OrbitalsTerms and Conditions

Legal · Privacy

Privacy Policy

v1·Last updated 16 July 2026

1. Introduction

This Privacy Policy explains how Venture Squad Limited ("Venture Squad", "we", "us") collects, uses, shares, and protects personal data when you use Orbitals, including our website, applications, and related services (together, the "Service"). It also explains the rights you have under data protection law and how you can exercise them.

You should read this Privacy Policy together with our Terms and Conditions ("Terms"). This Policy forms part of the Terms, and capitalised terms used here have the meaning given in the Terms.

2. Who is responsible for your data

Venture Squad Limited, a company incorporated in Gibraltar, is the data controller for personal data processed in connection with operating the Service, except where stated otherwise.

Orbital administrators may act as independent controllers or joint controllers for the personal data they collect and manage within their orbitals (for example, custom profile fields or application questions). We explain this shared responsibility in more detail in Section 8 (Orbitals, administrators, and shared responsibility).

3. What data we collect

We collect and process the following categories of personal data, depending on how you use the Service:

  1. Account data: email address, display name, authentication identifiers (including from third-party identity providers), password or login tokens.
  2. Profile data: information you provide about yourself within orbitals, including roles, interests, skills, and any custom profile fields set by administrators.
  3. Connection data: if you choose to connect a third-party account (see Section 9), the account identifier for that service and the specific data the connection provides (for example, roles or membership tiers).
  4. Usage data: activity logs, join/leave events, membership status, interactions with orbitals, preferences, device information, and approximate location derived from IP address.
  5. Content data: messages, posts, uploads, links, and other User Content you submit within orbitals.
  6. Support and communications data: enquiries, feedback, and support conversations.
  7. Technical data: IP address, browser type, operating system, timestamps, and other technical identifiers needed to provide and secure the Service.

We do not intend to collect special category (sensitive) data — such as data revealing health, religion, sexual orientation, or political opinions, biometric data, or criminal records — and ask that you do not submit such information through the Service. Orbital administrators are prohibited under our Terms (Section 6(13)) from requiring members to submit special category data or government identification documents as a condition of membership.

We do not currently process payment data. If we introduce paid plans, payments will be handled by a payment provider acting as merchant of record under its own terms and privacy policy, and we will update this Policy before those features launch.

4. Children

The Service is not intended for anyone under 16, and we do not knowingly collect personal data from children under 16. If we become aware that we hold such data, we will delete it. If you believe a child under 16 has provided us with personal data, please contact us using the details in Section 14.

5. How we obtain your data

We collect personal data in three main ways:

  1. Directly from you: when you create an account, join an orbital, update your profile, connect a third-party account, participate in communities, or contact us.
  2. From orbital administrators: when administrators invite you, approve membership applications, or configure required profile fields for their orbitals.
  3. Automatically: through cookies, similar technologies, and logs generated by your use of the Service (see Section 11 — Cookies and similar technologies).

If administrators import member lists or connect third-party accounts, we may receive information from those sources in order to provide the Service.

Under the Gibraltar GDPR, we must have a legal basis for each type of processing. We use the following:

  1. To provide and administer the Service — creating and managing accounts; enabling you to join orbitals; maintaining membership records; delivering core features. Legal basis: performance of a contract (Article 6(1)(b)) — necessary to provide the Service under the Terms.
  2. To operate orbitals and community features — displaying profiles to other members, supporting roles and permissions, enforcing membership rules, and enabling communication within orbitals. Legal basis: performance of a contract and legitimate interests (Article 6(1)(b) and 6(1)(f)) — running a community platform and enabling member interaction, balanced against your privacy interests.
  3. To secure and protect the Service — monitoring for abuse, enforcing the Acceptable Use rules in the Terms, preventing fraud and unauthorized access, enforcing bans, and responding to security incidents. Legal basis: legitimate interests, and legal obligation where required (Article 6(1)(f) and 6(1)(c)).
  4. To improve and develop the Service — analysing usage patterns, testing features, and optimizing performance, including limited aggregation and anonymisation of data for statistics. Legal basis: legitimate interests (Article 6(1)(f)) — improving a digital service used by our users, with appropriate safeguards.
  5. To communicate with you — sending service announcements, changes to the Terms or policies, security alerts, and responses to support requests. Legal basis: performance of a contract and legitimate interests — keeping you informed about important changes and updates.
  6. Optional communications and features — newsletters, product updates, or beta invitations that are not strictly necessary to use the Service. Legal basis: consent (Article 6(1)(a)); you can withdraw consent at any time.

We do not currently carry out automated decision-making that produces legal or similarly significant effects on you. If we introduce such processing (for example, decisions about access based mainly on automated analysis), we will explain the logic involved and your rights in a dedicated section of this Policy or in-product notices before it takes effect.

7. How long we keep your data

We keep personal data only as long as necessary for the purposes set out above, subject to legal and regulatory requirements.

Indicative retention periods:

  1. Account and basic profile data: kept for the life of your account. When you delete your account, we delete your profiles across all orbitals, subject to limited retention in backups and logs (typically up to 3 months).
  2. Orbital-specific profile data: deleted when you leave an orbital, as described in the Terms. If an orbital is deleted by its administrator, member profile data within that orbital is deleted.
  3. Moderation and ban records: if you are banned from an orbital or from the Service, we retain limited profile and activity data as necessary to enforce the ban and maintain moderation records. Legal basis: legitimate interests (Article 6(1)(f)) — keeping communities safe and preventing ban evasion.
  4. Content data (posts, messages): retained while you remain a member of the relevant orbital, and may persist as part of the community history unless deleted by you or the administrator.
  5. Connection data: deleted when you disconnect the third-party account; individual orbital grants are removed when you revoke them or leave the orbital.
  6. Security logs and access records: retained for up to 12 months to monitor for abuse, enforce bans, and maintain the security and integrity of the Service.
  7. Support communications: retained for up to 3 years for our records and to improve support, unless a longer period is needed in connection with an active legal claim or dispute.

8. Orbitals, administrators, and shared responsibility

Orbitals are communities created and operated by users. Within each orbital:

  1. Administrators decide which profile fields are required, which third-party connections are allowed or required, and what membership rules apply.
  2. Members choose what information to share about themselves and their activities.

In data protection terms:

  1. Venture Squad provides the platform and processes personal data to operate the Service.
  2. Administrators may act as independent controllers or joint controllers for personal data they collect or use to manage their communities (for example, vetting applications or exporting member lists).

Administrators must ensure their orbitals comply with applicable data protection law and with our Terms, including the Acceptable Use rules. Where Venture Squad and an administrator act as joint controllers, we determine our respective responsibilities in an arrangement, the essence of which is available on request. Where responsibility is shared, we will work with administrators to respond to data subject requests and to maintain appropriate safeguards.

9. Sharing your data

We share personal data only as necessary to operate the Service, comply with law, or with your consent. We may share data with:

  1. Other members of your orbitals: profile information and content you choose to share will be visible to applicable members, according to the settings of each orbital.
  2. Service providers: trusted third-party processors who help us host the Service, send emails, provide analytics, or secure the platform (for example, hosting providers, email infrastructure, and monitoring tools).
  3. Third-party connections: you may optionally connect external accounts (such as Discord, Patreon, SoundCloud, or Spotify). We store connection credentials securely and access only the data needed for the feature (for example, roles or membership tiers). A connection is shared with a specific orbital only when you grant it for that orbital, and you can revoke a connection or an individual grant at any time in your settings. An orbital administrator may make a connection a condition of membership in their orbital; whether to join on those terms is your choice. Data exchanged with a third-party service is also subject to that service's own terms and privacy policy.
  4. Legal and regulatory authorities: where we are required to do so by law, or where necessary to protect our rights, our users, or the Service.

We do not sell your personal data to third parties for their own marketing purposes.

When using processors, we enter into data processing agreements that require them to protect your personal data and only use it according to our instructions.

10. International transfers

Orbitals is a global platform. This may involve transferring your personal data outside Gibraltar, the United Kingdom, or the European Economic Area.

Where we transfer personal data internationally, we will rely on adequacy decisions where available (including Gibraltar's adequacy arrangements), or use appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms. You can contact us for details of specific transfers and safeguards relevant to your data.

11. Cookies and similar technologies

We use cookies and similar technologies to:

  1. keep you logged in and maintain session security;
  2. remember your preferences;
  3. measure and improve how the Service is used.

Where required by law, we will obtain your consent for non-essential cookies and provide you with controls to manage your choices. Our separate Cookie Policy provides more detail.

12. Your rights

Under the Gibraltar GDPR, you have the following rights in relation to your personal data:

  1. Right of access — to receive a copy of your personal data.
  2. Right to rectification — to correct inaccurate or incomplete data.
  3. Right to erasure ("right to be forgotten") — to request deletion of your data in certain circumstances.
  4. Right to restriction of processing — to limit how we use your data.
  5. Right to data portability — to receive your data in a structured, commonly used, machine-readable format.
  6. Right to object — to certain processing, including processing based on legitimate interests or for direct marketing.
  7. Rights relating to automated decision-making and profiling, where applicable.

You can exercise these rights by contacting us using the details in Section 14. We may need to verify your identity and, where applicable, coordinate with orbital administrators to fulfil your request. Where consent is the legal basis for processing, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

If you are not satisfied with our response, you have the right to lodge a complaint with the Gibraltar Regulatory Authority or another competent supervisory authority.

13. Security

We take appropriate technical and organisational measures to protect personal data against loss, misuse, and unauthorised access, disclosure, alteration, and destruction. These measures include access controls, encryption in transit, secure storage of connection credentials, regular backups, and monitoring for abuse.

No online service can be completely secure, but we aim to keep risk proportionate to the nature of the data and the Service.

14. Contact and data protection queries

If you have questions about this Privacy Policy or wish to exercise your rights, you can contact us at:

If we appoint a Data Protection Officer or local privacy representative, we will add their contact details here.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example to reflect changes to the Service or to applicable law. We will provide reasonable notice of material changes, such as by updating the date at the top of this page and, where appropriate, notifying you within the Service or by email.