Privacy Policy

2. Categories of Data We Process

• Account and Profile Data: Full name, email address, password hash (managed securely via Supabase Auth), workspace team invitations, and user role.
• Social Channel Access Tokens & Credentials: Encrypted OAuth 2.0 access and refresh tokens necessary to publish scheduled content to your connected social channels (Meta, LinkedIn, X, TikTok, YouTube, Pinterest, Google Business Profile). All tokens are stored in an AES-256-GCM encrypted vault.
• Content & Post Data: Text captions, scheduled publishing timestamps, image and video URLs, link destinations, and UTM parameters configured in the composer.
• Payment & Billing Data: Our order process is conducted by our reseller Paddle.com (Merchant of Record). Paddle collects credit card details, billing address, and tax identification numbers. Orbit Cue does not receive or store full payment card numbers; we only store Paddle transaction IDs, subscription identifiers, and billing plan status.
• Technical Log Data: IP address, device type, operating system, browser user-agent, error trace logs, and delivery attempt HTTP status codes.

3. Legal Bases for Processing (GDPR Art. 6)

• Performance of a Contract (Art. 6(1)(b)): Processing necessary to provide Orbit Cue SaaS functionality, authenticate users, execute scheduled social media posts, and manage workspaces.
• Legal Obligation (Art. 6(1)(c)): Compliance with statutory accounting, invoice retention, and tax requirements under Latvian commercial and tax laws.
• Legitimate Interests (Art. 6(1)(f)): Detecting security incidents, preventing fraud, diagnosing server errors, and maintaining service reliability and tenant isolation.
• Consent (Art. 6(1)(a)): Where explicitly requested for optional non-essential analytics or marketing communications.

4. Sub-processors and Third-Party Data Sharing

We engage reputable cloud service providers under Data Processing Agreements (DPAs) incorporating EU Standard Contractual Clauses (SCCs) where international transfers occur:

5. Data Retention Periods

We retain personal data only for as long as your workspace account remains active or as needed to provide the service. If you delete your account or organization workspace:

• Connected OAuth credentials and access tokens are immediately purged and unlinked.
• Scheduled and drafted content is removed from the active database.
• Invoices, tax records, and transactional financial logs are retained for at least five (5) years in accordance with Latvian accounting laws (Likums "Par grāmatvedību").

6. Your Rights Under the GDPR

As an individual in the European Economic Area (EEA), you possess the following rights regarding your personal data:

• Right of Access (Art. 15): Obtain confirmation and copies of your personal data.
• Right to Rectification (Art. 16): Request correction of inaccurate information.
• Right to Erasure ("Right to be Forgotten", Art. 17): Request deletion of your data.
• Right to Restriction of Processing (Art. 18): Restrict processing under certain conditions.
• Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to Object (Art. 21): Object to processing based on legitimate interests.

To exercise any of these rights, contact our privacy team at hello@saiteo.com. We respond to all verified requests within one calendar month.

7. Supervisory Authority & Complaints

If you believe our processing of your personal data infringes the GDPR or Latvian data protection laws, you have the right to lodge a complaint with the lead supervisory authority: