Privacy Policy

1. Controller

The controller of your personal data is AUREOVOLUS - UNIPESSOAL LDA (NIPC 519414772), incorporated in Portugal. Contact for all privacy matters: rohovets.taras@orbitra.digital.

2. Data we collect about users

• Account data — name, email address, and a hashed password; if you sign in with Google, the name and email Google shares with us.
• Billing data — subscription status and invoices. Payments are processed by Stripe; we never see or store your full card details.
• Usage data — actions in the app (e.g. searches, exports) and technical logs (IP address, browser type) needed to operate and secure the Service.

We use only strictly necessary cookies and browser storage (session and preferences). We do not run third-party advertising or tracking cookies, so no cookie consent banner is required.

3. Purposes and legal bases

• Providing the Service (account, features, support) — performance of a contract (Art. 6(1)(b) GDPR).
• Billing and tax compliance — legal obligation (Art. 6(1)(c)).
• Security, abuse prevention, service improvement — legitimate interests (Art. 6(1)(f)).
• Product emails (e.g. weekly digest) — performance of a contract or consent; you can opt out at any time.

4. Data about people listed in our database

LeadPrysm contains business information about startups and their founders and executives: name, role, company, business contact details, and funding information. This data is collected from publicly available sources (company websites, public posts, news) and processed on the basis of our legitimate interest in providing B2B sales intelligence (Art. 6(1)(f) GDPR), limited to professional — not private — data.

If you are listed in our database, you have the right to access, correct, or have your data removed, and to object to this processing at any time. Email rohovets.taras@orbitra.digital and we will remove your record without undue delay, at the latest within one month.

5. Recipients and processors

We share data only with service providers that help us run the Service:

• Stripe — payment processing;
• Google — sign-in (Google Identity Services);
• Microsoft Azure — hosting, in the West Europe region (Netherlands);
• transactional email providers for account and product emails.

Where a provider processes data outside the EEA (e.g. Stripe in the United States), transfers are protected by an adequacy decision (EU–US Data Privacy Framework) or the European Commission's Standard Contractual Clauses.

6. Retention

• Account data — for the life of the account and up to 30 days after deletion;
• Billing records — 10 years, as required by Portuguese tax law;
• Technical logs — up to 12 months;
• Database records of listed companies and contacts — while the information remains current and relevant, or until a valid objection or erasure request.

7. Your rights

Under the GDPR you may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interests. Write to rohovets.taras@orbitra.digital. You also have the right to lodge a complaint with the Portuguese supervisory authority, CNPD (Comissão Nacional de Proteção de Dados, www.cnpd.pt), or the authority of your country of residence.

8. Security

We apply appropriate technical and organisational measures, including encryption in transit (HTTPS), hashed passwords, and access controls. No system is perfectly secure; we will notify you and the CNPD of any breach where legally required.

9. Automated decision-making

We use AI to enrich company records and draft suggested emails. We do not make automated decisions about you that produce legal or similarly significant effects.

10. Changes

We may update this policy as the Service evolves; material changes will be announced by email or in-app. The date above always reflects the latest version.