Privacy Policy

Version 1.1, in force from 17 October 2026

Dark Orb is a business ecosystem. Today it builds and publishes websites for businesses; more is in development. This policy explains what personal data we handle, why, and the rights you have over it.

Who we are

The data controller for the personal data described in this policy is DanTodd Ltd, 1 St. Hilaire Walk, Leeds, England, LS10 4FE, company number 15749189. DanTodd Ltd operates Dark Orb on an interim basis while Dark Orb Ltd is being formed. You can contact us about privacy or exercise your data rights at hello@darkorb.ai. We have not appointed a Data Protection Officer: we are not required to at our current scale, and you can raise any data-protection matter with us at the same address.

A note on roles. For your account, your use of Dark Orb, and our own waiting list, we are the controller. For personal data that visitors submit to a website you have built with Dark Orb (for example, a contact form, a booking, or a newsletter sign-up on your site), you are the controller and we act as your processor. The terms governing that processor relationship are set out in a separate Data Processing Agreement.

What data we collect, why, and our lawful basis

We practise data minimisation: we collect what the service needs to function and little else. There are no passwords, no marketing trackers, and no third-party analytics scripts.

Account data

When you create an account we store your email address, an internal user identifier (a random identifier, not derived from your email), and the date you joined. If you register a passkey, we store the public key and related metadata for that passkey. We never store passwords, and we never store passkey private keys (those stay on your device). Our lawful basis is performance of our contract with you.

Sign-in tokens

We use passwordless sign-in. A magic-link token expires after 15 minutes; a passkey challenge expires after 5 minutes. Both are single-use and deleted as soon as they are used. Our lawful basis is performance of our contract and our legitimate interest in account security.

Cookies

We set at most two cookies, both strictly necessary, so we do not show a cookie consent banner. When you are signed in we set a session cookie to keep you signed in. It is marked HttpOnly and SameSite=Lax, is sent only over HTTPS in production, is signed so it cannot be tampered with, and expires after 30 days. It contains only your user identifier, your email, and an expiry timestamp. If you try Dark Orb without an account, we set a demo_session cookie so your trial survives between requests. It is marked HttpOnly, SameSite=Strict and Secure, holds only a random identifier and no personal data, and expires after 24 hours, refreshed as you revise. It is cleared when you claim the trial into an account. We use no analytics or advertising cookies. See our Cookie Notice for the full detail.

What you tell us to build

When you describe what you want Dark Orb to build, we store that description and what it produces (your website, and any logo you compose) so you can revise, undo, and restore earlier versions. We also store the business context you give us (for example your industry and location). To produce a site, your description is sent to our AI subprocessor and may be held in a short-lived cache for up to 24 hours. Our lawful basis is performance of our contract with you. If you try Dark Orb without an account, we keep that demo session for up to 7 days, refreshed by activity, and delete it when you claim it into an account or when it expires.

What Dark Orb remembers about your business

Dark Orb is adding a Business Profile: a short, plain-language record of what you tell us about your business and your preferences, such as colours to avoid, the tone you want, or a fact about your business. Each item is one statement of up to 280 characters, kept against your account and the business it belongs to. Only what you say to Dark Orb in your portal (or, later, through the programming interface on your behalf) can be stored in it. Customer enquiries, imported web content, and AI output are never stored as profile items. The profile is used as context when Dark Orb builds things for you, so those items are sent to our AI subprocessor along with your request. You can ask "What do you know about me" at any time and read back what is held. A correction keeps the earlier item as history, and a withdrawn item is marked withdrawn rather than shown. The profile is part of your account export and is erased with your account. This section applies from the day capture is switched on. Our lawful basis is performance of our contract with you.

Images

If you upload an image, we store it to provide it on your site. If you ask for a stock image, we search our stock-image providers (Pexels and Openverse) with a search phrase only, screen the candidates for suitability, and store the chosen image against your account. If you bring an existing logo for Dark Orb to draw from, we store it and send it to our AI subprocessor to read its visual character. Our lawful basis is performance of our contract with you.

Form submissions on the sites you build

When a visitor submits a form on a website you have built with Dark Orb (typically a name, email, and message, plus any custom fields), we store that submission so you can read it in your portal, and we email it to you through our email subprocessor (Resend, or Brevo as a backup) to notify you that it has arrived. Submissions that carry an email address are also gathered into a customer record, so you can read everything one person has sent as a single thread. If you reply to a customer from your portal, your reply is delivered to them through our email subprocessor. If you ask a question about your customers, or for a summary of a thread, and answering needs interpretation, the relevant enquiry text is sent to Anthropic, or to OpenAI as a backup if Anthropic is unavailable. This happens only when you ask, never automatically. Beyond that, we do not send these submissions to any other third party or use them for our own purposes. We hold them on your behalf as your processor; you decide why they are collected and how long they are kept. The most recent 500 submissions per site are retained in the site inbox; customer records last for the life of your account.

Bookings on the sites you build

When a visitor books an appointment on a website you have built with Dark Orb, we store the visitor's name (if given), email address, the appointment start and end times, and whether the booking is confirmed or cancelled. The booking record stores a hash of the token used to cancel or reschedule without an account. To deliver the confirmation email reliably, the complete manage link, including the raw token, is stored temporarily in the booking notification outbox while delivery is pending or being retried. The link is cleared when the email is delivered or delivery reaches terminal failure. We send the confirmation through our email subprocessor. A booking also appears on that customer's thread in your portal, beside their enquiries. The booking form uses the same bot check as other forms on your site. We hold bookings on your behalf as your processor. They are kept for the life of your account and are erased when you delete your account. Contact hello@darkorb.ai if a visitor asks you to erase an individual booking.

Newsletter subscribers on the sites you build

When a visitor subscribes to a newsletter on a website you have built with Dark Orb, we store their email address, the page they signed up from, and the date. We then email them a confirmation link. Only when they open the link and press the button do they become a subscriber, and at that point we record the time, their IP address and their browser's user agent as evidence that they consented. Every email carries a one-click unsubscribe link. Sign-ups that are never confirmed are deleted after 30 days. A person who unsubscribes is kept as a suppression record, so that they are not added again by mistake. Subscriber lists are held on your behalf as your processor and are shown to you in your portal. They are erased when you delete your account. The lawful basis is the subscriber's consent, given through the double opt-in; you, as controller, are responsible for what you send them.

Our waiting list

Dark Orb is not yet open to the public. When we open a waiting list on darkorb.ai, we will collect your email address, the date, and where you signed up from. We will email you a confirmation link, and you are added only when you confirm it. At that point we record the time, your IP address and your browser's user agent as evidence of your consent. We will use the list only to tell you about Dark Orb opening and about early access, and every email will carry a one-click unsubscribe link. We will delete sign-ups that are not confirmed within 30 days. We will keep confirmed sign-ups until you unsubscribe or we close the list, and we keep a suppression record after you unsubscribe so you are not added again. The confirmation email goes through our email subprocessor. This section applies from the day the waiting list opens. For the waiting list we are the controller, and our lawful basis is your consent, which you can withdraw at any time using the unsubscribe link or by emailing hello@darkorb.ai.

Audit and security logs

We keep minimised audit logs of security-relevant events, such as sign-in successes and failures, to protect accounts and investigate abuse. Sign-in success logs record only your internal identifier, not your email, and failure logs record a non-identifying reason. Our lawful basis is our legitimate interest in keeping the service secure.

Analytics

Our analytics are server-side, cookieless, and first-party. We do not set tracking cookies, do not assign persistent visitor identifiers, and do not send data to any third-party analytics product. There are two kinds, and they are treated differently.

Visitors to the sites you build. We count views, form submissions and button clicks on your published sites. Nothing in these counts identifies the visitor. Where an approximate location is derived, IP addresses are anonymised before storage (the final part of the address is removed). Raw events are kept for 30 days; aggregated counts, which cannot identify a person, are kept longer.

How you use Dark Orb. We also record how your account uses the product, so that we can see which features are used, find problems, and fix them. This is linked to your account by its internal identifier (not your email address). It records the kind of action (for example starting and ending a working session in the editor, an undo, a retry of a correction, an export, or restoring an earlier version), which part of Dark Orb it was in, the time, and how long a session lasted. It does not record the text of your requests. Raw events are kept for 30 days. Hourly totals per account are kept for the life of your account. Only the founder can read this view, in an internal admin page, and each read is audit logged. These totals are included in your account export and are erased when you delete your account.

Our lawful basis for analytics is our legitimate interest in understanding and improving the service. For account-linked usage we have weighed this against your interests and expectations, and you may object at any time at hello@darkorb.ai.

Payments

Dark Orb is provided without charge today, so we do not currently process any payment data. When paid subscriptions become available, payment will be handled by our payment subprocessor. We will not store full card details; we will store the information needed to manage your subscription (for example your billing email and a payment reference), and we will update this policy before that processing begins.

Subprocessors

We use a small set of providers to deliver the service. Each is bound by a data processing agreement and processes data only on our instructions.

The subprocessors listed above are the current set. Where a row says backup, that provider only sees data if the main one fails. Stripe and Sentry are listed as planned and are not yet in use. We will give notice before adding a new subprocessor that handles personal data, and we maintain a standalone Subprocessors page you can subscribe to for changes. Where personal data is transferred outside the UK, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses; the specific mechanism cited per subprocessor is being confirmed with our solicitor and does not change the safeguards you are entitled to.

How long we keep data

You can delete your account yourself from your account page, or ask us at hello@darkorb.ai. Deletion removes your account record and your sites, their versions, their form submissions, bookings, customer records, newsletter subscribers, Business Profile, and business context, and the usage totals linked to your account. Visitor analytics are cookieless and are not linked to anyone's identity; raw events age out within 30 days. Backups containing earlier copies age out within 30 days.

Your rights

Under UK GDPR you have the right to access your data, have inaccurate data corrected, have your data erased, restrict or object to certain processing, receive your data in a portable format, and withdraw consent where we rely on it (for newsletters and the waiting list). From your Dark Orb home, ask to download all your data and we will prepare everything your account holds as one file. For any of these rights, or to object to usage measurement, contact us at hello@darkorb.ai. We will respond within one month. If a website visitor wants to exercise rights over data submitted to a site built with Dark Orb, that request goes to the business that owns the site, not to us; we will assist that business as their processor. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, though we would welcome the chance to resolve any concern first.

Security

Sign-in is passwordless, which removes the most common account-takeover risk. The session cookie is signed and tamper-evident. Access to your data is scoped to your account at the storage layer, not only at the surface. We log security-relevant events to detect and investigate abuse.

Children

Dark Orb is a business tool and is not directed at children. We do not knowingly collect data from anyone under 18.

Changes to this policy

We may update this policy as the service grows. When we make a material change we will update the version and the date, and where appropriate we will notify you. Continued use after a change means you accept the updated policy.

Version 1.1, in force from 17 October 2026. It replaces Version 1.0, in force from 22 June 2026.