Version 1.0 · Last updated 2 November 2026
This Privacy Policy explains how Orbis Digital Ltd, a company registered in England and Wales (Company No. 17116737), registered office 66 Paul Street, London, EC2A 4NA, collects, uses and protects personal data when you use Orbis Drive or contact us through this website. We are the data controller for account, billing, enquiry and website data. For personal data within files you store, the account holder or workspace owner is generally the controller and we act as its processor.
1. Information we collect
- Account details: your name, email address, a secure hash of your password and the workspace name you choose.
- Workspace data: membership and role, invitation addresses, file and folder names, sizes and dates, and sharing link settings.
- Files: the files you and your workspace members upload, which may contain personal data.
- Enquiries: your name, email address, organisation and message when you contact us.
- Billing data: Stripe customer and subscription references and plan details. Stripe processes your card details; we do not receive your full card number.
- Technical data: IP address, browser information, server logs, rate-limit data and audit records of key actions, used to keep the Service secure.
2. How we use your information
- To provide, maintain and support the Service.
- To verify your email address and send password reset and other service messages.
- To take payment and manage subscriptions.
- To respond to enquiries.
- To protect the Service, prevent misuse and investigate incidents.
- To comply with legal obligations.
3. Legal bases
We rely on performance of a contract, our legitimate interests in running and securing the Service, compliance with legal obligations, and consent where it is required.
4. Service providers
We share data with trusted suppliers who process it on our behalf:
- Cloudflare for file storage (R2)
- OVHcloud for server hosting
- Brevo for transactional email
- Stripe for payments
- Dropbox for storing our encrypted offsite backups
- Google Fonts for delivering website fonts, which involves your browser connecting to Google and sharing your IP address
5. International transfers
Some suppliers may process data outside the UK. Where they do, we rely on appropriate safeguards required by UK data protection law, such as adequacy regulations or the International Data Transfer Agreement or Addendum. Contact us for more information.
6. Retention
We keep account data while your account is active. Deleted files stay in Trash for 30 days before permanent removal from live storage. Encrypted backups are kept for about 35 days. Expired tokens and sharing links are removed automatically. Billing records may be kept for as long as accounting and tax law requires.
7. Your rights
Under UK data protection law you may have rights to access, correct, delete or restrict your personal data, to object to processing and to data portability. To exercise these rights, or to request account deletion, contact support@orbisdigital.co.uk. We will respond within one month where the law requires. If your data is in a workspace run by another organisation, please contact that organisation first. You may also complain to the Information Commissioner's Office at ico.org.uk.
8. Cookies
We use essential cookies as described in our Cookie Policy.
9. Security
We use encrypted connections, private storage, hashed passwords, access checks and encrypted backups. No online service can be guaranteed completely secure. See our Security page for detail, including what is not provided.
10. Changes
We may update this policy and will post the current version here with its date.
11. Contact
For privacy questions, contact Orbis Digital Ltd at support@orbisdigital.co.uk.