Privacy Policy

1. Introduction

Welcome to Orbliq ("we," "our," or "us"). We are committed to protecting your privacy and personal information in accordance with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and other applicable data protection laws.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our 3D artwork visualization platform and related services. The responsible party ("Verantwortlicher") within the meaning of Art. 4(7) GDPR is specified in our Impressum.

2. Information We Collect

2.1 Information You Provide

• Account information (email address, name) when you sign up via Google or email authentication
• Artwork images you upload for 3D visualization
• Project configurations (sizes, frame types, presentation settings)
• Payment information (processed securely by our payment provider, LemonSqueezy)
• Custom branding assets (for Gallery tier users)

2.2 Information Collected Automatically

• Usage data (pages visited, features used, session duration)
• Device information (browser type, operating system)
• Analytics data via Microsoft Clarity (session recordings, heatmaps)
• View counts and engagement metrics for shared/embedded projects

3. How We Use Your Information

• Provide and maintain our 3D visualization services
• Process your artwork and generate showroom mockups using AI
• Manage your account and subscription
• Process payments and prevent fraud
• Send service-related communications
• Improve our platform and develop new features
• Provide analytics for your shared projects (paid tiers)
• Respond to support requests

3a. Legal Basis for Processing (Art. 6 GDPR)

We process your personal data on the following legal bases:

• Contract performance (Art. 6(1)(b) GDPR) – Processing necessary to provide our services: account management, artwork storage, 3D rendering, showroom generation, and subscription management
• Legitimate interests (Art. 6(1)(f) GDPR) – Analytics to improve our platform, fraud prevention, and security monitoring. Our legitimate interest is to provide and improve a secure service. You can object to processing based on legitimate interests at any time
• Consent (Art. 6(1)(a) GDPR) – Analytics cookies (Microsoft Clarity) and marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal
• Legal obligation (Art. 6(1)(c) GDPR) – Retention of payment records and responding to legal requests as required by German tax and commercial law

3b. Data Transfers Outside the EU/EEA

Some of our service providers process data outside the European Economic Area (EEA). In particular, AWS and Google services may process data in the United States. These transfers are safeguarded by:

• EU Standard Contractual Clauses (SCCs) as approved by the European Commission
• The EU-U.S. Data Privacy Framework where applicable
• Appropriate technical and organizational measures

You may request a copy of the relevant safeguards by contacting us.

4. Data Storage and Security

Your data is stored securely using industry-standard practices:

• Artwork and project files are stored on Amazon Web Services (AWS) S3 with encryption
• User data is stored in AWS DynamoDB with access controls
• Authentication is handled by Firebase Authentication (Google)
• All data transmission is encrypted via HTTPS/TLS
• Payment information is handled by LemonSqueezy and never stored on our servers

5. Third-Party Services

We use the following third-party services:

• Google Firebase - Authentication services
• Amazon Web Services - Cloud storage and database
• Google Gemini AI - AI-powered showroom generation
• LemonSqueezy - Payment processing and subscription management
• Microsoft Clarity - Analytics and session recording
• Meta - Optional advertising measurement through the Meta Pixel and server conversion events, when you allow marketing measurement

Each service has its own privacy policy governing the use of your data.

6. Data Sharing

We do not sell your personal information. We may share data:

• With service providers who assist in operating our platform
• When you make projects public or create embeddable links
• To comply with legal obligations or protect our rights
• In connection with a business transfer or acquisition

7. Your Rights Under GDPR

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15) – Obtain confirmation and a copy of your personal data
• Right to rectification (Art. 16) – Correct inaccurate or incomplete data
• Right to erasure (Art. 17) – Request deletion of your data ("right to be forgotten")
• Right to restriction (Art. 18) – Restrict processing under certain conditions
• Right to data portability (Art. 20) – Receive your data in a structured, machine-readable format
• Right to object (Art. 21) – Object to processing based on legitimate interests, including profiling
• Right to withdraw consent (Art. 7(3)) – Withdraw consent at any time, without affecting prior processing

To exercise any of these rights, contact us at support@orbliq.com. We will respond within 30 days as required by law.

Right to lodge a complaint: You have the right to lodge a complaint with a data protection supervisory authority. The competent supervisory authority in Germany depends on the federal state where our company is registered. You can find a list of all German supervisory authorities at www.bfdi.bund.de.

8. Data Retention

We retain your data as long as your account is active. Upon account deletion:

• Your personal information is deleted within 30 days
• Uploaded artwork and projects are permanently removed
• Anonymized usage data may be retained for analytics
• Payment records are retained as required by law

9. Cookies

We use essential cookies for authentication and preferences (like dark mode). With your analytics permission, Microsoft Clarity helps us understand visits and usability. With your marketing permission, Meta can receive page visits and account registration, trial and purchase events, including transaction value and currency, permitted advertising identifiers, and hashed account identifiers for matching. Artwork files and prompts are not included in these conversion events. Use Privacy choices to allow or withdraw optional measurement at any time.

10. Children's Privacy

Orbliq is not intended for children under 13. We do not knowingly collect information from children under 13. If you believe we have collected such information, please contact us.

11. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes via email or platform notification. Continued use after changes constitutes acceptance.

12. Contact Us

For questions about this Privacy Policy or our data practices:

Email: support@orbliq.com