Privacy

The short version

We collect the least we can run the service on. We do not sell data, we run no advertising trackers, and we never see your card number or your payout wallet's private key.

Orbylon is operated by an individual based in Quebec, Canada. There is no registered company. Postal mail reaches us at 555 Rue Chabanel O, Suite 1541, Montreal, QC H2N 2J2, Canada.

What we collect

Four things, and this is the whole list.

• ·A scan: the address you typed and the public data our scanner read from it. If you scanned from the public box on the site, the report is public and lives at its own address.
• ·An account: your email, the domain you proved, and the wallet address you choose to publish. You give us an email because a magic link is how you sign in; there is no password to store and so none to lose.
• ·Billing: the fact that you subscribed, your Stripe customer id and your plan. Your card number goes from your browser to Stripe and never touches our servers or our database.
• ·Product analytics: which pages loaded and which steps of the funnel happened, through PostHog. Rough country-level location from the request, nothing finer.

What we never collect

• ·Card numbers. Stripe holds those. We hold an identifier that points at a customer record in Stripe.
• ·The private key to your payout wallet. We could not spend your money if we wanted to, which is the design.
• ·Anything behind a login on your own site. The scanner reads what an anonymous visitor reads and stops there.
• ·Advertising identifiers, third-party ad pixels, or anything sold to a data broker. We have none and we will not add one.

Why we are allowed to process it

Under the GDPR the bases are: performing the contract you signed up for, our legitimate interest in the product working and improving, and your consent where you gave it, such as joining a waitlist.

Under Quebec Law 25 and Canada's PIPEDA the same processing rests on your consent and on the necessity of running a service you asked for.

Where it lives and who else touches it

Four processors, each doing one job. We keep no other copies.

• ·Supabase, hosting the database and the sign-in system.
• ·Vercel, hosting the website and its short-lived request logs.
• ·Stripe, taking payments and holding the card details we never see.
• ·Resend, sending the email we send you.

The blockchain part, stated plainly

When a document is anchored publicly, what is published is a hash: a fixed-length fingerprint of the file. It is not the file and it cannot be turned back into the file. We never publish personal data to a public chain, because a public chain cannot forget and a deletion right cannot be honoured on one.

How long we keep it

An account and its identity, for as long as the account exists. A public scan report, until somebody who controls the domain asks for it to be removed. Analytics, for PostHog's retention window on our plan. Request logs, for the hour Vercel keeps them on our plan.

Your rights, and the one address that exercises them

Write to contact@orbylon.com and ask. You can ask for a copy of what we hold about you, a correction, a deletion, or a portable export, and we will do it. If you are in the EU, the UK or Quebec you have these rights by law; we give them to everybody because running two standards is how the weaker one becomes the real one.

A public report about a domain you control is removed on proof of that control. Proving control is a thing this product happens to be very good at.

The person responsible for the protection of personal information at Orbylon can be reached at the same address, marked for the attention of the Privacy Officer. That is the role required by Quebec Law 25.

Cookies

A sign-in cookie, which exists so that being signed in survives loading the next page. Analytics run without an advertising cookie. There is no consent banner because there is nothing to consent to beyond the cookie that makes your session work.

Children

This is a product for businesses. It is not directed at children and we do not knowingly collect anything from one.

Changes

If this page changes in a way that matters, the date at the top changes and we write to account holders. We do not quietly widen what we collect.