This Privacy Policy explains how South Loop Studios Limited (“we”, “us”, or “our”) collects, uses, and protects personal information when you use our websites, applications, and services — including the Orbit family of applications and the orbitspatial.io website, and the Esfera streaming platform — register interest, create an account, or make a purchase.
1. Information We Collect
We collect the following categories of information:
- Identity and contact data (name, email address)
- Profile data (organisation name, role, licence interest; on Esfera, your public profile)
- Account data (login credentials and verification codes)
- Purchase and billing data (licence or subscription type, billing country, business name and VAT number where you provide them, payment status, and transaction metadata)
- Technical data (IP address, device and browser information, timestamps, and security logs; when you activate a licence we also record a pseudonymous device identifier and the device name your computer reports — often “Someone’s MacBook Pro” — so you can see and manage your activations)
- Usage data (how our websites, services, and applications are used — see Section 3)
- Content you choose to publish on Esfera (uploads, artwork, comments, and profile information you make public)
2. How We Use Your Information
We use your information to:
- Provide our websites and services and respond to enquiries
- Register your interest and send product updates and release notifications
- Create and manage accounts, including verification and authentication
- Process purchases and deliver licences, subscriptions, or access
- Provide customer support and resolve issues
- Maintain security, prevent fraud, and protect our services
We will never sell your data to third parties.
3. Usage Data and Analytics
We collect usage data to operate, secure, and improve our websites, services, and applications. This data is collected using our own in-house system — we do not use a third-party analytics provider, and we never sell or share usage data with third parties for their own purposes under any circumstances.
Website and service usage (essential)
When you use our websites and account services, we process operational usage data that is necessary to deliver what you have signed up for — for example, creating and maintaining licences or subscriptions, processing billing and purchases, providing downloads and streaming, and keeping our services secure. Because this processing is essential to provide the service, it cannot be switched off while you use our websites and accounts (legal basis: performance of a contract and our legitimate interests).
App usage analytics (optional)
Our applications can share usage analytics that help us understand which features are used and how the apps perform, so we can focus development. This data is anonymous and is not tied to your identity or account. It includes information such as:
- Anonymous feature events (e.g., that a file was imported or an export completed)
- App version, release channel, platform, and operating system version
- Counts and durations (e.g., how many objects, or how long an export took)
We never store with these events:
- Your name, email address, or licence details
- File names, file paths, or any audio content
- Anything that could identify you or your projects
To verify that analytics come from a genuine copy of the app, the app presents its licence token when sending them; we use it only for that check and discard it — it is not stored with the events.
App usage analytics are optional. You can opt out at any time in the application’s privacy settings.
Linking to your licence
Today, app usage analytics are never linked to your licence or account. In future we may offer an opt-in choice to link them — for example, to help us provide support. If we do, it will be off by default and you will be able to withdraw it at any time.
4. Legal Bases for Processing (UK/EU)
We process personal data based on one or more of the following legal bases: your consent (e.g., mailing list sign-up), performance of a contract (e.g., account creation and purchases), compliance with legal obligations (e.g., tax and accounting), and our legitimate interests (e.g., maintaining security, preventing fraud, and improving our services).
5. Data Storage, International Transfers, and Security
Our own systems store and process data in the UK and EU. Some of the service providers listed in Section 8 are based in, or process data in, the United States — for example Stripe (payments), Postmark (transactional email), and Cloudflare (security and content delivery). Where personal data is transferred outside the UK or EU, we rely on recognised transfer safeguards: a UK adequacy decision (including the UK–US Data Bridge) or an EU adequacy decision (including the EU–US Data Privacy Framework) where the provider is certified, and otherwise standard contractual clauses with the UK addendum.
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. Access is restricted to authorised personnel and service providers who need it to perform their roles.
6. Your Rights (UK GDPR / EU GDPR)
You have the following rights, subject to certain conditions and exceptions:
- Right to access: request a copy of the personal data we hold about you
- Right to rectification: request correction of inaccurate or incomplete data
- Right to erasure: request deletion of your personal data
- Right to restrict processing: request that we limit how we use your data
- Right to data portability: request transfer of your data to another service
- Right to object: object to our processing of your personal data
- Right to withdraw consent: withdraw your consent at any time
You also have the right to lodge a complaint with a supervisory authority. In the UK this is the Information Commissioner’s Office (ico.org.uk); in the EU it is the data protection authority of the country where you live or work. We would appreciate the chance to address your concern first, but you may contact the authority at any time.
7. Data Retention
We retain personal data only as long as necessary for the purposes described in this policy, including legal, accounting, or reporting requirements. Account and purchase data is kept for the duration of your account and for a reasonable period thereafter. You may request deletion of your data at any time (see Section 9).
8. Third-Party Services and Processors
We use trusted service providers to operate our services and process data on our behalf:
- Stripe — payments and checkout; for purchases where Stripe’s Onelink service acts as merchant of record, Stripe processes your payment data as described in its own privacy policy
- Cloudflare — security, content delivery, bot protection, and cloud storage for downloads and support attachments
- Postmark — sending our transactional and product email, and receiving email you send to our support address
- Sentry — error monitoring for our websites and services; an error report can include your IP address and technical details of what went wrong
- Formspree — beta-programme and feedback form handling
- Google — Sign in with Google, hosted web fonts, and embedded YouTube videos on our sites
- Apple — Sign in with Apple
- Supabase — database and account infrastructure for Esfera
- Hetzner — the EU data-centre provider hosting our own servers
Each processes data only as needed to provide their service.
9. Data Removal Requests
To exercise any of your rights, contact us with “Data protection” in the subject line. Response time: within 30 days. Data removal: within 14 days of verification.
10. Cookies and Similar Technologies
We do not use advertising cookies. Cloudflare and Stripe may set or access cookies or similar technologies that are necessary for security, fraud prevention, and payment processing. See our Cookie Policy.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated effective date.
12. Contact
The data controller is South Loop Studios Limited, a company registered in England & Wales (company number 16933824), registered office 38 South Loop Park, Birmingham, B16 0AF, United Kingdom.
General enquiries and data protection: [email protected]
13. Legal Disclaimer
Orbit and Esfera are independent products developed by South Loop Studios Limited. Orbit Spatial is a registered trademark of South Loop Studios Limited. Our products are not affiliated with, endorsed by, or sponsored by any third-party renderer or DAW manufacturer. All trademarks mentioned are the property of their respective owners.