Privacy policy

Bifröst Orbit is provided by Eirik Saman Kyrkjeeide, Kolonnenstr. 8, 10827 Berlin, Germany (VAT ID DE460394401), called "we" or "us" below. You can reach us at legal@bifrostorbit.com.

This policy explains what personal data we process when you visit bifrostorbit.com and when you or your organisation use Bifröst Orbit and its satellites, such as CMS Orbit.

1. Two roles

We are the controller for visitors to our website, for people who contact us, and for the accounts people use to sign in to Bifröst Orbit.

We are a processor for the content, files and other data that organisations put into Bifröst Orbit, including the details of their own people and website visitors. The organisation is the controller for that data, and our data processing agreement governs how we handle it. Questions about that data should go to the organisation first.

2. What we process

Visiting our website

• Technical data: Your IP address, browser, the page requested and the time, which our servers and network provider need to deliver the page and protect it from abuse.
• Your theme choice: Light or dark mode is stored in your own browser and never sent to us.

Our website uses no analytics, advertising or tracking cookies. See the cookie notice.

Contacting us

When you email us or use the contact form, we process your name, email address, your organisation if you give it, what you write and, for the form, your IP address to prevent abuse. We use this only to answer you. Messages from the form reach us by email through Resend.

The support chat

When you use the chat on our website, our docs or in Bifröst Orbit, we process your name, email address, your messages and any files you send, the page you were on and your IP address, to answer you and to prevent abuse. If you are signed in, we also see your organisation. Our team reads and answers the chat in Slack, so your messages and files are also stored there. On the website and the docs, Cloudflare Turnstile may check that you are a person.

Using Bifröst Orbit

• Account data: Your name, email address, an optional profile picture, the organisations you belong to, your role and the regions and satellites you can use.
• Sign-in data: One-time sign-in codes sent by email, which expire after 10 minutes, or the identity your organisation's Microsoft sign-in confirms. A session cookie keeps you signed in for up to 8 hours.
• Activity records: An audit trail of changes you make, with the time, your IP address and browser, and, for AI agents, the person the agent acts for. Organisations use it to see who changed what.
• Content and files: Whatever you and your colleagues create or upload. We process this for your organisation, as described in section 1.
• Messages from us: Sign-in codes, invitations and notifications you choose to receive.

3. Why, and on what legal basis

Purpose	Legal basis
Providing the service you or your organisation signed up for	Art. 6(1)(b) GDPR, performing a contract
Keeping it secure and working, preventing abuse and keeping records of what happened	Art. 6(1)(f) GDPR, our legitimate interest in a safe and reliable service
Answering you when you contact us	Art. 6(1)(b) or (f) GDPR
Meeting legal duties, such as keeping invoices	Art. 6(1)(c) GDPR, legal obligation

We do not sell personal data, use it for advertising, or make decisions about you by automated means that have legal effects.

4. Who we share it with

We use a few providers to run the service, listed with what they do and where on the sub-processors page. They may only use the data to provide their service to us. We disclose data to authorities only when the law requires it.

5. Where your data is

The platform runs in a data centre in Spain, files and backups are stored in Ireland, and email is sent from Ireland. Our network provider, Cloudflare, routes traffic through its worldwide network and may process it outside the EU. Where data leaves the EU or EEA, we rely on the European Commission's adequacy decisions, including the EU-U.S. Data Privacy Framework, or on Standard Contractual Clauses.

6. How long we keep it

Data	How long
Sign-in codes	10 minutes
Sessions	Up to 8 hours
Accounts	While you belong to an organisation in Bifröst Orbit. Your organisation can remove you at any time.
Deleted content	30, 60 or 90 days in the bin, as your organisation chooses, then erased
Organisations	Erased from the live service straight away when the organisation is deleted
Audit trail	As long as the organisation exists
Backups	Up to 14 days after data is erased
Support chat files	90 days after they were sent
Support chat conversations	12 months after the last message, or sooner if you ask us to delete them
Emails to us	As long as needed to deal with your request, and invoices as long as tax law requires

7. Security

Connections are encrypted, access to data is limited by roles and checked on the server for every request, secrets are stored encrypted, and changes are recorded. No system is perfectly secure, but we work to keep the risk low and will tell those affected about a breach as the law requires.

8. Your rights

You have the right to access your data, to have it corrected or erased, to restrict or object to processing, and to receive it in a portable format. Where we rely on consent, you can withdraw it at any time. To use these rights, email legal@bifrostorbit.com. For data we process for your organisation, we will pass your request on to them.

You can also complain to a data protection authority. Ours is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), but you may contact the authority where you live or work.

9. Children

Bifröst Orbit is a service for organisations and is not meant for children under 16.

10. Changes

We update this policy when the service or the law changes. The version and the date it takes effect are shown at the top, and we tell account holders about significant changes.