Legal

Privacy policy

Last updated: 2 November 2026

ORBYT respects your privacy and follows the General Data Protection Regulation (GDPR, in Dutch: AVG). This page explains which personal data we use, why, and what your rights are.

Who is responsible

ORBYT, run by Prince Jangra, is responsible for your data. Questions? Email [email protected].

What we collect and why

• When you email us: your name, email address and your message, to answer you.
• When you join the waitlist: your email address, to tell you when a drop goes live. You can unsubscribe at any time.
• When you make an account: your email address, your password (stored scrambled, we can never read it) and your first name if you give it, so you can log in and see your orders. If you log in with Google, Google shares your name, email address and profile picture with us; we never see your Google password.
• When you order: your name, address, email, phone number (optional), what you bought and your payment status, to deliver your order, handle returns and keep our records. Payments are handled by our payment provider; we never see your card or bank details.

We do not sell your data and we do not use it for anything else without asking you first.

How long we keep it

• Emails and waitlist: until you ask us to delete them, and at most 2 years after our last contact.
• Your account: until you ask us to delete it, or 2 years after you last logged in.
• Orders and invoices: 7 years, because Dutch tax law requires us to keep them.

Who else gets your data

Only the companies we need to run the shop, and only what they need:

• our website host, which shows you this website;
• our email provider (Google), for email;
• Supabase, which stores accounts and log-ins for us on servers in the EU (Ireland);
• Brevo, which keeps our waitlist and sends drop emails;
• the payment provider and the delivery company, when you order.

This website loads fonts from Google Fonts and a 3D viewer from unpkg.com, so your browser connects to those services and they can see your IP address. Some of these companies may process data outside the EU under the safeguards the GDPR requires.

Cookies

We do not use tracking or advertising cookies, and no analytics. The website only keeps two things in your own browser: what is in your bag, and, when you log in, a log-in key so you stay logged in (removed when you log out).

Your rights

You may see, correct or delete the personal data we have about you, ask us to stop using it, or ask for a copy. Email [email protected] and we reply within one month. If you are not happy with how we handle your data, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

Security

We protect your data with secure connections (HTTPS) and keep access to it limited to the people who need it.