Privacy Policy

This Policy explains Orbit's processing on its websites, Dashboard, Discord application and bot, APIs, support and enabled product features. It covers people who use Orbit directly and Discord members or other people whose data is processed through a server feature without an Orbit account. The primary website is orbot.cloud; orbit.gamingforfun.de remains available as an additional domain.

For Orbit's own platform, account, security, commerce and support processing, the controller is GamingForFun, c/o Block Services, Stuttgarter Str. 106, 70736 Fellbach. General enquiries can be sent to system@gamingforfun.de; privacy requests and complaints can be sent to lord@gamingforfun.de. Correspondence addressed to GamingForFun at the stated postal address reaches the operator.

The privacy mailbox is a direct contact route and is not a statement that a statutory data protection officer has been appointed. If another controller is responsible for a particular server workflow, we will identify or assist that controller where reasonably possible.

Affected people can include account holders, server owners and staff, ordinary Discord members, moderated or reported people, support and appeal participants, developers, contributors, purchasers, survey or form participants, notification recipients, creators and public-site visitors.

We receive data from you, from authorised server administrators, from Discord and enabled identity, payment or public creator services, from modules and integrations, and from communications or uploads. We also generate permission decisions, activity summaries, model or rule results, technical records and audit evidence while operating Orbit.

Orbit determines purposes and means for platform-wide authentication, security, fraud prevention, service operation, billing records, system audit, platform safety and product administration. A Discord server operator generally determines the purpose of its server-specific moderation, logging, tickets, forms, automations and community rules.

Depending on the actual feature and decisions, Orbit may act as an independent controller, a processor for a server operator or, where the legal requirements are met, together with another party. Product labels do not replace that factual assessment. Server operators and external module providers remain responsible for processing they determine.

Identity and access data can include Discord and Orbit identifiers, display names, avatars, server relationships, linked providers, enrolled contact details where offered, authentication factors, session and API-credential metadata, IP address, user agent, permissions and account status. Discord sign-in does not require an email address from Discord.

Server and activity data can include server, channel, role and member identifiers; settings and permissions; commands and interactions; membership, progression, voice and activity summaries; automation results; delivery status; and audit history. Which records exist depends on the functions enabled for that server.

Content and case data can include messages, attachments, form and survey answers, tickets, support conversations, feedback, moderation reasons and evidence, internal notes, appeals, safety reports, decisions and corrections. Such content can mention other people or contain sensitive information, so only necessary material should be submitted.

Operational data can include timestamps, request and error references, logs, diagnostic copies, security events, rate-limit and capacity information, staff actions, reviews, approvals, delivery attempts, backups and recovery records. We exclude reusable secrets from ordinary diagnostic views where technically possible.

Where the relevant optional feature is enabled, data can also include plan and entitlement status, payment references, wallet and reward history, inventory, promotion use, developer packages and reviews, localization contributions, public creator metadata and notification history. Orbit does not normally receive full card numbers or card security codes.

We process data to create and secure accounts, provide requested features, execute authorised Discord actions, deliver purchases, handle support and appeals, maintain settings and records, and communicate about the service. Where the GDPR applies, processing objectively necessary for a contract with the affected person can rely on Article 6(1)(b).

We pursue legitimate interests under Article 6(1)(f) in keeping Orbit secure and reliable, preventing abuse and fraud, diagnosing failures, documenting authorised actions, defending legal claims, improving the service and protecting users and communities. We rely on this basis only after considering necessity, proportionality and the rights of affected people; a server installation alone does not justify every use of member data.

We process data under Article 6(1)(c) where necessary to meet a legal obligation. Where we ask for consent under Article 6(1)(a), it is voluntary for the stated purpose and can be withdrawn for future processing. Withdrawal does not affect processing already lawful before withdrawal.

Server operators need their own valid basis for the features and content they configure. Information about criminal allegations, health, identity or other sensitive matters requires particular necessity, access limits and, where applicable, an additional condition under Articles 9 or 10 GDPR. Do not submit such information merely because a field permits it.

Required identifiers, permissions and technical records are necessary to provide or protect the requested account or feature. If they are not provided, Orbit may be unable to authenticate the user, execute the action, investigate a failure or supply the purchase. Optional profile, survey, reward, wallet, shop and integration data is processed only when the corresponding function is available and used.

A server can use Orbit for moderation, logging, member profiles, progression, tickets, forms, surveys, notifications, creator updates, safety, modules and other configured functions. Some areas can be globally disabled or unavailable. A person can be included in records because of Discord activity even without an Orbit account.

Authorised server staff can see only the data allowed by their current server permissions and feature role. Member inventories, searches, profiles, notes, case history and analytics remain scoped to the relevant server unless a separate platform-safety purpose is clearly stated.

Event logging and analytics can process selected Discord events, metadata, message content where explicitly configured, activity counters and voice-state duration. Server operators must choose proportionate settings and inform members where required. Aggregate platform telemetry can be produced separately for reliability and capacity without using message bodies for those aggregates.

Globally hiding or disabling a feature normally stops or limits new use; it is not automatically an erasure request. Existing balances, purchases, cases, safety effects, audit records or Discord actions can remain until their own lifecycle, correction or deletion rule applies.

Orbit can retain observed server identifiers, names, ownership or management access and the observation time before the bot is installed. Authorised staff use these records to administer installation restrictions and assign individual installation recommendations; current access is checked before a recommendation is shown. Recommendation status, snoozing or dismissal, invitation steps, confirmed installation, sponsor-plan grants and notice acknowledgements support eligibility, fulfilment and prevention of duplicate rewards. These staff-selected recommendations do not use an automatic personal score.

Tickets, forms, support, moderation and appeals can retain the submitted content, attachments, participants, reasons, status, assignment, decisions, communications and history needed to handle the matter. Restricted staff notes and internal review material are not shown to ordinary participants unless disclosure is legally required.

Where enabled, Sentinel can combine serious cross-community reports, identity information, evidence, human decisions, appeals and enforcement history. Automated signals may prioritise or recommend handling, but active admission and consequential platform decisions require authorised human action. Public or subject-facing output excludes restricted evidence and internal deliberation.

Files can be stored separately from the database record through Orbit's configured storage or CDN. Access links can expire, and files can be checked, limited, quarantined or rejected. Deleting a source message, ticket channel or database reference does not necessarily delete a copy already held by Discord, an export recipient or another lawful recipient.

Case correction, closure, withdrawal, hiding or expiry changes the active status but does not necessarily erase the historical action, audit trail or evidence needed for accountability, security or legal claims. A deletion request is assessed separately under the rules in this Policy.

A form may be operated by Orbit or by a Discord server, including when staff prepare it on that server's behalf. Its operator and configured review boundary determine who can access submissions; an official mark alone does not make Orbit the operator of every form. Responses retain their original review scope if the form is later reassigned. A global Orbit form can be reviewed by authorised Orbit staff without a server association.

Orbit processes connection, session, request, error, performance and security data to operate the service, prevent abuse and diagnose failures. Where separately enabled, monitoring can record route and interaction events or a protected replay of interface activity. Optional analytics or replay is assessed separately from strictly necessary security and service records.

For serious fault analysis, bounded diagnostic copies of Discord events and attachments already received by the bot can be retained independently of a server's ordinary logging setting. Access is restricted to authorised staff for a reasoned and audited investigation. These copies are not automatically used for AI training.

Privileged reads and changes create internal accountability records. Server-facing history can use a neutral Orbit Staff attribution while the actual authorised actor remains available only to restricted audit functions. This protects staff privacy without removing internal accountability.

We use measures appropriate to the risk, including access controls, scoped permissions, secret protection, encryption in transit, validation, rate limits, tenant and module isolation, audit trails, backups, monitoring and incident response. No system is completely secure; we may revoke sessions, isolate services or restrict access while investigating an incident.

First-party page-performance traces can link normalised route names, timings, bounded operation names, request references and coarse browser or network characteristics to a keyed account pseudonym. Authorised staff use them to diagnose slow pages, with restricted and audited access to individual traces and expiry under the configured diagnostic retention window. These traces exclude form content, message content, full URLs and query values, cookies and reusable credentials; a pseudonym is not anonymity.

The outgoing-message safety check can block delivery or create an internal review record containing a limited redacted content preview, content fingerprint, destination identifiers, detected categories, delivery result and review history. Recurring findings may be grouped for authorised Orbit reviewers. These records are not a server-managed support queue, and automated classification does not make a suspicion a verified fact.

Where enabled, Orbit can use self-hosted models and deterministic rules to classify content, support moderation, select optional audiences or execute configured actions. Inputs can include text, image features, links, account or activity context and server rules. Scores are probabilistic signals and are not verified facts about a person.

Rules can delete content, assign or remove roles, apply warnings or restrictions, change progression and determine optional survey, reward or beta eligibility. These effects can change participation before human review. Server operators must assess the significance of their settings and provide an appropriate review route for consequential actions.

Audience profiles can combine permitted activity and account facts into explainable segments for optional surveys, rewards or beta access. They must not reduce purchased, base or ordinary permission rights. Individual profiles and cross-server insights are limited to specifically authorised platform staff; servers and modules receive only the decision needed for the feature.

Content is not placed into a training dataset merely because Orbit processed it. Bot-wide model training requires a separately authorised workflow, documented provenance and applicable sharing and retention conditions. People can request available information about significant automated effects and human review where Article 22 GDPR or another applicable rule provides that right.

If a real-money offering is enabled, Discord, Stripe or another identified payment provider processes payment details and sends Orbit the status and references needed to fulfil, reconcile and support the purchase. Disabling new sales does not itself delete transaction records or end an existing subscription.

If wallet, virtual currency, rewards, promotions or inventory are enabled, Orbit records balances, ledger entries, eligibility, grants, corrections, redemption and abuse-prevention data. Historical entries can remain to explain the balance and prevent duplicate or fraudulent use even when earning or redemption is later disabled.

Forms, surveys, feedback, developer and localization programmes process the submissions, drafts, answers, review status, attribution, rewards and audit information needed for the selected programme. Before participation, additional information can explain audience, confidentiality, publication, retention and reward conditions.

Developer participation records include the submitted contact information, application and team status, module submissions, review decisions and the version and time of an express agreement. Agreement evidence is kept to document the applicable relationship and resolve disputes, subject to the retention and rights rules below. A new edition is not recorded as accepted merely because an account already existed.

Depending on configuration, identity and selected content can appear in Discord messages, public level cards, published reviews, survey results, giveaway announcements, creator notifications, status pages or a limited safety projection. The relevant screen or server setting determines what is intended to be public; restricted evidence and internal notes are not included.

Dashboard and Discord notifications can contain account, purchase, security, support or server information and record delivery, read or dismissal state. Server administrators choose Discord destinations and must consider who can read them. Once information is delivered to Discord or exported to an authorised recipient, that recipient can hold a separate copy.

Orbit uses cookies and browser storage necessary for sign-in, security, load distribution, language or appearance preferences, short-lived return flows and requested interface state. Blocking necessary storage can prevent authentication or other requested functions.

Optional analytics, replay or similar non-essential device access is used only when enabled and after any consent required by law. A notice acknowledgement or use of an optional product feature is not treated as consent to unrelated tracking.

Orbit serves its primary domain orbot.cloud and the additional domain orbit.gamingforfun.de, including registered environment subdomains. Sign-in can return through a verified, short-lived handoff between those domains. Session cookies are bound to the receiving host; browser storage and passkeys associated with another domain are not automatically copied or transferred.

Data is available to authorised Orbit personnel according to their tasks and to authorised server staff or participants according to the relevant feature. Carefully selected providers can process data for hosting, storage and CDN, email, monitoring, security, support, status, payment and other infrastructure under the applicable arrangements.

Discord receives data needed for sign-in, server actions, messages and Discord purchases. Where enabled, Stripe or another checkout provider receives payment data; public creator services receive the requests needed for creator notifications; and approved modules or integrations receive only the data and capability needed for their declared function.

Other recipients can include people intentionally addressed by a public or Discord output, professional advisers, auditors, insurers, transaction partners and authorities where disclosure is necessary and legally permitted. We do not sell personal data as a standalone product.

Orbit hosts its own services in Germany and France, but Discord, payment providers and other enabled recipients can process data in countries outside the European Economic Area or permit remote access from those countries.

Where GDPR transfer rules apply, a transfer requires an applicable adequacy decision or appropriate safeguards such as standard contractual clauses and, where necessary, supplementary measures. Information about the relevant safeguard can be requested through the privacy contact, subject to protection of confidential terms.

We retain personal data only while needed for the stated purpose and then delete or anonymise it unless a legal duty, legitimate legal claim, security need or valid restriction requires longer storage. The period is determined by feature status, account or contract duration, configured retention, case lifecycle, statutory accounting duties, limitation periods and the interests of affected people.

Short-lived authentication, queue, export and diagnostic data is kept for the configured operational window and removed after expiry or completion. Account and configuration data normally remains while the account or server uses the service. Support, moderation, safety, audit and transaction records can remain after closure where needed to document decisions, protect people, prevent abuse or meet legal duties.

A global feature disablement, account closure, hiding an export, expiry of a warning, removal of a module or deletion of a Discord channel does not by itself erase every related record. We distinguish current state, history, deletion markers, independently delivered copies and backups. A valid erasure or correction is reapplied if a backup is restored.

Legal holds and exceptional preservation require a specific purpose, restricted access and later review. Technical immutability alone is not a reason for indefinite personal storage. Physical removal from storage or a CDN can follow access denial with a limited operational delay; recipients outside Orbit remain responsible for their own copies.

Where the GDPR applies and its conditions are met, you can request access and a copy, correction, erasure, restriction and portability. You can object for reasons relating to your situation to processing based on legitimate interests and object to direct marketing at any time. Consent can be withdrawn for the future.

Send a request to lord@gamingforfun.de. An Orbit account is not required. Provide only the identifiers and context needed to locate the data; never send passwords or access tokens. We may request proportionate verification and record the request, verification, correspondence and outcome.

The normal GDPR response period is one month and can be extended by up to two further months where legally permitted, with notice during the first month. Requests are normally free. Any refusal or charge must meet legal conditions and explain available complaint or judicial remedies. Product cooldowns and appeal limits do not replace these rights.

For server-specific processing, the server operator can be the correct first contact, and we will assist or redirect where responsibility can be identified. You may complain to a competent data protection authority, including in your habitual residence, workplace or the place of an alleged infringement, without first completing an Orbit product appeal.

Orbit is not directed to children below the age required for Discord in their country. Server operators should not use Orbit to request unnecessary data from children. If we learn of processing without a valid basis or required authorisation, we can restrict the feature and take appropriate deletion or preservation steps.

We update this Policy when features, providers, legal requirements or data practices materially change. The version and date identify the revision. Material changes are announced through an appropriate channel where required; a new text does not retroactively make earlier unlawful processing lawful.

Privacy questions and complaints can be sent to lord@gamingforfun.de or by post to GamingForFun, c/o Block Services, Stuttgarter Str. 106, 70736 Fellbach. We cooperate with lawful supervisory inquiries and can preserve relevant records while a complaint, security investigation or legal dispute is pending.