Privacy Policy

We collect information you actively provide when you: create an account; complete your profile; subscribe to a paid plan; contact our support team; submit feedback; complete surveys; or use features of the Service that require data input.

When you use the Service, we automatically collect certain technical and usage information through: (a) web server logs; (b) strictly-necessary and functional browser storage (see Section 11); and (c) our application's own event logging. We do not run third-party analytics or advertising trackers by default; any optional analytics we add in the future will load only with your consent and will respect Global Privacy Control / Do-Not-Track.

If you register or sign in using Google OAuth, we receive your name, email address, and profile photo from Google as authorized by you. We may receive fraud signals or verification data from Stripe (our payment processor). We do not purchase third-party marketing lists.

We do not use the content of your websites or your personal communications to train our own AI models. To generate or edit your site, the prompts, media, and pasted-URL content you provide are sent to our AI provider — primarily Google's Gemini API and, if a fallback model is enabled for availability, a secondary provider (which may include OpenAI, Anthropic, or xAI) — which processes them to return results (see Section 8 and the applicable provider's API data-use terms). You may opt out of optional product analytics at any time in Account → Security & Privacy or by emailing privacy@angelgatesolutions.com.

We send marketing emails only where: (a) you have given explicit consent at signup or subsequently; or (b) you are an existing customer and the email relates to similar products or services (as permitted under applicable law). You may opt out at any time via the unsubscribe link in any marketing email, or through Account Settings > Notifications. Transactional emails (receipts, security alerts, legal notices) are not subject to marketing opt-out.

We engage the following third-party vendors to process personal data on our behalf, under their respective data processing terms (e.g., the Google Cloud DPA and Stripe DPA), which restrict use of the data to providing their services to us:

We may disclose personal information to law enforcement, courts, government agencies, or other third parties when: (a) required by applicable law, regulation, valid subpoena, court order, or legal process; (b) we believe disclosure is necessary to protect our rights or property; (c) we believe disclosure is necessary to protect the safety of any person; or (d) disclosure is required in connection with a government investigation. Where legally permitted, we will notify you before disclosing your information in response to such requests. See also Section 17 (Government Access).

In connection with any merger, acquisition, asset sale, reorganization, or bankruptcy proceeding involving Angel Gate Solutions, personal information may be transferred to the acquiring or surviving entity. We will provide you with at least 30 days' advance notice by email before your personal information becomes subject to a materially different privacy policy, and will give you the opportunity to delete your account before the transfer takes effect.

We may share aggregated or de-identified information (such as statistical usage data, industry trend reports, or benchmark data) with third parties for research, marketing, analytics, or other commercial purposes. De-identified data does not contain information that can reasonably be used to identify you.

We may share your information for purposes not described above with your prior, informed, and explicit consent.

If you refer others or join the Orbix Partner Program, we process referral and payout data as follows: (a) we attribute new signups to a referral code using cookies/browser storage and our server records; (b) we calculate commissions on referred accounts' subscription payments after covering taxes, payment-processing fees, and platform costs, and record them in your earnings ledger; (c) we process payouts through Stripe (see our subprocessor table above); and (d) where required, we collect tax documentation (e.g., IRS Form W-9 or W-8BEN) and report payments to tax authorities (e.g., IRS Form 1099). Partners receive only anonymized, aggregated performance data about the accounts they refer (such as amounts paid, plan, and their share) — never the personal information or identity of a referred account or its customers. Your participation is governed by the Partner Program terms in our Terms of Service (Section 5.11).

We honor Global Privacy Control ("GPC") signals. If your browser or device sends a GPC signal, we treat it as a valid opt-out of sale and sharing of personal information for California residents, consistent with guidance from the California Attorney General. We will not override or ignore GPC signals.

Even though we do not sell or share personal information, you have the right to direct us not to do so in the future. To exercise this right or to confirm our current practices, contact privacy@angelgatesolutions.com with the subject line "Do Not Sell or Share Request."

Some cookies may be set by third-party services embedded in our platform (for example, Stripe on payment/checkout pages). These cookies are governed by those third parties' own cookie and privacy policies, which we encourage you to review independently.

We present a cookie/storage consent banner before enabling any non-essential storage, and we default to declining it when your browser sends a Global Privacy Control or Do-Not-Track signal. You can change your choice at any time in Account → Security & Privacy. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

We respect browser "Do Not Track" (DNT) signals where technically feasible — when a DNT signal is detected, we will not place performance or marketing cookies. We also honor Global Privacy Control (GPC) signals from browsers that support it (see Section 9.1).

You can configure your browser to reject, block, or delete cookies at any time. Most browsers allow you to: view what cookies have been set; refuse all or certain cookies; delete cookies when you close the browser. Disabling strictly necessary cookies will prevent you from logging in and using the Service. Browser cookie controls are available in your browser's Settings or Preferences menu.

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, Angel Gate Solutions will:

• Notify affected Users without undue delay and, where feasible, within 72 hours of becoming aware of the breach, via email to the registered account address;
• Notify relevant supervisory authorities within 72 hours as required by GDPR Article 33 and applicable U.S. state data breach notification laws (including Florida Statute § 501.171, California Civil Code § 1798.82, and similar laws in other states);
• Provide a written notice containing: (a) the nature of the breach; (b) the categories and approximate number of individuals affected; (c) the categories and approximate number of data records affected; (d) the likely consequences of the breach; (e) the measures taken or proposed to address the breach; and (f) protective steps you can take;
• Take immediate containment, remediation, and forensic investigation steps;
• Document the breach internally as required by GDPR Article 33(5); and
• Cooperate with relevant regulatory authorities in their investigation.

If you discover a security vulnerability in Orbix, please contact us immediately and confidentially at security@orbixapp.com. We operate a responsible disclosure policy and will acknowledge your report within 48 hours. We ask that you give us a reasonable opportunity to investigate and remediate before public disclosure.

Regardless of your location, you have the following rights with respect to your personal information we hold:

• Right of Access: Request a copy of the personal information we hold about you;
• Right to Correction / Rectification: Request correction of inaccurate or incomplete information;
• Right to Deletion / Erasure: Request deletion of your personal information (subject to legal retention obligations);
• Right to Data Portability: Receive your personal information in a structured, machine-readable format (e.g., JSON, CSV);
• Right to Withdraw Consent: Withdraw any consent you have given at any time, without affecting the lawfulness of prior processing;
• Right to Opt Out of Marketing: Unsubscribe from marketing emails at any time via the unsubscribe link in any such email or through Account Settings.

In addition to the rights above, EEA and UK users have:

• Right to Restrict Processing (Art. 18): Request that we restrict processing of your data in certain circumstances;
• Right to Object (Art. 21): Object to processing based on legitimate interests; object to direct marketing at any time;
• Rights Related to Automated Decision-Making (Art. 22): Not to be subject to solely automated decisions that have legal or similarly significant effects, without human review (see Section 15);
• Right to Lodge a Complaint: Lodge a complaint with your national supervisory authority. In the UK: Information Commissioner's Office (ICO) at ico.org.uk. In EU member states: your national Data Protection Authority (find yours at edpb.europa.eu).

California residents have the following rights under the California Consumer Privacy Act (CCPA, Cal. Civ. Code § 1798.100 et seq.) and California Privacy Rights Act (CPRA):

To submit a CCPA/CPRA verifiable consumer request, contact privacy@angelgatesolutions.com with the subject line "California Privacy Rights Request." We may need to verify your identity before processing your request. We will respond within 45 days of receipt. Authorized agents must provide written proof of authorization.

The following additional U.S. state privacy laws may apply to residents of those states:

If you are a resident of any of the above states, you may exercise your rights by contacting privacy@angelgatesolutions.com. We will respond within the timeframe required by your state's applicable law. You may also have the right to appeal our decision; to do so, include "Privacy Rights Appeal" in the subject line of your email.

Canadian residents have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA, S.C. 2000, c. 5) and, for Quebec residents, Act respecting the protection of personal information in the private sector (Law 25 / Bill 64). These rights include: access to your personal information; correction of inaccurate information; withdrawal of consent; right to know if your information has been disclosed to third parties; and for Quebec residents: right to data portability and right to de-indexation. Contact privacy@angelgatesolutions.com to exercise these rights.

Two of the most common rights are available to you directly in the app: go to Account → Security & Privacy to export your data (machine-readable JSON) or to permanently delete your account.

For any other right (or if you can't access your account): email privacy@angelgatesolutions.com with subject line "Privacy Rights Request." Include your full name, the email address associated with your account, your state or country of residence, and a description of the right you wish to exercise. We may need to verify your identity to process your request. We will acknowledge your request within 5 business days. We will not charge a fee for reasonable requests; for manifestly unfounded or excessive requests, we may charge a reasonable fee or decline to act.

We do not disclose personal information to government or law enforcement agencies except pursuant to: (a) a valid court order; (b) a valid subpoena; (c) a valid legal demand issued under applicable law; or (d) other valid legal process. We carefully review all government requests for user data and require legally sufficient process before complying.

Where permitted by law and operationally feasible, we will attempt to notify you before disclosing your information to a government authority by emailing the address associated with your account. We may be prohibited by law from notifying you in certain circumstances (e.g., under a non-disclosure order or National Security Letter).

We reserve the right to publish transparency reports disclosing aggregate statistics regarding government requests for user data, to the extent permitted by applicable law.

Under the USA PATRIOT Act and similar national security legislation, Angel Gate Solutions may be required to provide government agencies with access to stored electronic communications and associated records. If applicable, we will comply with legally valid national security requests while challenging overbroad requests to the extent legally permissible.

Angel Gate Solutions, LLC is headquartered and operates primarily in the United States. If you access Orbix from the European Economic Area ("EEA"), the United Kingdom ("UK"), Canada, or any other jurisdiction with data transfer restrictions, your personal information will be transferred to and processed in the United States, which may have different data protection laws and may not be deemed to provide an "adequate" level of protection by your jurisdiction's standards.

For transfers of personal data from the EEA or UK to the United States, we rely on the following safeguards:

• Standard Contractual Clauses (SCCs): We incorporate the European Commission's Standard Contractual Clauses (Decision 2021/914) for EEA-to-U.S. transfers with our sub-processors;
• UK International Data Transfer Agreements (IDTAs): For UK-to-U.S. transfers, we use the UK IDTA approved by the UK Secretary of State;
• Supplementary Measures: Where required by post-Schrems II guidance, we implement supplementary technical and organizational measures (e.g., encryption, pseudonymization).

Our sub-processors (including Google LLC and Stripe, Inc.) maintain their own internationally recognized transfer mechanisms, including participation in applicable data transfer frameworks and implementation of SCCs. You may request a list of our sub-processors and their transfer mechanisms by contacting privacy@angelgatesolutions.com.

If you are located in the EEA or UK and are not satisfied with our response to your privacy request or complaint, you have the right to lodge a complaint with your local supervisory authority:

• United Kingdom: Information Commissioner's Office (ICO) — ico.org.uk
• European Union: Your national Data Protection Authority (directory at edpb.europa.eu)

We will acknowledge privacy requests within 5 business days and provide a substantive response within: 30 days for general requests; 45 days for CCPA/CPRA verifiable consumer requests (extendable by 45 days with notice); 30 days for GDPR requests (extendable by 2 months for complex requests, with notice); and within the period required by other applicable state privacy laws.