Privacy Policy

Privacy Policy

Operator: Belmiro Michel Da Cruz Antonio, an individual established in Portugal and operator of the personal Orbisay project.
Legal contact address: Braga rua 25 de abril
Tax identification / NIF: 301963134
Email: [email protected]
Effective date: 19 September 2026.

1. Scope

This Policy explains how Orbisay processes personal data when someone creates an account, uses the platform, publishes content, comments, reacts, sends messages to the team, submits reports or exercises privacy rights.

2. Data we may process

Depending on the feature used, we may process: name, username, email, password in hashed form, date of birth, country, city, language, profile photo, bio, interests, posts, comments, likes, reports, appeals, support messages, consent records, session data, security information and technical logs necessary to operate and protect the service.

We never store the original password. Passwords are protected with Argon2id. Verification codes and sensitive tokens are stored in non-reversible or encrypted form according to their purpose.

3. Purposes and legal bases

We process data to:
- create and manage accounts and provide the requested service;
- verify email addresses, authenticate users and maintain secure sessions;
- enable posts, comments, likes, search and other social features;
- prevent fraud, abuse, attacks, spam and unauthorised access;
- receive and decide reports, appeals and content-related requests;
- respond to support messages;
- comply with legal obligations and respond to competent authorities when legally required;
- maintain records of consent and preferences;
- send marketing communications only where an appropriate legal basis exists, including consent where required.

Legal bases may include performance of a contract, compliance with legal obligations, legitimate interests in platform security and integrity, and consent where applicable.

4. Minimum age

As a product policy, Orbisay applies a minimum age of 16 at launch. Accounts that do not satisfy the applicable minimum age should not be created.

5. Sharing and service providers

We do not sell personal data to advertisers.

We may use providers necessary for hosting, email, CDN/security, storage, backups and technical operation. Initial infrastructure includes services from Hostinger and Cloudflare. Providers process data only to the extent necessary for the contracted services and applicable safeguards.

6. International transfers

Some providers may process data outside the European Economic Area. Where applicable, we use mechanisms recognised by data-protection law, such as adequacy decisions or appropriate contractual safeguards.

7. Retention

We retain data for as long as necessary to provide the service, comply with law, resolve disputes and protect the platform. Never-verified accounts may be automatically removed after the configured period, currently up to 72 hours. Verification codes expire by default after 10 minutes. Support, reporting, moderation, security or legally relevant information may be kept for as long as necessary for the relevant purpose and possible legal claims.

When data is no longer needed, it is deleted or appropriately anonymised.

8. Security

We use technical and organisational measures including password hashing, administrator MFA, access controls, rate limiting, server-side sessions, encryption of secrets, encrypted backups, sensitive-log reduction and isolation of PostgreSQL and Redis from the public Internet.

No system can guarantee zero risk. We maintain processes to detect, respond to and mitigate incidents.

9. Your rights

Where applicable, you may request access, rectification, erasure, restriction, portability, objection and withdrawal of consent. You may also lodge a complaint with the competent supervisory authority, including the Portuguese CNPD.

Requests may be sent to [email protected] or made through available account tools. We may request additional information reasonably necessary to confirm identity.

10. Decisions and moderation

Orbisay may restrict accounts or content for safety, legal compliance and enforcement of platform rules. Where appropriate and required, we communicate the decision and reasons and provide appeal mechanisms.

11. Changes

We may update this Policy. Material changes will be communicated appropriately and, where required, renewed acceptance will be requested.