Privacy Policy

1. Who we are and what this covers

Orbit Connect is operated by us ("we", "us"). This policy explains what personal data we handle and why. We aim to follow India's Digital Personal Data Protection Act, 2023 and the rules made under it.

We handle personal data in two different roles:

Website and account data. If you visit this website, create an account, contact us or subscribe, we decide why and how your data is used. We are responsible for it.
Your customers' data in the app. The Orbit Connect app for Shopify processes information about a store's customers so the store can issue invoices. The store owner decides why that data is used and is responsible for it. We process it on the store owner's instructions, under the data-processing terms accepted in the app.

If you are a customer of a store that uses Orbit Connect, section 9 explains how to exercise your rights.

2. What this website collects

Exactly this, and nothing else:

Account: Your email address, your name and company name (if you give them), a password hash (never the password itself), whether your email is verified, and the dates you signed up, last signed in and last changed your password.
Sign-in sessions: For each signed-in browser: a hash of its session token, the IP address and browser details (user agent) it was created from, and when it was last used.
Billing profile: If you add one: legal name, an optional GSTIN, address, state, PIN code and country. The GSTIN is checked for format only.
Subscriptions: The plan you chose, its status, your Shopify store address, the price shown at the time, trial and cancellation dates, and a reference from the payment provider once one exists. We do not collect card details on this site.
Contact messages: The name, email, topic and message you send, the browser details, and a keyed hash of your IP address (not the address itself).
Security records: A log of account events such as sign-ins, failed sign-ins, password changes and account deletion, each with the IP address and browser details.
Rate limiting: Short-lived counters keyed by IP address, or by a keyed hash of an email address, that stop repeated sign-in, sign-up, password-reset and contact attempts.
Server logs: Our web server records the IP address, time, page requested, response status and browser details for each request.
Emails we send: Transactional messages only, such as email verification and password reset.

The site sets three strictly necessary cookies (see the cookie notice). It has no analytics, advertising or tracking, and loads no third-party scripts, fonts or images.

3. What the Orbit Connect app processes

When a store installs the app, the app connects to that store through Shopify with the permissions listed on the security page. It processes:

Store connection: The store's Shopify address, the access token Shopify issues, the permissions granted and, where Shopify provides them, the name, email and locale of the staff user who signed in.
Business settings: Legal name, GSTIN, PAN, address, invoice prefix and numbering, tax settings, retention setting, terms text, GST registrations by location, GST rates by collection, invoice template branding, and any bank account details the merchant chooses to print on invoices.
Orders and documents: Order, refund and shipment identifiers, dates, amounts, products, taxes and payment mode; and the customer's or supplier's name, GSTIN, billing and shipping address, email address and phone number where needed for a document.
Customer GST details: A Shopify customer identifier, company name and GSTIN, so repeat business buyers can be filled in automatically.
Delivery and consent: Who a document was sent to, on which channel, with what result, and each customer's consent or opt-out, kept as a keyed hash with a masked hint, the source and the purpose.
Integrations the merchant connects: Connection details for email (SMTP), WhatsApp (account and phone-number IDs), a GSP, Zoho Books and Odoo, with the secrets kept encrypted; e-invoice requests and results (including IRN and acknowledgement details); records of what was synced; and API keys, kept only as hashes.
Operational records: Webhook and background-job records, download-link records, privacy-request records, retention-run records and an audit trail of actions taken.

The data comes from Shopify, from the merchant's own settings and from the third-party services the merchant connects. We do not sell it, use it for advertising, or use it for automated decisions with legal or similarly significant effects.

4. Why we use data

To provide the Service you asked for: run your account, create documents, deliver them and keep your subscription.
To keep the Service secure: prevent abuse, spot and investigate problems, and keep audit trails.
To answer your messages and support requests.
To meet our legal obligations, for example handling Shopify's privacy requests.
With your consent, where the law needs it. You can withdraw consent at any time by contacting us.

We do not sell personal data. We use these service providers, and only for the purpose shown:

Service providers and why we use them
Provider	Why
Shopify	The commerce platform the app runs on. It is the source of order and customer data and handles the app's sign-in.
Amazon Web Services	Hosts this website and the app, including the servers and storage that hold the data described above.
Email provider for this site	Sends verification and password-reset emails once an SMTP provider is configured. It will be named here when it is.
Payment provider	No provider is connected yet. When paid plans open, the provider (Shopify Billing or a payment gateway) will be named here and at checkout.

A store owner can also connect services of their own choosing: their email provider, a WhatsApp Business account (Meta), a GSP, Zoho Books or an Odoo instance. Data sent to them goes there because the store owner asked for it, and those providers' own terms and privacy policies apply. We are not their processor.

We may disclose data where the law requires it, for example to answer a valid order from a court or authority.

6. Where data is stored

Our servers are hosted with Amazon Web Services in the United States (US East, N. Virginia), so personal data is processed outside India. Data sent through Shopify, Meta, your email provider and other services you connect is handled where those services operate.

7. How long we keep it

This website

How long website data is kept
Data	Kept for
Account, billing profile and subscription details	While your account exists. When you delete your account from the account page, the account, its sessions, billing profile and subscriptions are deleted.
Sign-in sessions	Until they expire or you end them: 2 hours idle or 12 hours in total, or 14 days idle or 30 days in total if you chose "Keep me signed in".
Password-reset and verification links	Single use. They expire within 24 hours, and expired records are deleted a day later.
Rate-limiting counters	Removed in periodic clean-ups after about a day.
Contact messages	While we deal with your message and for a reasonable time afterwards. You can ask us to delete yours.
Security records	They are kept as a trail and can outlive your account. Ask us if you want yours removed.
Server logs	For a limited period, then rotated out.
Backups	Daily backups are kept for 14 days, so deleted data can remain in a backup for up to that long.

The Orbit Connect app

The store owner chooses how long documents are kept. Other records have fixed periods:

How long the app keeps each kind of data
Data	Kept for
Invoices, credit notes and other documents	For the retention period you set in the app: 2,555 days (seven years) by default, adjustable from 30 to 2,920 days. When it ends, the customer's name, contact details, GSTIN, billing address and the order references on the document are removed.
Delivery records and download-link records for those documents	Removed when the document is redacted. Download-link records are also removed 30 days after the link expires.
Webhook and background-job records	Their payloads are cleared once processed, and the records are deleted after 30 days.
Privacy-request records	Deleted 30 days after the request is completed.
Audit events	Deleted after 365 days.
Delivery consent and opt-out records	Deleted 2,555 days (seven years) after their last update.
Shopify access tokens and sessions	Deleted when the app is uninstalled.
Documents, settings, GST registrations, saved integration credentials and the audit trail for a store	Deleted when Shopify sends its shop-erasure request after uninstall.

Tax law may require a business to keep invoices for a set period. The store owner is responsible for choosing a retention period that meets their own obligations.

8. Security

Sensitive fields in the app are encrypted with AES-256-GCM, downloads use expiring links, actions are logged, and this site protects passwords with Argon2id. The security page explains what is protected, what is not field-encrypted, and where the limits are.

9. Your rights

Under India's Digital Personal Data Protection Act, 2023 you can ask us to:

tell you what personal data of yours we process, and give you a summary of it;
correct inaccurate or incomplete data, and update it;
erase your data, unless we must keep it by law;
take up a grievance with us (see section 10); and
nominate another person to exercise these rights for you if you cannot.

You can also withdraw consent you have given, as easily as you gave it.

If you have an account here, you can change your details and delete your account from the account page, or contact us.

If you bought from a store that uses Orbit Connect, please contact that store first: it decides how your data is used. Shopify passes customer data requests and erasure requests to the app, and the app processes them. You can also contact us and we will pass your request on to the store.

To make a request, use the contact form and choose the topic "Privacy or a data request". We may need to check who you are before we act. We will reply as quickly as we can, and within the time the law allows.

10. Grievances

To complain about how your personal data is handled, use the contact form and choose the topic "Privacy or a data request". Your message goes to the person who handles data protection complaints.

If we do not resolve your complaint, you may complain to the Data Protection Board of India where the law provides for it.

11. Children

The Service is for businesses and is not aimed at children. We do not knowingly collect personal data from anyone under 18 for our own purposes. If you think a child has given us their data, tell us and we will delete it. Store owners are responsible for the data of their own customers.

12. If something goes wrong

If a security incident affects your personal data, we will tell you and any store affected, and notify the authorities where the law requires it. Our security page explains how to report a vulnerability.

13. Cookies

This site sets only strictly necessary cookies. They are listed in the cookie notice.

14. Changes to this policy

We will update this policy when what we do with data changes. The date at the top shows the latest change. If a change materially affects you, we will tell you before it applies.

15. Contact

Use the contact form.