Privacy policy
Last updated September 27, 2026
What this policy covers
This policy describes how we handle personal data collected through the public website at orbitify.ai. It does not describe how the Orbitify platform processes a customer's operational data — imagery, telemetry, records and decision traces. That processing is governed by the agreement and data processing addendum you sign, and is summarised on the Trust page.
Who is responsible
Orbitify is the controller for personal data collected on this website. You can write to us at info@orbitify.ai. We do not currently appoint a separate data protection officer; that address reaches the people who would answer a rights request.
What we collect
We collect only what the site needs to operate and what you choose to send us. We do not buy lists, and we do not run advertising pixels on this site today.
The contact form
If you submit an enquiry we collect the fields you enter:
- Name and work email, which we need in order to reply.
- Company, phone and the message, which you can leave blank except for the message itself.
- How the visit reached us: the first page you opened, the referring site and any campaign tags in the link (utm_*, gclid, fbclid). These are held only in this tab's session storage until you submit. If you have switched Analytics on, the analytics identifier is sent as well, so the enquiry can be joined to the visit.
- A hidden field used only as a bot trap. A person never sees it and we do not store it as a real answer.
What arrives with a visit
Like any hosted site, a request leaves a trace on the server. That typically includes IP address, user agent, the page requested, referrer and a timestamp. We use this to operate, debug and secure the site, not to build a profile of you.
If you switch Analytics on under Consent preferences, the site loads PostHog, which records the pages you view with a pseudonymous identifier. Autocapture and session recording are off. Nothing is loaded if Analytics is off, which is the default.
If you switch language, a locale cookie is set so the next visit can open in the language you picked. That cookie is described in the cookie policy.
Why we use it
We use website personal data to reply to enquiries, to keep the site up and safe, to remember a language preference, and to understand in aggregate whether the site is working. We do not use it to train models, and we do not sell it.
Legal bases
Where European data protection law applies, we rely on: taking steps at your request before a contract (an enquiry about the product); legitimate interests in operating and securing a public website; and, for optional analytics or marketing if you switch them on, consent. Where Vietnam's Law on Personal Data Protection (Law 91/2025/QH15) and Decree 356/2025/ND-CP apply, we process on the corresponding lawful grounds — your consent, or the performance of steps you have asked for — and honour the rights that law gives you.
You do not have to send us an enquiry. If you do not, we still process the minimum needed to serve the page you asked for.
How long we keep it
Contact enquiries are kept for as long as we need them to reply and for a reasonable follow-up, then deleted or reduced to a record that no longer identifies you. Server logs are kept for a short operational window. Locale and consent choices live in your browser until you clear them.
We do not publish a number of days here that a security questionnaire would then treat as a contractual retention period. If you need a specific period, ask and we will put it in writing.
International transfers
Orbitify works across Southeast Asia and beyond. The processors named above handle data outside Vietnam: in Singapore (Amazon Web Services) and in the United States (Google, PostHog). Where a transfer needs a safeguard (for example under GDPR), we use the mechanism the processor offers — typically their standard contractual clauses — rather than inventing a route of our own.
Under Vietnamese law, sending personal data of people in Vietnam to servers abroad is a cross-border transfer. Preparing and filing the processing impact assessment and the cross-border transfer impact assessment that Law 91/2025/QH15 and Decree 356/2025/ND-CP require is in progress.
Your rights
Subject to the law that applies to you, you can ask us to access, correct, delete or restrict the personal data we hold from this website, to object to our using it, or to receive a copy of what you sent us. You can also withdraw consent for optional categories on the Consent preferences page; that does not affect anything already done on the previous choice.
To exercise a right, email info@orbitify.ai. We will need enough to find you in our records and may ask you to confirm who you are. You can also complain to your local supervisory authority — in Vietnam, the Ministry of Public Security (Department of Cybersecurity and High-Tech Crime Prevention). We would rather fix it with you first.
Platform customer data
If you are a customer, your operational data is yours. We process it to run the service you bought. It is not used to train models offered to anyone else. Export, deletion and residency are described on the Trust page and stated in your agreement. This privacy policy does not replace that agreement.
Children
This site is for people acting in a professional capacity. We do not knowingly collect personal data from children. If you believe we have, write to us and we will delete it.
Changes
We will update this policy when the site's processing changes — for example when we add a processor or a new optional tag. The date at the top is when the published version took effect. Material changes will be reflected here before any new optional tag is switched on.
Contact
Privacy questions and rights requests: info@orbitify.ai.