01 What we collect
We collect only what is needed to sell you a service, deliver it, and meet our legal obligations.
You give us directly
- Identity and contact: name, email address, phone number.
- Billing: billing address, city, state, pincode, and GSTIN if you supply one.
- Business context: organisation name and any project notes you write at checkout or send us by email.
- Account credentials: a password, stored only as a one-way hash — we cannot read it.
- Delivery access: where a service requires it, access you grant to your own platforms (for example an ads account or a website admin). We ask for the minimum permission level that lets us do the work.
Collected automatically
- Standard server logs: IP address, browser and device type, pages requested, timestamps.
- Analytics events, if analytics is enabled on the site (see Cookies & analytics).
- A session cookie that keeps you signed in, and browser local storage that holds your cart before checkout.
We do not collect card numbers, UPI PINs, bank credentials, government ID numbers, or any special category data. If you send such information to us unprompted, we delete it.
02 How we use it
- To process your order, take payment and issue a GST invoice.
- To contact you at kickoff, deliver the service and hand over the output.
- To provide support and answer enquiries you send us.
- To maintain your account and show your order history.
- To meet tax, accounting and other statutory obligations.
- To detect and prevent fraudulent or abusive use of the site.
We do not sell personal data. We do not share it with advertisers. We do not send marketing email unless you explicitly opted in, and every marketing message carries a one-click unsubscribe.
03 Legal basis & consent
We process your data on these bases, consistent with the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and rules made under it:
- Performance of a contract — everything needed to sell and deliver the service you bought.
- Legal obligation — invoicing, GST records and statutory retention.
- Consent — optional items such as marketing email or non-essential analytics. Consent can be withdrawn at any time without affecting services already delivered.
- Legitimate interest — security, fraud prevention and keeping the site working.
04 Who we share it with
Only with processors who need it to deliver something you asked for:
- Payment gateway (MMADPay) — to take and verify your payment.
- Hosting provider — the servers this site and its database run on.
- Email provider — to send order confirmations, invoices and replies.
- Analytics provider — only if analytics is enabled, and only in aggregated, pseudonymised form.
- Authorities — where we are legally compelled to disclose, and only to the extent compelled.
Each processor is bound to use the data only for the purpose we engaged them for. We do not transfer personal data outside India except where a processor's infrastructure requires it, and then only with appropriate safeguards.
05 Payment data
Payments are handled entirely by the gateway. Card numbers, UPI IDs, PINs and OTPs are never transmitted to or stored on our servers, in line with RBI tokenisation guidance. What we retain is limited to the order reference, the gateway transaction identifier, the amount, the status and the bank reference number — enough to reconcile a payment or process a refund, and nothing more.
06 Cookies & analytics
- Strictly necessary — a session cookie that keeps you signed in and protects forms against cross-site request forgery. The site cannot work without these.
- Local storage — your cart is held in your own browser until checkout. It never leaves your device until you place the order.
- Analytics — where enabled, Google Analytics 4 records aggregated usage. You can block it with browser settings or an extension without losing any site functionality.
We do not run advertising or cross-site tracking cookies.
07 How long we keep it
| Data | Retention |
|---|
| Account profile | Until you ask us to close the account |
| Orders, invoices and tax records | 8 years, as required by Indian tax law |
| Support and enquiry correspondence | 24 months from the last message |
| Server logs | 90 days |
| Project files and deliverables | 12 months after handover, then deleted from our systems |
08 Your rights
You may ask us to:
- Access a copy of the personal data we hold about you.
- Correct anything inaccurate or incomplete — most of it you can edit yourself in your profile.
- Erase your data and close your account, subject to records we must retain by law.
- Withdraw consent for anything processed on that basis.
- Nominate another person to exercise these rights on your behalf if you are unable to.
- Complain to us first, and to the relevant data protection authority if we do not resolve it.
Write to info@orbivextech.com and we will respond within 30 days. We may ask you to confirm your identity before acting on a request.
09 Security
The site is served over HTTPS. Passwords are stored as salted one-way hashes. Database access is restricted to the application, and administrative access is limited to named individuals who need it. We keep access to your platforms at the minimum level required and hand it back or ask you to revoke it at handover.
No system is perfectly secure. If a breach affects your personal data we will notify you and the relevant authority as required, with what happened, what data was involved and what to do about it.
10 Children
Our services are sold to businesses and to adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us data, contact us and we will delete it.
11 Changes to this policy
We update this policy when our practices or the law change. The revision date at the top always reflects the current version. Material changes affecting how we use existing data are notified by email to registered account holders before they take effect.