OrbitFlow Privacy Policy

OrbitFlow Pro Privacy Policy

Last updated: 10 Aug 2026

Scope
This Privacy Policy describes how the OrbitFlow Pro Chrome extension and related services (“OrbitFlow”, “we”, “us”) collect, use, store, share, and secure user data. It applies to the OrbitFlow Pro extension distributed through the Chrome Web Store and to services hosted at Dustprints.com. This policy supplements any site‑wide privacy policy and applies specifically to extension behavior and in‑product disclosures.

Summary of key points
– We collect only the data necessary to provide extension features you enable (sign‑in, licensing, marketplace, and optional support features).
– Most runtime data and flow logs remain on your device by default; we only transmit data you explicitly approve (for example, when you submit a support report or choose to upload a screenshot).
– We do not sell personal data or share it with advertising networks.

Data we collect, how we collect it, and whether we share it
Below we list each category of data, how it is collected, how we use it, where it is stored, typical retention periods, and the parties with whom it may be shared.

– Account data (email address, display name)
– Collected: when you voluntarily create an account or sign in via OAuth.
– Use: authenticate users, tie licenses/subscriptions to accounts, communicate account notices.
– Storage & retention: stored on our servers while your account is active; retained up to 12 months after account deletion for fraud prevention and legal obligations unless a longer retention is required by law.
– Shared with: authentication provider (e.g., Google Identity) and payment processor when you purchase a license.

– Authentication tokens & credentials
– Collected: when you sign in with OAuth or provide credentials for license activation.
– Use: session authentication and license validation.
– Storage & retention: tokens are stored encrypted and are short‑lived; refresh tokens (if any) are stored securely and revoked on sign‑out.
– Shared with: authentication provider only (e.g., Google Identity) under contract.

– Device identifier and license metadata
– Collected: pseudonymous device ID generated locally to link subscriptions and prevent abuse.
– Use: license enforcement, reconnection, fraud detection.
– Storage & retention: stored locally and on our servers while your license is active; retained up to 12 months after license expiry unless you request deletion.
– Shared with: none except internal systems and necessary service providers (hosting, license manager).

– License data (license key, plan tier, purchase metadata)
– Collected: when you purchase or activate a license.
– Use: enable paid features and manage entitlements.
– Storage & retention: stored server‑side for the life of the subscription and taxable recordkeeping periods (typically up to 7 years for payment records).
– Shared with: payment processor (e.g., Stripe, PayPal) and hosting provider as needed to process payments and maintain records.

– Marketplace metadata (install key, installed flow IDs)
– Collected: when you browse, install, or sync marketplace items.
– Use: provide your installed flows, synchronize your library across devices, and enable marketplace features you request.
– Storage & retention: stored server‑side while you maintain an account or explicit marketplace sync; removable on request.
– Shared with: marketplace hosting provider and any 3rd‑party publisher only to deliver the marketplace item, with your consent.

– Local runtime logs and flow metadata
– Collected: generated locally while flows run in your browser (status codes, timestamps, non‑sensitive metadata).
– Use: improve reliability, let you retry failed runs, and diagnose problems.
– Storage & retention: kept locally by default in chrome.storage. They are not uploaded or transmitted unless you explicitly choose to share them (for example, sending a support report).
– Shared with: only when you opt in to share logs with support; then logs are transmitted to our support provider for troubleshooting.

– Cookies and browser local storage
– Collected: used locally by the extension to maintain session state, preferences, and optional snapshot/restore features.
– Use: session continuity, user preferences, and local flow snapshots.
– Storage & retention: stored locally; not shared externally.

– Screenshots, screen captures, and downloads
– Collected: only when you explicitly request or consent (for example, you choose “Save screenshot” or enable screen capture for a flow).
– Use: saved files are provided to you; screenshots may be included in support reports only with your explicit consent.
– Storage & retention: saved locally by default. If you choose to upload or share a screenshot, it will be transmitted only to the destination you select or to our support provider under your consent. Uploaded screenshots are retained only as needed to resolve the request and then deleted on request.

What we do NOT collect
– We do not collect background web browsing history, the contents of web pages you visit, keystrokes, precise geolocation, microphone or camera streams, or other telemetry unless you explicitly initiate an action that captures such data and directly consent to it.
– We do not sell personal data or share it with advertising networks.

How we use data
– Provide core functionality: sign‑in, license activation, marketplace delivery, and flow execution.
– Support and troubleshooting: with your consent we may collect logs, screenshots, or other debug information to diagnose issues.
– Compliance and safety: to detect and prevent abuse, respond to legal requests, and enforce our terms.

Parties with whom we share data
We only share user data with the parties necessary to provide the service. Categories of recipients include:
– Authentication providers (e.g., Google Identity) — to authenticate users when you sign in via OAuth.
– Payment processors (e.g., Stripe, PayPal) — to process purchases and chargebacks. Payment processors receive only the transaction information necessary to process your payment; full payment card data is handled directly by the payment processor and is not stored on our servers.
– Hosting and infrastructure providers (e.g., AWS, Cloudflare) — to host servers and store account records.
– Email and communication providers (e.g., SendGrid, Mailgun) — to send transactional emails such as license receipts and account notices.
– Support and bug‑tracking providers (e.g., Zendesk, Sentry) — only with your consent when you submit support requests or error reports.
– Legal and compliance recipients — to comply with laws or enforce terms when required.
We require all third‑party service providers to process data under contract and to use appropriate security measures.

Prominent disclosure inside the extension
Before collecting or accessing sensitive data, the extension will display clear, prominent in‑product disclosures and request consent. Examples:
– Screen capture / screenshots: you will see a disclosure and must explicitly confirm before we call `captureVisibleTab` or similar APIs.
– Content script injection / page data access: we will disclose what page content will be accessed and why before injecting scripts.
– Native messaging helper: enabling `com.orbitflow.mouse` will show a disclosure describing the helper’s function and the data it may access.
These prominent disclosures satisfy Chrome Web Store requirements and appear at the moment the sensitive action is requested.

Data retention and deletion
– Local data: extension settings, saved flows, and runtime logs remain on your device until you clear them or uninstall the extension.
– Account/server data: account records and license metadata are retained while your account is active and for typical legal/financial retention periods (e.g., payment records up to 7 years). You can request deletion of your account and personal data by emailing support@dustprints.com. We will respond and take action in accordance with applicable law; some minimal records may be retained for legal compliance.

Security
– We use HTTPS/TLS for all server communication. Sensitive values (tokens, keys) are stored encrypted at rest. Access to production systems is restricted to authorized personnel.
– While we use reasonable technical and organizational measures to protect data, no system is perfectly secure. If you believe your data has been compromised, contact us immediately at support@dustprints.com.

International data transfers
User data may be processed or stored in countries other than your country of residence (for example on hosting providers’ servers). When we transfer data internationally we use lawful transfer mechanisms and require providers to implement safeguards.

User rights and choices
– Opt‑out & revoke consent: you can revoke optional consents (e.g., support log uploads, screenshots) from within the extension UI or by uninstalling the extension.
– Access, correction, deletion: email support@dustprints.com with the subject line “Data Request” and include the email address associated with your account. We will verify your request and respond according to applicable law.
– Data portability: where applicable, we will provide a machine‑readable export of account data upon request.

Children’s privacy
OrbitFlow Pro is not directed to children under 13. We do not knowingly collect personal data from children under 13. If you believe we have collected such data, contact us and we will delete it.

Changes to this policy
We may update this Privacy Policy. We will publish the revised policy with an updated “Last updated” date. Significant changes that affect data sharing or collection practices will be highlighted in the extension UI or via email when feasible.

Contact
If you have questions or data requests, contact us:
– Email: support@dustprints.com
– Postal address: Maholiya Shivpar, Hardoi, Uttar Pradesh, India

Effective date: 10 Aug 2026