Privacy Policy

1. Who this policy covers

This policy explains how Orbits Cards (“we”, “us”) handles personal data when you use https://orbits.cards, the Orbits Cards app, the business portal or the API. Orbits Cards is a reseller of cards and eSIM plans issued by our partners (see our Terms of Service). Our issuing partners also handle your data for their own products, under their own privacy notices.

2. What we collect

Account details. Your name, email address, an optional $Cashtag, and your password, which we store only as a one-way hash. For a business account: the company name, contact name, work email, website and password hash.

Security data. Whether two-factor authentication is on, its secret (stored encrypted), hashes of your recovery codes, and failed-attempt counters. One-time email codes, stored only as a hash with the IP address that asked for them.

Wallet and payment data. Your USDT deposit address, the withdrawal addresses you save (with any label you give them), and the blockchain transactions to and from them. Your balance, the full history of deposits, withdrawals, card loads and purchases from us, quotes and fees, and the limits that apply to you.

Card and eSIM data. For each card: the range, brand, status, the label and colour you choose, the cardholder email, expiry date, balance and the partner's reference. Full card numbers and security codes are held by the issuing partner, not by us: when you ask to see them, the app fetches them from the partner and shows them to you without our storing them. Purchase and decline records come from the partner. Card security codes sent to us by the partner (for 3-D Secure or adding a card to a mobile wallet) are kept so the app can show them to you. For each eSIM: the plan, its ICCID, installation details and status.

Identity checks. Your verification status. Identity documents asked for by an issuing partner are collected and kept by that partner under its own notice.

Support requests. What you write to us in a support request, your name and email, and our replies.

Technical and log data. Your IP address and, for security events, your browser's user agent; request logs (what was asked, when, the result, without passwords, codes, card numbers or keys); and for business accounts, an API log of each request made with your keys, including its IP address. Your IP address is also used, in memory only, to rate-limit requests; those counters are not stored.

3. Why we use it

• To provide the service you ask for: open and run your account, credit deposits, send withdrawals, buy cards, top-ups and eSIMs from our partners, and show your history. This is needed to perform our agreement with you.
• To keep accounts and money safe: sign-in, two-factor authentication, email confirmations, rate limits, fraud checks and the review of withdrawals. This is in our and your legitimate interest, and in some cases a legal duty.
• To meet legal and partner requirements: keep financial records, answer lawful requests, and support the identity and anti-money-laundering checks our partners must run.
• To talk to you: security emails (codes, sign-in and two-factor changes, withdrawals, new addresses), answers to support requests, account notices (for example when business live access is turned on), and notices about important changes. We do not send marketing email and we do not sell your data.
• To fix and improve the service: logs help us find errors and understand failures.

4. Who we share it with

We share only what each party needs to do its job:

• Card-issuing partners: a reference for your account, the card range you choose, your cardholder email (the partner sends 3-D Secure and mobile-wallet codes to it) and the amounts you load. They hold your card numbers and run identity checks, and they send us your card's status, balance and transactions.
• Our eSIM partner: the plan you buy and order references. It sends us the eSIM profile and its status.
• Our crypto payment processor: the service that provides deposit addresses and confirms USDT transfers receives a reference for your account and sees the deposits made to your address.
• Blockchain networks and blockchain data services: USDT transfers on TRON are public. Your deposit address, your withdrawal addresses and the transfers between them can be seen by anyone, and we look them up through a TRON network data service.
• Our email provider: your email address and the content of the security and support emails we send you.
• Hosting and infrastructure providers that run our servers and database for us, under contract and only on our instructions.
• Font provider: our pages load their typefaces from Google Fonts, so your browser sends your IP address to Google when it fetches them.
• Business accounts' own systems: if a business issues you a card through our API, card events are sent to the webhook address that business has set up.
• Authorities: when the law requires it, or to protect our users, our partners or us from fraud or harm.

Some of these parties are in other countries. Where data leaves the country it was collected in, we rely on the safeguards the law requires.

5. How long we keep it

• One-time email codes are deleted automatically about an hour after they expire.
• Request logs are deleted automatically after 30 days. Repeat-request (idempotency) records for the business API are deleted after 30 days.
• Rate-limit counters are held only in memory and are never written to storage.
• Account details, balances, the transaction ledger, card and eSIM records, security events, business API logs and support requests are kept while your account is open and afterwards for as long as we need them to meet legal, accounting and anti-fraud duties and to settle disputes. Our ledger is append-only: entries are corrected by new entries, not deleted.
• Issuing partners keep the data they hold for the periods set in their own notices.

6. Your rights and choices

Depending on the law where you live, you may have the right to:

• ask for a copy of the personal data we hold about you;
• correct data that is wrong (you can change your name and $Cashtag in Settings yourself);
• ask us to delete your data, or to close your account, subject to the records we must keep (section 5);
• object to, or ask us to limit, some uses of your data;
• receive your data in a portable format;
• complain to the data protection authority where you live.

To use these rights, contact us (section 9). We may ask you to confirm the request from your account email so that nobody else can make it for you. For data held by an issuing partner, we will pass your request on or tell you how to contact the partner.

7. Cookies and storage in your browser

We do not use cookies, advertising trackers or third-party analytics. The app keeps a few items in your browser's own storage, which stay on your device:

• Local storage: your sign-in token (orbit_token, and orbit_biz_token for the business portal), whether the portal is in test or live mode (orbit_biz_mode), and your light or dark theme (orbit_theme).
• Session storage: short-lived keys that stop a payment being sent twice if you reload the page while it is processing. They are cleared when you close the tab.

Signing out removes your sign-in token. You can clear all of these at any time in your browser's settings; you will then need to sign in again.

8. Security and eligibility

Passwords and recovery codes are stored only as hashes, two-factor secrets are encrypted, and logs strip passwords, codes, card numbers and keys. No system is perfectly secure: keep your password and authenticator safe, and tell us at once if you think your account has been accessed.

To use Orbits Cards you must meet the eligibility and identity (KYC) requirements of the issuing partner for the product you buy. Those checks are run by that partner, as described under Identity checks above.

9. Contact and changes

For any privacy question or request, use the Support page in the app or, for business accounts, the Support page in the business portal. Our Getting help page lists every way to reach us.

We may update this policy when the service or the law changes. The date at the top shows the latest version, and we will tell you by email or in the app before an important change takes effect.