Privacy Policy

This English translation is provided for convenience. In case of any conflict or inconsistency between the English and the German version, the German version prevails.

Controller: Building Brands LLC, 575 Rockwell Rd
Cincinnati, OH 45238
USA, email hello@orbiq.studio.

1. What this is about

Orbiq is software for online retailers (“customers”) that analyzes the advertising and sales data of their own store. In doing so, we process two kinds of data: data about our customers (account, billing) and data that our customers have us process about their store visitors and buyers. For the latter, the customer is the controller within the meaning of the GDPR and we are the processor (Art. 28 GDPR). A data processing agreement is part of the Terms of Service (DPA annex) and is provided as a signed document on request.

2. Customer account

When you sign up, we store your company, name, email address, a password (as a hash only), the selected plan, discount code, and the time of sign-up and of sign-ins (session token, 90 days). Legal basis: performance of a contract (Art. 6(1)(b) GDPR). We keep billing records for 10 years in accordance with tax regulations.

3. Data processed on behalf of the customer

Through the connections set up by the customer, we process: order data from Shopify (order number, time, amounts, products, discount codes, customer number, email address as a SHA-256 hash only, country), visit data from the tracking script (own visitor ID in the first-party cookie _stb_vid, page views, click IDs such as fbclid/gclid, UTM parameters, referrer, truncated IP used only for geolocation and not stored), advertising data from Meta Ads, Google Ads and Klaviyo (campaigns, ads, costs, clicks, email clicks), and cost and price data the customer enters themselves. No real names, no addresses, no payment data of store buyers.

Optional, and only if the customer explicitly enables it: transmission of purchase events to Meta (Conversions API) with hashed email, click ID and order value – the customer is the controller for this; Meta acts as an independent controller.

4. AI features

In the AI Studio, the brand profile, ad copy, metrics, comments and images uploaded by the customer are transmitted to Anthropic (Claude) or OpenAI (images) to generate scripts and images. According to their API terms, these providers do not use the data for training. Personal data of store buyers is not transmitted in the process.

5. Hosting and sub-processors

Hosting: Cloudflare, Inc. (USA/EU) – database and application in the EU region where available. Further sub-processors: Anthropic PBC (USA), OpenAI LLC (USA) – each only for AI features; GitHub (deployment of the software); Resend (sending system emails). Transfers to the USA are based on the EU-U.S. Data Privacy Framework or the EU Standard Contractual Clauses.

6. Cookies

The application itself only sets technically necessary cookies (sign-in). The tracking script in the customer’s store sets one first-party cookie with a random visitor ID (12 months) and no third-party cookies. Whether consent is obtained for this is decided by the customer, who is responsible for it as part of their store.

7. Retention

We store store and advertising data for the duration of the contract; 30 days after the contract ends, the workspace and database are deleted, or earlier on request. Visit data without an order is deleted after 13 months.

8. Rights of data subjects

Access, rectification, erasure, restriction, data portability, objection, and complaint to a supervisory authority – by email to hello@orbiq.studio. We forward requests from store buyers to the respective customer or support the customer in answering them.

9. Changes

Last updated: October 2026. We update this policy when features or the legal situation change.