Privacy Policy

1. Purpose of the Application & Scope

Orbis-01 operates as a multi-role e-commerce ecosystem providing:

• For Vendors & Merchants: Automated digital storefront creation, custom subdomain hosting, inventory cataloging, sales analytics, customer inquiry management, and automated payout routing.
• For Sales Agents: Tracking of vendor referral codes, commission accruals, and direct payout disbursements.
• For Shoppers & Customers: Storefront browsing, cart management, order placement, and inquiry communication.
• For Google Sign-In: Instant single sign-on access to user accounts without creating or storing a separate password.

2. Information We Collect

3. How We Use Your Information

• Account Creation & Session Management: To verify your identity, maintain authenticated user sessions, and allow access to your private vendor/agent workspace.
• Storefront Operations: To host your branded subdomain, present your catalog to shoppers, process orders, and facilitate customer communications.
• Financial Disbursements: To calculate commission balances and settle vendor payouts via payment processing partners (Paystack and Flutterwave).
• Transactional Communications: To send email verification codes, password resets, order notifications, and ticket updates via our transactional email infrastructure (Brevo).
• Security & Anti-Fraud: To prevent unauthorized account access, inspect fraudulent transactions, and uphold platform security.
• Service Improvement: To understand how features are used in aggregate so we can fix problems and improve the Platform.

We do not use your personal information, or any data received from Google, for advertising, and we do not sell it.

4. Third-Party Data Sharing & Protection Standard

User data, including all information obtained via Google Sign-In, is NEVER sold, rented, leased, or shared with third parties for marketing, advertising, or data brokering purposes.

We share personal information solely with essential service infrastructure providers required to deliver platform functionality, each bound to protect it:

• Supabase: Encrypted database hosting, user session authentication and token validation infrastructure.
• Paystack & Flutterwave: PCI-compliant payment card processing and vendor subaccount disbursements.
• Brevo: Transactional email delivery for one-time passcodes and store notifications.
• Cloudflare: Secure global content distribution, SSL encryption, and Web Application Firewall security.

When you place an order on a vendor's storefront, the vendor receives the order and delivery details needed to fulfil it. We may also disclose information when required by law, to protect the rights and safety of our users, or as part of a merger or acquisition, in which case this policy will continue to apply to your data.

5. Google API Services User Data Policy & Limited Use Compliance

Orbis-01's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• We only use Google user data to sign you in and to display your name, email and profile picture inside your Orbis-01 account.
• We do not transfer Google user data to third parties except as necessary to provide or improve app functionality, to comply with the law, or as part of a merger or acquisition.
• We do not use Google user data for serving advertisements, personalized marketing, or retargeting, and we do not use it to train AI or machine-learning models.
• Human interaction with user data obtained via Google APIs is restricted strictly to security investigations, user support requests you initiate, or as mandated by law.

6. Cookies & Local Storage

Orbis-01 uses your browser's local storage and session storage to keep you signed in, remember your shopping cart, and save interface preferences. Our infrastructure provider Cloudflare may set strictly necessary security cookies to protect the site from abuse. We do not use third-party advertising or tracking cookies.

7. Data Security & Storage

All data is transmitted over encrypted HTTPS connections. Passwords are stored only as salted hashes, access tokens expire automatically, and access to production data is restricted to authorized personnel. Our service providers may store and process data in countries other than your own; where they do, we rely on their contractual and technical safeguards to protect it. No method of transmission or storage is completely secure, but we work to protect your information and will notify affected users of any breach as required by law.

8. Data Retention & Account / Data Deletion Requests

We retain account data only for as long as your account remains active or as required by applicable tax, commercial, and financial record-keeping laws. When you delete your account, we delete or anonymize your personal information, except order and payout records we are legally required to keep.

9. Your Rights

Depending on where you live (including under the Nigeria Data Protection Act, the GDPR, and similar laws), you may have the right to access, correct, export, or delete your personal information, to object to or restrict certain processing, and to withdraw consent at any time. You can update most profile information directly in your account settings; for anything else, contact us at the address below and we will respond within 30 days.

10. Children's Privacy

Orbis-01 is not directed at children under 13 (or the minimum age of digital consent in your country), and we do not knowingly collect their personal information. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will change the "Last Updated" date above, and for significant changes we will notify you by email or with a notice in the app before the change takes effect.