Privacy Policy

01Who we are

Orbit Sites is a frontend engineering studio. We design and build websites and storefronts, and we run a client portal at orbitsites.store where the people who hire us can track their projects, read their invoices, and message us directly.

This policy covers the marketing site, the intake form, and the client portal. It is written in the first person plural: "we" is Orbit Sites, and "you" is either a visitor to the site or a client with a portal account.

02What we collect

We collect only what a specific feature needs to work. Nothing on this site profiles you, builds an advertising audience, or follows you to other sites.

• Project enquiries — When you submit the intake form we store your name, email address, company (if given), project type, budget range, timeline, description, and the URL of your current site. We also record the IP address the submission came from, which is used to rate-limit the form against automated abuse.
• Account details — If you create a portal account we store your name, email address, and a hash of your password. We store the hash, not the password — it is produced with Argon2id and cannot be reversed into the original. If you sign in with Google or GitHub instead, we receive your name and email address from that provider and store no password at all.
• Engagement records — The projects, invoices, and retainer services attached to your account: names, phases, amounts, dates, and status.
• Messages and attachments — Conversations you have with us through the portal, including any files you attach. Message bodies and attachment filenames are encrypted before they are written to the database.
• Security and operations records — Timestamps for your last sign-in and last password change; an activity log of changes our staff make to your records; and, for actions inside the messaging system, the IP address and browser user-agent of the person who took them. These exist so an account compromise can be reconstructed rather than guessed at.

03Cookies and tracking

We set one cookie: the session cookie that keeps you signed in. It is signed, restricted to this site, and holds your account identifier rather than your details. Signing out clears it.

There is no analytics package, no advertising pixel, no session recorder, and no third-party script of any kind on this site. That is why you are not being asked to accept cookies — there is nothing to opt out of. Some parts of the portal remember small preferences, such as whether you collapsed the sidebar, in your own browser's local storage; that never leaves your device.

04Why we are allowed to hold it

Under the GDPR the lawful bases we rely on are: performance of a contract, for everything needed to deliver work you have engaged us for and to bill you for it; legitimate interests, for security records, abuse prevention, and answering enquiries sent to us; and consent, where you have given it — for example by submitting the intake form.

We do not rely on consent for anything you cannot withdraw without losing the service, and we do not treat continued use of the site as consent to anything.

05Who else sees it

We do not sell personal data, and we do not share it for anyone else's marketing. It reaches other companies only where they run part of the service on our behalf, under contract, and only to the extent that part requires.

• Vercel — Application hosting. Handles the requests that reach the site.
• Turso — Managed database hosting. Holds the records described above.
• Cloudflare R2 — Object storage for message attachments and project deliverables. The bucket is private; files are served through short-lived links that expire in minutes.
• Resend — Email delivery. Sees the address a message is going to and its contents — verification links, password resets, and notifications.
• Google and GitHub — Only if you choose to sign in with one of them, and only for that sign-in.

06How it is protected

Passwords are hashed with Argon2id. Message bodies and attachment filenames are encrypted with AES-256-GCM before storage, so the database rows are unreadable without a key held separately from it. Attachment downloads are authorized by the application and then handed to storage through a link that expires in five minutes and cannot be edited to fetch a different file.

The site sets a strict Content-Security-Policy, HSTS, and frame-denial headers on every response. Uploads are checked against their declared type by inspecting the actual bytes, and scanned before they are stored. Staff access is governed by a role hierarchy in which every action is re-checked on the server against the live account record, not against the sign-in token.

No system is perfectly secure, and we will not pretend otherwise. If we discover a breach affecting your personal data we will notify you and the relevant supervisory authority as the law requires.

07How long we keep it

• Enquiries that do not become projects — Kept for up to 24 months so we can pick up a conversation you return to, then deleted.
• Client records — Kept for the life of the engagement and for seven years afterwards, which is what tax and accounting rules require of invoices and contracts.
• Messages and attachments — Kept for the life of the account. Deleting a message removes it from view immediately; it is purged from storage within 30 days.
• Security logs — Kept for 12 months.
• Closed accounts — Deleted within 30 days of closure, except records we are required to retain for the periods above.

08Your rights

Wherever you live, you can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, or object to a particular use of it. If you are in the EU, UK, or California, those rights are statutory and we answer within 30 days.

Email hello@orbitsites.store, or open a thread from the portal if you have an account. We will ask you to confirm you control the email address on the account, and nothing more — we will not demand identity documents to honour a request about an email address you can prove you own.

You also have the right to complain to your data protection authority. We would rather you told us first, but that right does not depend on it.

09Children

This is a business service and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us information, email us and we will delete it.

10International transfers

Our infrastructure providers operate globally, so your data may be processed outside your own country, including in the United States. Where data leaves the EEA or the UK, transfers rely on the European Commission's Standard Contractual Clauses or an equivalent approved mechanism in our contracts with those providers.

11Changes to this policy

If we change this document we update the effective date at the top. If a change materially affects how we handle data we already hold, we will email account holders before it takes effect rather than relying on you to notice.