Privacy policy

Last updated: [date of legal review]. Company: OddOrbit Labs LLC, a New Jersey limited liability company, [principal business address].

What we collect

• Your email address, to deliver purchases, run your account and (only if you opt in) send marketing emails.
• Order records: product, amount, date and the payment processor's reference. We never see or store your card details.
• If you pay with stablecoin: Stripe and its payment partners process wallet addresses and transaction information to handle stablecoin payments. We receive payment records and may access related wallet and transaction details through Stripe. On-chain transactions are publicly visible and generally cannot be deleted.
• If you pay with bitcoin: your billing country, state and postal code (to calculate sales tax), and the payment's network details. Blockchain payments are public records, and wallet addresses can be linked to transactions by anyone. [List any sanctions-screening provider used.]
• Messages you send us.
• Basic page-view counts by product, without cookies for tracking or advertising.

What we don't do

We don't sell your data, we don't use advertising trackers, and we don't use your messages to train AI models.

Who we are

OddOrbit Labs LLC, [business postal address], is the controller of the personal information described here. Contact: [privacy email].

Who processes it

We use Stripe for payments, billing and fraud prevention; [email provider/legal entity] for email delivery; [hosting provider/legal entity] for hosting; and [AI provider/legal entity] to process customization instructions and generate requested outputs. We disclose only information needed for these purposes. Providers act under appropriate contractual restrictions where they process information on our behalf. Stripe also processes some information as an independent controller under its privacy notice.

Legal bases (EU and UK)

Where EU or UK data-protection law applies, our bases are contract necessity for purchases, accounts and requested customization; applicable legal obligations for required records; legitimate interests in security, fraud prevention and handling ordinary inquiries; and consent for optional marketing. Consent may be withdrawn at any time.

International transfers

Information is processed in [actual countries]. Where legally required, transfers use [only the mechanisms actually in place: adequacy decision, Data Privacy Framework certification, EU Standard Contractual Clauses or UK IDTA/Addendum], with additional safeguards where necessary. Contact [privacy email] for information about applicable safeguards or a copy.

How long we keep it

We retain order and tax records for [verified period and starting point, set by the accountant]. Routine support messages and customization inputs are deleted after 12 months unless needed for an unresolved matter or legal obligation. Marketing records remain until withdrawal; we retain minimal suppression information to respect unsubscribe requests. Consent and dispute records follow applicable legal retention periods.

Your rights

Depending on applicable law, you may request access, correction, deletion, portability or restriction, object to processing, withdraw consent, and complain to your data-protection regulator. Rights are subject to legal exceptions. Contact [privacy email] or use our contact page; we respond within applicable deadlines.