Privacy Policy

ORB. (“we”, “us”) respects your privacy and handles personal data in line with Singapore's Personal Data Protection Act (PDPA). This policy explains what we collect on orb.sg, why, and the choices you have.

• Account details: name, email, username, phone number, and delivery address when you register or update your profile.
• Design files: the 3D models you upload for quoting, plus the settings you choose and the resulting quotes.
• Order and payment records: what you ordered, amounts, delivery details, and payment status. Card and PayNow payments are processed by Stripe; we never see or store your full card number.
• Support messages: contact form submissions, design briefs, and refund/reprint requests including any photos you attach.
• Technical data: IP address and basic request logs used for security and rate limiting, and privacy-friendly aggregate analytics (Vercel Analytics, no advertising trackers).

• Generating quotes and producing your orders;
• Payment processing, delivery, and order updates;
• Running your account and the ORB. Rewards programme;
• Responding to support requests and quality claims;
• Keeping the platform secure (fraud and abuse prevention, rate limiting);
• Emails you'd expect: verification, password resets, order confirmations. We don't send marketing email without your consent.

Uploaded models are used solely to quote and fulfil your orders. They are stored in private cloud storage, are not publicly accessible, and are never shared with third parties, published, or printed for anyone else. Quoting records expire, but files may remain in private storage until they are purged. Paid-order files are not deleted automatically.

We don't sell personal data. We share only what's needed with the service providers that run the platform:

• Stripe: payment processing;
• Vercel: website hosting and aggregate analytics;
• Neon: database hosting;
• Cloudflare: file storage (R2) and content delivery;
• Upstash: job queue infrastructure;
• Resend: transactional email delivery.

Some providers process data outside Singapore; we use providers with standard industry safeguards and share the minimum necessary.

We use only functional cookies: a session cookie when you sign in, a signed cookie that ties guest quotes to your browser, and a theme preference. No advertising or cross-site tracking cookies.

Order records are kept as long as needed for warranty, accounting, and legal obligations. Account data is kept while your account is active. Data is encrypted in transit, access to production systems is restricted, and payment credentials never touch our servers.

Under the PDPA you may request access to or correction of your personal data, or withdraw consent (which may mean closing your account). Email hello@orb.sg and we'll respond within 30 days.

We'll post any changes to this policy on this page with an updated date. See also the Terms of Service.