{"id":"privacy","slug":"privacy","title":"Privacy Notice","version":"2026-10-21.v1","locale":"en","effectiveAt":"2026-10-21T00:00:00+04:00","updatedAt":"2026-10-21","summary":"How Orbitty uses personal data, what becomes public, and how to exercise your choices and rights.","sections":[{"id":"controller","title":"1. Who is responsible","paragraphs":["Orbitty is operated by Ancu Labs FZE LLC, a free zone establishment registered with Sharjah Publishing City Free Zone Authority, licence 4415153.01, formation 4415153. Our registered address is Business Centre, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates.","Ancu Labs FZE LLC determines the purposes and means of personal-data processing for Orbitty, except where an independent provider or a seller acts for its own purposes. Use Support → Privacy for questions or rights requests, or write to our registered address. We do not claim to have an appointed EU or UK representative or data protection officer where none has been appointed."]},{"id":"data","title":"2. Data we process","paragraphs":["Account data includes email address, profile details, account identifier, sign-in provider and security-factor information, sessions and security events. Listing data includes seller declarations, business and permit information where collected, prices, descriptions, photos, location, approximate public boundaries, draft content, status and updates. We also process saved land, enquiries and their recipient/contact information, support and recovery requests, reports, appeals and legal acceptance records.","Technical information can include IP address, browser/device type, request time, cookie or consent identifiers and security/error logs. We do not ask you to submit passwords, full card numbers or identity documents through ordinary support messages. If additional evidence is necessary, we will explain a suitable restricted collection method. Do not include other people’s personal data without a lawful basis."]},{"id":"sources","title":"3. Where data comes from","paragraphs":["We receive data from you, your authenticated use of Orbitty, sellers and people who contact or report content, and relevant service providers. Identity and payment providers return the results and references needed to deliver their features. Map services supply location and map information. We may receive evidence from an authorised organisation representative or a lawful authority. We do not treat public listing facts as proof of account ownership."]},{"id":"purposes","title":"4. Purposes and legal authority","paragraphs":["We process information to provide requested accounts, saving, drafts, publication, enquiries, billing and support; protect accounts and prevent abuse; maintain service reliability; meet legal and accounting duties; manage complaints and disputes; and record required agreements. Optional analytics or marketing require a separate valid choice where applicable.","Under UAE data-protection law, we rely on consent where required or the applicable permitted exception, including processing necessary for a contract with you, compliance with law, or legal claims. Where EU or UK data-protection law applies, we use contractual necessity for requested services, legal obligation where a relevant duty applies, legitimate interests for proportionate security, fraud prevention and service administration after considering your rights, and consent for optional tracking or marketing requiring consent. We do not treat acceptance of Terms as consent to every use of data."]},{"id":"public","title":"5. Public listings and location","paragraphs":["Information intentionally published in a listing may be available worldwide, indexed by search engines and shared by others. This may include descriptions, photos, price, public location, approximate boundary and area, seller role, permitted public identifiers, availability and scoped identity status. Do not include home contact details, identity documents or sensitive information in public descriptions or images.","Drafts, private contact information and internal case evidence are not intended for public display. Public map locations are approximate representations; location can still identify real land. Review the map and public preview before publishing. A geolocation request to your device is optional and subject to browser permission. Public photo derivatives are normalised to remove unnecessary metadata; avoid uploading sensitive originals. Removing a listing cannot immediately erase independent search caches or copies already made by others."]},{"id":"sharing","title":"6. Recipients and service providers","paragraphs":["Buyer names, contact details and private messages are disclosed only to a currently authorized recipient who has their own valid personal identity verification and eligible Orbitty Active access for the listing. Enquiries may be received while these requirements are pending and may be disclosed later when they are met, only while the record remains retained under this notice and any applicable privacy restriction. Deleted enquiries are not restored. A verified company owner does not confer personal identity verification on employees. Staff and service providers have access needed for their authorized function. We may disclose information to comply with lawful requests, investigate abuse, protect legal rights or carry out a lawful business transfer with appropriate safeguards. We do not sell personal data or share it for cross-context behavioural advertising.","The application uses Supabase for authentication and application data; Google Maps and Google 3D mapping for maps and location services; Cloudflare storage/media infrastructure and Turnstile where configured for media and abuse protection; Stripe for hosted platform-fee payments and subscriptions; Didit for a requested identity-verification flow; Resend for configured transactional email; Meta/WhatsApp when an available messaging channel is selected; and Sentry for configured error monitoring. Google Analytics is optional and may operate only when enabled and your analytics choice permits it. The relevant provider is used only when its corresponding service is operating. Hosting and infrastructure providers process requests needed to run the site.","Payment providers collect card details in their hosted interface; Orbitty retains payment references, subscriptions and invoices rather than raw card details. Didit collects identity evidence directly under its notice. Orbitty retains scoped status, limited provider references, an approved verified name where returned for public-name review, and minimal duplicate-signal and review decisions. Orbitty does not retain identity document images, face photographs or biometric templates for duplicate detection. A potential match can hold identity-gated privileges pending human review; use Support → Identity verification to request review without receiving information about another account. An identity result does not prove ownership or listing authority. Error monitoring minimizes personal data and does not enable session replay."]},{"id":"transfers","title":"7. International processing","paragraphs":["We are based in the UAE and service-provider infrastructure or support may process data in other countries. Public listing publication is worldwide by design. For restricted international transfers, we assess the destination, provider contracts and available lawful transfer mechanism, such as an adequacy decision or appropriate contractual safeguards when applicable. You may ask through Support → Privacy for information about safeguards relevant to your data. We do not treat use of the site alone as consent to an otherwise unlawful transfer."]},{"id":"retention","title":"8. Retention and deletion","paragraphs":["We keep personal data only while reasonably needed for the stated purpose, a lawful retention duty or a proportionate legal hold. Account and active listing data are generally needed while the service is used. Closing an account or requesting deletion triggers review of associated drafts, photos, enquiries, billing, support and provider records; completion depends on verification and lawful exceptions. We explain retained categories where a request cannot be fulfilled in full.","Billing and tax records, agreement evidence, fraud records and dispute evidence may need to remain after account closure. Recovery evidence is restricted and reviewed for deletion when the case no longer needs it. Deleted photos may remain in isolated recovery storage through a minimum 30-day protection period before controlled cleanup; backups are not used to restore deleted content into ordinary use. We do not promise immediate deletion from every provider or backup. Ask for the retention information applicable to your case."]},{"id":"cookies","title":"9. Cookies, choices and communications","paragraphs":["Necessary authentication, security and consent storage support the service. Requested preferences and draft recovery use browser storage. Optional analytics are subject to the Cookie Preferences control; rejecting optional analytics does not prevent core account or marketplace use. See the Cookie Notice for the inventory and withdrawal mechanism. Marketing is separate from service, enquiry and security communications and is not a condition of accepting Terms."]},{"id":"rights","title":"10. Your rights","paragraphs":["Depending on applicable law, you may request access, correction, deletion, portability, restriction, objection to processing and withdrawal of consent. You may object to direct marketing at any time. Withdrawing consent does not affect earlier lawful processing. A request may be subject to lawful exceptions and proportionate verification; we do not ask for more evidence than needed.","Submit a Privacy request through Support, including your request type and a safe reply channel. You receive a case reference and can track the available status. We aim to acknowledge within seven days and respond within the applicable legal period, ordinarily one month where EU/UK rules apply. If more time is lawfully needed, we explain why. You may complain to the competent privacy authority, including the UAE Data Office or your relevant local authority; using our Support route does not limit that right."]},{"id":"security","title":"11. Security and automated decisions","paragraphs":["We use access controls, encrypted connections, restricted provider credentials and proportionate monitoring. No system is risk-free; report suspected security issues through Support → Security. We do not use solely automated decisions to determine land ownership, legal purchase eligibility or professional advice. This version does not describe an operational generative-AI adviser. Any future material AI processing will require an updated notice and appropriate controls."]},{"id":"children","title":"12. Children and updates","paragraphs":["Orbitty accounts and seller services are intended for adults with legal capacity. We do not knowingly solicit children’s personal data. Contact Support → Privacy if a child’s data has been submitted.","We publish a dated version and archive prior published notices. Material changes will be brought to your attention through appropriate service or account notices. New consent is requested where a changed use legally requires it."]}]}