Legal / pre-launch draft
Privacy policy
Effective 22 October 2026 · NAYI MANZIL LLC
Account data
We process your name, email address, phone number, email-verification record, password verifier, hashed session tokens and trial-use counter to provide and secure your account. Passwords are stored as salted, one-way scrypt hashes; we do not store or recover the original password. Verification codes are hashed and expire after ten minutes. Password reset requires an email verification code. Login sessions expire after seven days.
Payment and licence data
We process payment references, plan, PC ID, signed licence, delivery state and expiry to fulfil purchases and support activation. Square processes card details. Do not send card numbers or licence keys through the support chat. Our website does not need to store your full card number.
Search providers
Your search query is sent to Google Places to return business results. The portal does not persist these results or your search query in its database. Google handles requests under its own terms and privacy policy. Desktop integrations may send relevant data to providers that you configure.
Cookies and support
The portal uses an essential HttpOnly session cookie for sign-in, with Secure enabled in production. The FAQ support assistant runs locally in your browser tab and does not send your typed question to an AI provider. Email sent to support is processed to respond to your request. Non-essential analytics or advertising cookies must not be enabled without any consent required by law.
Purposes and rights
Account and purchase processing supports the requested service and contract; security and fraud controls support legitimate interests, subject to applicable law. Separate optional marketing requires an appropriate lawful basis and a way to opt out. Depending on applicable law you may request access, correction, erasure, restriction or portability, or object to processing. Contact sales@orbyco.com. UK users may complain to the ICO.
Retention and international processing
Keep account and licence records only as needed for service, disputes and legal obligations, then delete or anonymise them. Exact production retention periods, processor names, international transfer safeguards and the confirmed controller must be recorded before public launch. This policy is a pre-launch draft pending those operational details.