise legally able to enter the service agreement. Do not use OrbitPage to collect children's data without a valid legal basis and appropriate safeguards.

OrbitPage applies access controls, encrypted transport, tenant isolation, signed provider requests, request limits, publication revisions and monitoring appropriate to the service. No online system is completely secure. If a personal-data breach creates a legal notification duty, OrbitPage will notify the competent authority and affected people as required.

Material changes will be posted here and, where appropriate, communicated through the service or by email before they take effect. Questions and requests can be sent to contact@orbitpage.com.

Most information is provided by you, by your device or through service use. We also receive limited information from Google sign-in, Stripe payment and connected-account events, workspace owners inviting collaborators, sellers supplying order or booking instructions, and the service providers described above. Business enquiries and demo relationships can include professional information from public business pages or a referring contact. When information is obtained indirectly, applicable Article 14 information is provided within the statutory period or at the first communication where required; no exemption is presumed merely because information was public.