Privacy Policy

Phaeros Inc. (“Phaeros,” “we,” “us,” or “our”) operates Orbit, a fan rewards service that helps artists, labels, and other participating organizations reward and understand their most committed fans.

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you use Orbit, visit our website, or interact with us.

Shopify does not operate, provide, or support Orbit. When a participating organization connects a Shopify store to Orbit, Orbit accesses and processes certain Shopify store information as described below.

1Who this Privacy Policy applies to

This Privacy Policy applies to:

• fans who participate in an Orbit-powered rewards program;
• people who create or use an Orbit account;
• employees, representatives, and other authorized users of participating organizations;
• visitors to our website; and
• people who contact us for support or other inquiries.

A participating organization may have its own privacy policy governing how it collects and uses information about its customers, fans, or other individuals. Where applicable, that organization remains responsible for its own processing activities and its relationship with those individuals.

Depending on the activity and applicable law, Phaeros may process personal information for its own purposes, on behalf of a participating organization, or both. The specific roles and responsibilities of Phaeros and the participating organization may also be addressed in our customer agreements or data-processing terms.

2Information we collect

Orbit account information

When you create or use an Orbit account, we may collect:

• name;
• email address;
• Orbit account ID;
• account creation and authentication information;
• profile information you provide; and
• account activity and security information.

If you sign in using Google, Google may provide us with your name, email address, Google account identifier, and basic profile information needed for authentication. We do not receive your Google password.

Rewards and program information

When you participate in an Orbit-powered rewards program, we may collect and generate information such as:

• your participation in a program;
• reward ledger entries and balances;
• reward tier or progress information;
• qualifying activities;
• rewards and redemptions;
• refund or reversal activity; and
• information needed to investigate fraud, abuse, or account issues.

Shopify-connected store information

When a participating organization connects Shopify to Orbit, Orbit processes only the minimum Shopify customer, order, product, and store information reasonably required to operate the applicable Orbit service.

This processing may include information needed for:

• purchase attribution;
• rewards calculation and ledger administration;
• refund and reversal handling;
• Shopify privacy requests;
• security and fraud prevention;
• troubleshooting and operational support; and
• related Orbit services.

Orbit does not create, modify, or delete Shopify customer, order, product, or merchant data.

Orbit retains minimized commerce records derived from Shopify that are needed to operate the rewards service, which may include:

• store and order identifiers;
• order number;
• currency;
• eligible merchandise value;
• reward points associated with qualifying purchases;
• refund or reversal information; and
• purchase-attribution outcome.

Orbit does not retain customer addresses, phone numbers, payment details, or shipping details for operating the rewards program.

Where a Shopify customer email is needed to check whether a purchase can be attributed to a verified Orbit fan account, Orbit may temporarily use the raw Shopify customer email for that matching process.

Orbit does not retain the raw Shopify customer email in its Orbit commerce records for this purpose. Where required for attribution, Orbit uses a normalized, protected representation to perform the comparison against the verified Orbit fan account.

Orbit does not use a person’s name, phone number, physical address, or fuzzy matching to attribute purchases.

Orbit uses Shopify’s final eligible line-item amounts as the source of truth for rewards and does not independently recalculate Shopify discounts.

Orbit does not need or process payment-card information to operate the service and does not process the underlying purchase or refund.

Artist-label relationship information

When an artist accepts an invitation from a label or other participating organization, Orbit stores the artist’s verified Orbit account email as a contact email snapshot on that artist-label relationship.

Authorized members of the active label workspace may access this relationship-level contact information for purposes of administering the artist-label relationship.

The contact email snapshot is associated with the accepted artist-label relationship rather than maintained as an independent label-owned contact record.

If the artist-label relationship ends, the relationship-level contact email snapshot is removed.

If the relevant artist account is later erased, the associated relationship-level contact email snapshot is also removed.

If an artist invitation expires or is cancelled before acceptance, the invitation email is removed and no artist contact record is created for the label.

Website, device, and support information

When you visit our website or use Orbit, we may automatically collect information such as:

• IP address;
• browser and device type;
• operating system;
• pages and features accessed;
• approximate location derived from IP address;
• authentication and security events;
• cookie and similar technology information; and
• other technical information necessary to operate and secure the service.

If you contact us, we may collect the information you provide, such as your name, email address, organization, and the contents of your inquiry.

3How we use information

We use personal information to:

• create and authenticate Orbit accounts;
• operate fan rewards programs;
• calculate and maintain reward balances and qualifying activity;
• attribute eligible purchases to verified Orbit fan accounts;
• process redemptions and account activity;
• process purchase refunds, cancellations, reversals, and related adjustments;
• process applicable Shopify privacy requests;
• provide customer and technical support;
• detect and prevent fraud, abuse, and unauthorized activity;
• maintain, secure, test, and improve Orbit;
• communicate with users about their accounts and the service;
• comply with legal and regulatory requirements;
• enforce our agreements and policies; and
• protect our rights, users, participating organizations, and the security of our systems.

We do not sell personal information.

We do not use Shopify-derived personal information for advertising or unrelated marketing.

We do not use personal information collected through Orbit to train general-purpose AI models.

4How rewards information is associated with purchases

Orbit uses information from connected Shopify stores to determine whether an eligible purchase can be attributed to a verified Orbit fan account.

Purchase attribution is based only on the information required to make that match. Orbit does not use name, phone number, physical address, or fuzzy matching for this purpose.

Where a Shopify customer email is required for attribution, the raw email may be used temporarily for the matching process. Orbit does not retain the raw Shopify customer email in its commerce records for this purpose.

If an attributed purchase is subsequently refunded or otherwise reversed, Orbit may use the corresponding minimized commerce information to make the appropriate adjustment to the rewards ledger.

Detailed reward rules, including eligibility requirements, reward rates, tiers, redemption rules, expiration, and program-specific conditions, may be described separately in the applicable program terms or rules.

5Information shared with participating organizations

When you participate in an Orbit-powered program, the participating artist, label, or other organization may receive limited information needed to administer its program and understand fan participation.

Depending on the program and the organization’s permissions, this may include:

• an Orbit-specific or pseudonymous fan reference;
• participation status;
• reward balance or tier information;
• qualifying activity;
• reward and redemption activity; and
• other limited program information needed to administer the fan relationship.

Participating organizations do not receive Shopify customer information through the Orbit dashboard, including:

• Shopify customer email addresses;
• phone numbers;
• physical addresses;
• payment information; or
• shipping information.

Participating organizations also do not receive Shopify customer information simply because a purchase has been attributed to an Orbit fan account.

Your Orbit email address is not, by itself, marketing permission for a participating organization.

Where an artist accepts a label invitation, authorized members of the active label workspace may access the artist’s verified Orbit email stored as a contact email snapshot on that artist-label relationship.

Where a label manages multiple associated artists, access is limited according to the organization’s relationship with those artists and the permissions provided by Orbit.

Orbit may provide aggregated information about audience overlap across associated artists, such as the number or percentage of fans shared between programs, without exposing an individual fan’s cross-artist identity or relationship.

6Service providers and other disclosures

We may disclose personal information to service providers that help us operate Orbit, such as providers supporting:

• hosting and infrastructure;
• authentication;
• security and monitoring;
• communications;
• analytics;
• customer support;
• data storage and processing; and
• other technical or operational services.

These providers receive information only as reasonably necessary to provide services to us and are subject to appropriate contractual or other safeguards where required.

We may also disclose information:

• when required by law, regulation, legal process, or governmental request;
• when necessary to protect the rights, property, or safety of Phaeros, Orbit users, participating organizations, or others;
• to enforce our agreements or policies;
• in connection with a merger, acquisition, financing, restructuring, sale of assets, or similar corporate transaction; or
• with your direction or where otherwise permitted by applicable law.

7Shopify uninstall, disconnection, and privacy requests

Shopify disconnection

If a participating organization disconnects its Shopify store from Orbit, Orbit will stop receiving new Shopify-derived purchase information from that connection.

Disconnecting Shopify does not automatically delete the organization’s Orbit account, fan accounts, points balance, or every existing rewards or commerce record.

Information may continue to be retained where necessary for account or reward history, refund handling, dispute resolution, privacy requests, security, legal obligations, or other legitimate purposes described in this Privacy Policy and our Data Retention Policy.

Shopify privacy requests

Shopify customer and merchant privacy requests are handled separately from general Orbit account deletion.

Where applicable, Phaeros processes Shopify’s mandatory privacy requests through Shopify’s designated mechanisms, including:

• customers/data_request;
• customers/redact; and
• shop/redact.

When a Shopify customer privacy request requires removal or deidentification of Shopify-derived information, Orbit removes or deidentifies the applicable information in accordance with the request and applicable requirements.

This may include applicable customer, order, refund, attribution, installation, webhook, or related Shopify-derived information.

Where necessary to maintain the integrity of the rewards ledger, a remaining reward effect may be addressed through a compensating ledger entry, with related historical information deidentified where appropriate.

An independent Orbit account may remain active where it can continue to operate without the removed Shopify-derived information.

Shopify uninstall or shop deletion

Where Shopify requires Orbit to delete or remove information following an uninstall, shop deletion request, or other applicable Shopify data lifecycle event, Orbit will delete or deidentify the applicable Shopify-derived information in accordance with its deletion procedures and applicable requirements.

This may include removal of Shopify connection credentials, store information, catalogue information, order information, refund information, webhook data, privacy export files, and related records, subject to information that we are permitted or required to retain.

8Program termination

If a participating organization terminates an Orbit rewards program, the program may enter a wind-down period.

During the wind-down period, no new Shopify-derived purchase activity will be added to the program. Existing rewards may remain available for redemption during the applicable wind-down period.

After the wind-down period ends, the program will close and redemption will no longer be available.

Additional program-termination rules may be provided in the applicable customer or program terms.

9Orbit account deletion and retention

Orbit account deletion is currently a verified, support-assisted process. Orbit does not currently provide a fully automated self-service account-deletion process.

To request deletion of an Orbit account, contact Phaeros through the privacy contact information below. We may verify your identity and review relevant workspace ownership, access, reward, transaction, and other data-retention considerations before processing the request.

Deleting an Orbit account ends access to the applicable Orbit account, points, rewards, and program participation, subject to information that Phaeros is required or permitted to retain.

Deleting an Orbit account does not necessarily result in the immediate deletion of every associated record. Certain information may need to be retained for legal, accounting, security, fraud-prevention, dispute-resolution, audit, or other permitted purposes.

Where retained information is no longer required in identifiable form, Phaeros will delete or deidentify it in accordance with its retention procedures.

A later Orbit account is treated as a new account and does not automatically restore a previously deleted points balance or rewards history.

For specific retention periods, see the Orbit Data Retention Policy.

10Your privacy choices and rights

Depending on where you live and applicable law, you may have rights to:

• request access to personal information we hold about you;
• request correction of inaccurate information;
• request deletion of personal information;
• request information about how your information is processed;
• withdraw consent where processing is based on consent;
• object to or request restriction of certain processing; and
• request portability of certain information.

To protect privacy and account security, we may need to verify your identity before completing a request.

If your information is being processed by Orbit on behalf of a participating organization, we may direct you to that organization or work with it to respond to your request.

Deleting information may affect your ability to use an Orbit account or participate in a rewards program, and certain information may need to be retained where permitted or required by law.

To make a privacy request or request Orbit account deletion, contact:

Phaeros Inc.

Email: hello@phaeros.co

Subject: Privacy Request

11International processing

Phaeros and our service providers may process and store personal information in Canada, the United States, and other jurisdictions where we or our service providers operate.

Where personal information is transferred across borders, applicable laws may permit courts, regulators, law enforcement, or other governmental authorities in those jurisdictions to access information in accordance with applicable law.

We use contractual, organizational, technical, or other safeguards where required by applicable privacy law.

12Cookies and similar technologies

Orbit and our website may use cookies and similar technologies for purposes such as:

• authentication and session management;
• security;
• remembering preferences;
• understanding service usage; and
• improving website and service performance.

You may be able to control cookies through your browser or device settings. Where required by applicable law, we may also provide additional cookie or preference controls.

13Children

Orbit is not intended for children below the minimum age permitted for use of the service in the applicable jurisdiction.

We do not knowingly collect personal information from children in circumstances where doing so would violate applicable law.

If you believe a child has provided personal information to us inappropriately, please contact us so that we can investigate and take appropriate action.

14Security

We use administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, use, alteration, disclosure, or destruction.

These measures may include access controls, authentication and security controls, encryption, monitoring, logging, and procedures designed to limit access to information based on operational need.

Orbit maintains audit records relating to access to protected Shopify customer data for security and accountability purposes. These records are subject to periodic review and are retained according to the Orbit Data Retention Policy.

No system or method of transmitting or storing information can be guaranteed to be completely secure.

For a suspected vulnerability or security incident, use the Security / Incident Contact process.

15Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to Orbit, our practices, applicable law, or other operational requirements.

When we make material changes, we may provide notice through Orbit, our website, or other appropriate means.

The “Last updated” date at the beginning of this Privacy Policy indicates when it was most recently revised.

16Contact us

If you have questions about this Privacy Policy or our privacy practices, contact:

Phaeros Inc.

Email: hello@phaeros.co

For privacy requests or Orbit account deletion requests, please use the subject line “Privacy Request.”

For a suspected vulnerability or security incident, use the Security / Incident Contact process.