Gritly Analytics Private Limited, operating as Orbix Global ('Orbix'), is a technology company incorporated in India operating the compliance assessment platform at orbixglobal.com. Under the Digital Personal Data Protection Act 2023 (DPDPA), Orbix is the Data Fiduciary — the entity that determines the purpose and means of processing your personal data. You are the Data Principal.
| Data Type | What It Is | Why We Collect It |
|---|---|---|
| Identity data | Name, email from Google account | Account creation |
| Mobile number | Indian mobile number (10 digits, optional) | Compliance alert notifications (provided voluntarily by user) |
| Mission data | Mission type, orbit, phase, compliance responses | Generating your compliance assessment |
| Feedback data | Thumbs up/down, optional text | Platform improvement |
| Payment data | Transaction amount, Razorpay order IDs | Payment processing and GST invoices |
| Usage data | Pages visited, session duration, IP address | Security and analytics |
| Terms acceptance | Timestamp, IP, device when you accepted Terms | Legal evidence under IT Act 2000 |
What we do NOT collect: Credit card numbers (handled by Razorpay only), government IDs, biometric data, location beyond IP address, or data from anyone under 18.
| Legal Basis | When We Use It |
|---|---|
| Your explicit consent (Section 6 DPDPA) | All data collected at registration — via checkbox at signup |
| Contract performance | Providing the compliance assessment services you paid for |
| Legal obligation | GST law, IT Act, company law compliance |
| Legitimate interests | Platform security, fraud prevention |
We will never: Sell your data, share mission data with competitors, use mission data to train AI without anonymisation and your consent, or send unsolicited marketing without consent.
| Provider | What They Process | Location |
|---|---|---|
| Supabase Inc | Database — user accounts, sessions, payments | AWS Singapore |
| Razorpay Software Pvt Ltd | Payment processing only | India (RBI licensed) |
| Fast2SMS | SMS notifications to mobile (only if mobile number provided by user) | India |
| Anthropic PBC | AI processing of compliance responses | USA (not retained per Anthropic API policy) |
| Google LLC | OAuth authentication | USA (GDPR compliant) |
| Data Type | Retention Period |
|---|---|
| Account data | Duration of account + 90 days after deletion |
| Mission and assessment data | 36 months from last session |
| Payment records | 8 years (GST law compliance) |
| Terms acceptance logs | 7 years (IT Act 2000) |
| OTP logs | 30 days |
| Usage and session logs | 12 months |
| Your Right | How to Exercise | Response Time |
|---|---|---|
| Access your data | Email privacy@orbixglobal.com — subject: Data Access Request | 30 days |
| Correct your data | Email privacy@orbixglobal.com — subject: Data Correction Request | 30 days |
| Delete your data | Email privacy@orbixglobal.com — subject: Data Deletion Request | 30 days |
| Withdraw consent | Email privacy@orbixglobal.com — subject: Withdraw Consent | 30 days |
| File a grievance | Email grievance@orbixglobal.com | 15 days |
| Nominate a representative | Email privacy@orbixglobal.com with nominee details | 30 days |
If unsatisfied with our response, you may approach the Data Protection Board of India once constituted under DPDPA 2023.
We use only essential browser localStorage to store your authentication token (keeps you logged in). We do not use advertising cookies, tracking cookies, or any third-party analytics cookies. No non-essential cookies means no cookie consent banner is required.
The platform is not for anyone under 18. If we discover a user is under 18, their account and data will be deleted immediately. Contact privacy@orbixglobal.com if you believe a child has registered.
Material changes will be notified by email at least 15 days before taking effect. The Effective Date above will be updated. Previous versions are available on request at privacy@orbixglobal.com.