Privacy Policy

We collect only what we need to run your account and your services:

• Account details: your email address, and the name and profile picture you set on your GalaxyOrb account. You sign in with a passkey; we never receive your fingerprint, face or device PIN.
• Billing details: the company name and address you give us, your orders, invoices, payments, refunds and account credit.
• Card details, held by Stripe: Stripe stores your card. We keep only Stripe's reference to it, plus the card brand, last four digits and expiry date so you can recognise it.
• Service details: the services you order, their settings, and technical data such as server names and IP addresses.
• Support messages: what you write to us in tickets.
• Security records: a log of important actions on your account (such as orders, payments, cancellations and staff access), and the IP address you signed in from. Our web servers also keep standard access logs (IP address, browser, page and time) for a limited time.
• Error reports: when something breaks, on our servers or on a page in your browser, we record the error, the page, your browser type and, if you are signed in, your account ID, so we can fix it. They don't include your IP address, passwords or card details, and are deleted 90 days after the error last happened.

We don't use analytics, advertising or tracking tools, and we don't build profiles of you. We don't collect phone numbers or send marketing text messages.

• To set up, run and support the services you order (needed for our contract with you).
• To bill you, take payments, renew services and issue refunds (contract, and our legal duty to keep financial records).
• To send messages about your account and services, such as invoices, renewal reminders and security notices. We don't send marketing email.
• To keep the platform secure, prevent fraud and abuse, and investigate problems (our legitimate interest in a safe service).
• To meet legal obligations and answer valid requests from authorities.

We do not sell or share your personal information for advertising. We pass data only to service providers that help us run GalaxyOrb, and only what each needs:

• Stripe, to process card payments and refunds. Stripe handles your card under its own privacy policy.
• Data centre and cloud infrastructure providers in the United States, which host our platform and your servers.
• An email delivery provider, to send account and service emails.

We may also disclose data when the law requires it, to protect people or our services from harm, or as part of a merger or sale of our business (in which case this policy continues to apply to it).

Our staff can see your account to help you. When staff view your client area as you, access is read-only, time-limited and recorded.

Files, databases and other content you store on your hosting or servers belong to you. We process them only to provide the service, and we don't look at them except when needed for support you ask for, for security, or to investigate abuse. You decide what personal data your own websites and apps collect, and you are responsible for that.

Our platform and servers are in the United States. If you use our services from elsewhere, your data is transferred to and processed in the United States.

• Account, service and support data: while your account is open. When you ask us to close it, we delete or anonymise it, except what we must keep.
• Invoices and payment records: as long as tax and accounting laws require, usually seven years, even after the account is closed.
• A service's content, snapshots and backups: deleted when the service ends.

Sign-in uses passkeys only, so there are no passwords to steal. Your session is kept in an encrypted cookie that scripts in the browser can't read. Secrets such as server root passwords are stored encrypted. All traffic to our site is encrypted with HTTPS. No system is perfectly secure, but we work to protect your data and will tell you without undue delay if a breach affects it.

Depending on where you live (for example, under the GDPR in Europe and the UK, or US state laws such as California's), you can ask us to: access a copy of your data; correct it; delete it; restrict or object to how we use it; and receive it in a portable format. You can also withdraw any consent you gave.

Email support@galaxyorb.cloud from your account's address, or open a ticket. We answer within 30 days and won't treat you differently for using your rights. You may also complain to your local data protection authority.

We use only the cookies needed to sign you in and keep your cart. No tracking cookies. See the Cookie Policy for the full list.

Our services are for adults. We don't knowingly collect data from anyone under 18. If you think a child has given us data, contact us and we will delete it.

We will post any change here with a new date at the top. For important changes we will also tell you in your client area or by email before they apply.

GalaxyOrb LLC is responsible for your data. Privacy questions and requests: support@galaxyorb.cloud.