Privacy notice
Who operates this site
Orbenix is published by DBM Strategy LLC. Our current business address is 2915 Ogletown Road, #4266, Newark, DE 19713, United States. For questions about this site or requests concerning your information, use the official DBM Strategy contact form.
Subscriptions and confirmation
You can request information for the newsletter, waiting list or beta programme. Each form identifies its purpose and asks you to agree to the associated information. We record your email address, selected purpose, language, the time and version of that agreement, its form source and your IP address. Optional campaign parameters and your answer to “How did you hear about us?” help us understand how people find the site. Please do not include personal information in the optional free-text answer.
Submitting a form does not activate a subscription. We send a confirmation link, valid for 48 hours. Opening the page alone does not confirm anything: you must press its confirmation button. Each subscription purpose is independent. You can withdraw from the relevant purpose using its unsubscribe link and confirmation page. A new subscription after withdrawal requires a new request and confirmation. An address excluded following a complaint is not automatically reactivated.
We keep the first known acquisition source separately from the source of later requests. Form responses do not disclose whether an email address is already known.
Abuse prevention and temporary processing
Cloudflare handles the public form, Turnstile verification and a temporary delivery queue. The form data and consent IP therefore pass through Cloudflare before reaching the application. Turnstile verification uses a challenge token and technical request information, including the IP address. The application receives a signed verification record, not the challenge token.
The form limits submissions by IP address. Its limiter uses a keyed fingerprint rather than storing the raw address. A temporary encrypted receipt allows a request to be resumed without sending another confirmation because of a network retry. A generic acceptance response means the request has been queued or recorded; it does not mean your subscription is confirmed. A sufficiently long outage can exceed the queue’s retention period.
Audience measurement and browser storage
Browser audience measurement starts after you allow it in Privacy preferences. You can refuse or change your choice using the button in the footer. Your browser stores the choice under orb-privacy-v1 until you change it or clear site storage. The registration system records confirmation events separately.
We use an Umami instance dedicated to this site to count public page views, offer clicks and subscription events. The application forwards only selected public dimensions, such as language, form, purpose or campaign. It does not forward your email address, visitor IP address, individual browser User-Agent, cookies, authorisation header, private referrer, URL query or free-text answer. Server-side confirmation records remain the reference for confirmed subscriptions even when analytics is unavailable.
The measurement relay does not identify individual visitors: Umami’s session and visitor totals aggregate the relay and must not be read as counts of people. Browser measurement respects Do Not Track and Global Privacy Control signals when supplied. Confirmation and unsubscribe pages do not run analytics.
The site stores your appearance preference locally in your browser under orb-appearance. This remains until you change or clear that browser storage. Attribution is submitted with the form; no persistent attribution storage is added by this feature. The current submission identifier is kept only while the page resumes an unfinished request.
Retention and deletion
- Confirmation links stop working after 48 hours or when consumed, replaced or withdrawn. Their verification hashes and temporary encrypted sending copies are removed when no longer needed; expiry clean-up runs hourly.
- An unconfirmed subscription becomes eligible for deletion after 30 days in its pending period. A new subscription following withdrawal starts a new pending period; repeated confirmation requests do not extend an existing pending period indefinitely.
- Consent IP addresses are cleared after 30 days. Operational receipts, delivery metadata and technical events have a 30-day clean-up threshold. These scheduled deletions run hourly rather than at the exact second of each threshold.
- We retain the address and information needed for purposes that remain active. Withdrawal removes the relevant consent details and current source. When no active or pending purpose remains, the contact is deleted. Other independently active purposes are preserved.
- A minimal address fingerprint and erasure time prevent an older queued request from recreating a deleted contact. This erasure marker is eligible for deletion after 48 hours. A minimal complaint exclusion remains while it is needed to prevent unwanted reactivation; it is not automatically removed in a way that would allow new unwanted messages.
- The Cloudflare queue and its failure queue each retain messages for at most 24 hours, with an overall collection-age limit of 48 hours. Targeted erasure removes the application’s local copies and requests removal of the encrypted Worker receipt. A message already in transit may remain with the provider until expiry, but must not recreate the contact. We do not claim immediate physical deletion of every in-transit copy.
- The encrypted Worker receipt is kept for at most 24 hours; its compact replay-prevention marker for at most 30 days. IP limiter reservations serve a one-hour window and are cleared by its scheduled alarm.
- Audience measurement events are eligible for scheduled deletion after 30 days. Sessions can remain while they relate to activity within that period. Daily and pre-release backups and continuous PostgreSQL logs are stored in Cloudflare R2 to support a 30-day recovery window. A full backup and the logs needed for recovery may remain longer to preserve that window.
Your choices and rights
You can withdraw your consent to receive updates at any time using the unsubscribe link. Withdrawal applies to future processing based on that consent. To ask about a subscription or exercise your rights, use the official DBM Strategy contact form.
Depending on the law that applies to your request, you may be entitled to access, correct, delete or receive a copy of your personal information, ask us to restrict its use, or object to its processing. If we reasonably need more information to verify your identity, we will ask for the information needed to confirm it. You may also lodge a complaint with the competent data protection authority where applicable.
Hosting and service providers
Hostinger hosts the application in Paris, France. Cloudflare provides site delivery, abuse prevention, temporary form queueing and backup storage. We use MXroute, a provider based in the United States, to deliver subscription confirmations. MXroute processes the recipient address and the message content needed to deliver the confirmation.