Privacy Policy

OrbitLayer is a web and app development studio based in Gurugram, Haryana, India (Delhi NCR), operating the website https://orbitlayer.in. We design and build websites, web applications and mobile apps, and we offer UI/UX design, e-commerce development and SEO services. We also publish free concept and demo sites (our concept builds) purely to showcase our work.

We decide why and how your personal data is processed and are responsible for it as the data fiduciary (data controller). This policy explains what personal data we collect through our website, forms and WhatsApp enquiries, why we collect it, and the rights you have over it.

Our free concept and demo sites are published for display and illustration only. They contain no enquiry or signup forms and are not used to collect personal data from visitors; like any hosted page, they may generate standard server logs (including IP address) when loaded. You can reach us at any time at hello@orbitlayer.in or on +91 83681 19569.

We collect only the data we need to respond to you and run our services:

• Contact form: your name, email address, phone number and the message you write to us.
• Quote or estimate form: your name, email address, phone number, budget range, project timeline and the project details you provide (this free-text field may include information about your own business).
• Newsletter signup: your email address, and your name if you choose to give it.
• WhatsApp click-to-chat: your WhatsApp number, the content of your message and anything else you choose to share in the chat.
• Server logs, cookies and website analytics: your IP address, device and browser type, the pages you view, the page that referred you, timestamps and cookie or identifier data.
• Internal admin login (staff only): we operate a staff-only admin login to manage the website, leads and projects. This is not collected from public visitors and is described here only for transparency. Staff admin credentials, including passwords, are treated as sensitive personal information and are protected accordingly under the SPDI Rules.

We collect personal data in two ways. First, directly from you, when you fill in our contact or quote form, subscribe to our newsletter, or start a WhatsApp conversation with us. Second, automatically, through server logs, cookies and analytics scripts that run when you load our website.

Wherever we collect data on the basis of your consent, we show you a clear, plain-language notice at the point of collection so you know what you are providing and why before you submit it. We obtain your consent by a clear affirmative action, for example by you ticking an unticked box or submitting a form after reading this notice. We do not use pre-ticked boxes and we do not bundle unrelated consents together.

We use your personal data only for the specific purposes for which you gave it:

• To respond to your enquiries and provide the information about our services that you ask for (contact form and WhatsApp chats).
• To prepare and send you an estimate or proposal and to scope a possible project (quote form).
• To send you newsletters, updates and marketing content that you specifically opted into (newsletter signup).
• To operate, secure and improve our website, prevent abuse, and understand how the site is used (server logs, cookies and analytics).

Our website uses two kinds of cookies. Strictly necessary and operational cookies, along with basic server logs, are essential to make the site work and keep it secure; these are always active. Non-essential analytics cookies, which help us measure traffic and understand usage, are set only on the basis of your consent.

When you first visit, our cookie consent banner lets you accept or decline non-essential cookies, and you can change your choice at any time through the banner or preferences control, or by adjusting your browser settings. Declining non-essential cookies will not stop you using the core parts of the site.

Our website analytics tool captures information such as your IP address, device and browser type, the pages you view and the page that referred you; we treat your IP address as personal data. Analytics data is retained for the period configured in our analytics tool, and cookies expire according to their stated lifespans. If you would like the current list of the specific analytics, email and content-delivery providers we use, you can request it from us at hello@orbitlayer.in.

We do not sell your personal data. We share it only with trusted service providers who process it on our instructions to help us operate. These are:

• Amazon Web Services (AWS): hosting and storage of our website and data in the Mumbai (ap-south-1) region.
• Our company mail provider: delivery of contact enquiries, quotes and any replies, and transactional email.
• Meta Platforms and WhatsApp: carrying and processing WhatsApp click-to-chat conversations.
• Our website analytics tool: measuring and analysing how the site is used.
• Any content-delivery, DNS or proxy provider that serves or fronts our website: where such a provider proxies traffic, it may process visitor IP addresses and request data solely to deliver and protect our website.

Your personal data is primarily stored within India, on AWS in the Mumbai (ap-south-1) region. Some of our sub-processors, for example Meta and WhatsApp, our analytics tool and our mail provider, may process certain data outside India.

We do not transfer your data to any jurisdiction restricted by the Government of India. Where any sensitive personal data is involved, we apply the safeguards required by the Information Technology Act, 2000 and the SPDI Rules, 2011, which are currently in force. We also align our cross-border practices with the Digital Personal Data Protection Act, 2023, which we honour as and when its provisions come into effect.

We maintain reasonable security practices to protect your data, including access controls, our staff-only admin login, encryption of data in transit, encryption at rest provided by AWS, and infrastructure-level controls provided by AWS. While we take security seriously, no method of transmission or storage over the internet is perfectly secure, and we cannot guarantee absolute security.

If we become aware of a personal data breach affecting your personal data, we will notify you without undue delay. Our notification will describe the nature of the breach, the data affected, the likely consequences, the measures we have taken or propose to take to mitigate it, and how you can protect yourself, together with a contact point for more information.

Where required, we will also report the breach to the Data Protection Board of India, providing an initial intimation without delay and a detailed report within the timelines set under applicable law.

We keep personal data only for as long as it is needed for the purpose it was collected, after which we erase or anonymise it. The indicative periods below are our working defaults:

• Active enquiries and quote requests: kept while the conversation is live and for a limited follow-up window.
• Unconverted leads: cleared or anonymised after 12 to 24 months of dormancy if a prospect does not become a client.
• Client data: where you become a client, your data moves into the client relationship and is kept for as long as that relationship and our records require.
• Newsletter data: kept until you unsubscribe or withdraw consent, after which we suppress or delete it; we periodically clean up inactive subscribers.
• Server logs: retained for a limited security and operational window of around 90 days, then rotated and purged.
• Legal, tax, accounting or dispute-resolution records: retained for longer only where we are required to do so by law.

You have the following rights over your personal data, which we honour in line with the Digital Personal Data Protection Act, 2023 as its provisions come into force, and with current Indian law:

• Right to access: you can ask for a summary of the personal data we hold about you, the processing we carry out, and the identities of any other data fiduciaries or processors with whom we have shared it.
• Right to correction, completion, updating and erasure: you can ask us to correct inaccurate data, complete incomplete data, update it, or erase it where it is no longer needed.
• Right to grievance redressal: you can raise a complaint with us about how we handle your data (see the Grievance Officer section below).
• Right to nominate: you can nominate another individual to exercise your rights on your behalf in the event of your death or incapacity.
• Right to withdraw consent: wherever we rely on your consent, you can withdraw it at any time, as easily as you gave it, by emailing us or, for newsletters, by using the unsubscribe link in any marketing email. When you withdraw consent, we will stop the related processing and erase or anonymise the affected data within a reasonable time, unless we are required to retain it by law or for an ongoing dispute, and we will instruct our service providers to do the same.

To exercise any of these rights, email us at hello@orbitlayer.in, or contact our Grievance Officer at grievance@orbitlayer.in for complaints and escalations. We may need to verify your identity before acting on a request.

Withdrawing your consent may limit our ability to provide the related service; for example, we cannot send you the newsletter if you unsubscribe. If you are not satisfied with how we handle your request, you may escalate the matter to the Data Protection Board of India once it is operational.

Our website and services are intended for businesses and adults, not for children. Under Indian law a child is anyone under 18 years of age. We do not knowingly collect personal data from children.

If we ever needed to process a child's personal data, we would first obtain verifiable consent from a parent or guardian. We do not carry out tracking, behavioural monitoring or targeted advertising directed at children. If you are a parent or guardian and believe a child has provided us with personal data, please contact us at hello@orbitlayer.in and we will remove it.

Our website, blog and portfolio may link to third-party websites and tools whose privacy practices we do not control. In particular, once a WhatsApp conversation leaves our website, it is governed by WhatsApp's and Meta's own privacy policies.

We are not responsible for the content or privacy practices of third-party services, and we encourage you to review their privacy policies before submitting any personal data to them.

We may update this Privacy Policy from time to time to reflect changes in our practices or in the law. When we do, we will revise the last updated date at the top of this page, currently 16 September 2026.

If we make material changes, we will let you know by reasonable means, such as a notice on our website. Your continued use of our website after an update means you are aware of the revised policy.

This Privacy Policy, and any dispute or claim arising out of or in connection with it or its subject matter, is governed by and construed in accordance with the laws of India. The competent courts at Gurugram, Haryana, India shall have exclusive jurisdiction over any such dispute.