Version 2026-10-29

Privacy Policy

This explains what information we keep in your Orbit Account, why and for how long, who we share it with and how you can use your rights. In short: we keep what your account needs, we don't sell it and we don't use it for advertising.

1. Data controller

Orbit Helm (a company being incorporated in England and Wales; its registration details will be added to this text once it is incorporated). For anything to do with privacy: privacy@orbithelm.com. If you live in Türkiye, the KVKK Privacy Notice also applies.

2. Information we collect

Account information: your email address, your display name if you choose to add one, your language and country preference, and your account's status.
Sign-in information: the public keys of your passkeys and which password manager they are stored in, the link to your authenticator app and irreversible hashes of your recovery codes. Your face or fingerprint data never leaves your device; we cannot see it.
Session and security records: sign-in times, IP address, browser and device information (user agent), approximate location derived from the IP address (city level) and important changes to your account (such as adding a passkey, two-step verification or signing out).
Consent records: which version of which text you accepted or withdrew, and when.
App usage: which Orbit Helm apps you have signed in to with this account and when you last signed in.
Support records: actions the support team has taken on your account (for example, suspension) and the reason.

Orbit Account does not ask for information such as a password, an identity number, payment details or your contacts.

3. Why we use it and the legal basis

Opening your account, signing you in and connecting it to apps: performance of the contract (Terms of Use).
Protecting your account: new device and suspicious sign-in alerts, and preventing misuse and automated attacks: legitimate interest. This is necessary to keep your account safe.
Security emails and essential service notices: performance of the contract and legitimate interest.
Keeping consent records and support records: legal obligation and the protection of rights.
Promotional and announcement messages: only if you have given your explicit consent (Consent to Commercial Messages). You can withdraw your consent at any time.

We do not make automated decisions with your data that produce a legal effect on you; we do not build profiles to show you ads.

4. Who we share it with

We do not sell your information. We share it only with those needed to run the service, and only as much as needed:

The Orbit Helm apps you use: when you sign in to an app with this account, that app receives your account ID, email address and display name; it is notified if your account is suspended or deleted.
Our service providers (processors working on our behalf and on our instructions):
- Supabase: database and sign-in infrastructure; data is kept on servers in London (United Kingdom).
- Cloudflare: serving the site, attack protection and the bot check (Turnstile) also used in our apps. For the data Turnstile processes, see the Cloudflare Turnstile Privacy Addendum.
- Google Maps Platform: maps, address search, route and traffic times, weather and navigation in the Hopy driver app. While drivers use navigation, Google collects navigation data such as location and the route travelled to improve Google Maps for everyone; this data is not associated with your Google account or your device. For details, see the Google Privacy Policy and the Google Maps Platform Terms of Service.
- Resend: sending sign-in codes and security emails (EU, Ireland).
- IPinfo: finding an approximate location from an IP address (only the IP address is sent).
Public authorities: only when we are legally required to, and only to the extent necessary.

5. International transfers

Data is processed mainly in the United Kingdom and the European Union. Some of our service providers may also process it in the United States. For these transfers we use the safeguards provided for by applicable law, such as standard contracts. For transfers from Türkiye, see the KVKK Privacy Notice.

6. How long we keep it

Account and sign-in information: for as long as your account is open.
Security history and recognised devices: up to 1 year; then deleted automatically.
IP location information, records of emails sent and notifications sent to apps: 90 days.
If you close your account: after a 30-day period in which you can change your mind, your account and sign-in information is deleted; the apps you use delete their own data too. Consent records are kept, as proof of what you accepted and when, in a form that cannot be linked to your account.

7. What we store in your browser

We use your browser's local storage to keep you signed in and to remember which account you last signed in with on this device. We do not use advertising or tracking cookies. Cloudflare may use its own technical cookies for the bot check and attack protection.

8. Your rights

Depending on the law of the country you are in (UK GDPR, EU GDPR, KVKK), you have the following rights:

To access the data about you and get a copy: you can get it straight away with "Download as JSON" on the Privacy and data page.
To have incorrect information corrected, have your data deleted (by closing your account), restrict processing or object to it.
To withdraw consent you have given; withdrawing does not affect processing carried out before that.
To make a complaint: in the United Kingdom, to the Information Commissioner's Office (ico.org.uk); in Türkiye, to the Personal Data Protection Board; in the EU, to the data protection authority of the country you live in.

For requests you cannot make from your account, write to privacy@orbithelm.com from your account's email address. We will reply within 30 days at the latest after verifying your identity.

9. Security

We don't use passwords; you sign in with a passkey or a one-time email code. Connections are encrypted, recovery codes are stored only as hashes, important changes to your account are notified to you by email and the support team's actions are recorded. Our team can access data only with company email addresses and only as far as their work requires.

10. Children

Orbit Account is not for children under 13. If we notice such an account, we will close it.

11. Changes

We may update this policy. If there is an important change, we will ask you to accept the new version the next time you sign in to your account. The date of each version is shown at the top of the page.

Translated from the Turkish text.