1. Controller and purposes
The controller is Support Global Goods s.r.o., company identification number (IČO) 21983330, Kojetínská 3157/55, Přerov I-Město, 750 02 Přerov, Czech Republic; support@theorbit.world. We process your name, date and optional time of birth, location, coordinates and time zone, selected gender, tarot inputs, language, email address and generated reading to prepare, provide access to and support the service. The legal bases are taking steps at your request and performing the contract. Providing your time of birth is optional. Payment and billing identifiers, countries, amounts, currencies and documents are used for payments, accounting and compliance with legal obligations. Consent records and proportionate diagnostic information are used for security and the protection of legitimate legal claims. Do not enter health information or third-party data.
2. AI and recipients
Selected personal inputs and calculated supporting data are processed automatically and passed to AI to generate the reading. Your email address and card details are not sent to the model that writes the reading. This does not involve decision-making about employment, credit, health or any other legally significant status. We use Lovable Cloud for operation and storage, Lovable AI Gateway and the encrypted (TLS) OpenAI API to generate readings, Lovable Emails for service emails, Stripe for payments and Zoho for support. Other contracted providers of these services, accountants and authorised authorities may receive data to the extent necessary. Stripe may act as an independent controller for its own statutory purposes. We do not claim that data never leaves the operator.
3. Retention, data protection officer and international processing
We retain customer data (reading data, email address, orders, consent records and communications with support) for 3 years from the last purchase or contact, for customer support and defence against payment disputes (chargebacks); we then erase or anonymise it. Accounting and tax documents are retained for the period required by law; OSS records are generally retained for ten years from the end of the year of the transaction. You may request earlier erasure at support@theorbit.world, unless a legal obligation or legitimate legal claim prevents this. No data protection officer (DPO) has been appointed, as this is not mandatory for the scale of our processing; personal data enquiries are handled directly by the controller’s managing director at support@theorbit.world. Inputs for readings are transmitted over an encrypted connection to OpenAI, which may also process data outside the EEA (particularly in the USA) on the basis of standard contractual clauses or the EU–US Data Privacy Framework. You have the right to lodge a complaint with the Czech Office for Personal Data Protection (uoou.gov.cz) or the supervisory authority in your country of residence.
4. Technical Storage and Communications
The website uses the local storage entry reading_id to allow you to return to your reading. This entry has no automatic expiration date; it remains until overwritten or until the browser’s storage is cleared. Deleting the entry does not delete the stored reading data. Your cookie choice is stored in the entry orbit_cookie_consent until you change it or clear the browser’s storage. Payment and security tools may use their own necessary storage under their own policies. Analytics and advertising tools that require consent are not activated without it. Service messages and ordered readings are distinct from marketing, which requires a separate lawful basis and an easy way to unsubscribe.
5. Your rights and security
Subject to the applicable conditions, you have the rights of access, rectification, erasure, restriction of processing and data portability, and the right to object to processing based on legitimate interests; you may withdraw consent. Send requests to support@theorbit.world. Your entitlement to make the request may be verified in a proportionate manner. Under the GDPR, we will normally respond within one month and will explain the reasons for any extension permitted by law; in the USA, the applicable state time limits and rights apply, including any right of appeal. You may lodge a complaint at https://uoou.gov.cz/ or with the relevant local supervisory authority. Mandatory records cannot be erased before the statutory retention period expires. We use appropriate protective measures; absolute security is not guaranteed. Consent to immediate delivery is not consent to marketing or to unrestricted processing of data.