Privacy Policy

Last updated: March 23, 2026 — Version 1.0

The French version of this policy is legally binding.

1. Data Controller

Orbifly
Contact: info@orbifly.com
Jurisdiction: Courts of Grasse, France

2. Data Collected

2.1 API Access Logs (server-side)

Each request to the OrbiMap API is logged with:

IP address
User-Agent string
API action and parameters
HTTP response code and response time
Timestamp

2.2 Cookies

Cookie	Purpose	Duration	Consent
`orbimap_consent`	Remember your consent choice	6 months	Exempt (strictly necessary)
`orbimap_lang`	Remember your language choice	12 months	Exempt (explicit user choice)
`orbimap_theme`	Remember your theme preference (light/dark)	12 months	Required

2.3 Local Storage

Custom map views (name, coordinates, zoom) are stored locally in your browser. This data is never sent to the server.

2.4 No Analytics

OrbiMap does not use any analytics or tracking tools. No third-party trackers are present on the site.

3. Lawful Bases

Processing	Lawful Basis	GDPR Reference
API access logs	Legitimate interest (security, abuse detection)	Art. 6(1)(f)
Consent cookie	Strictly necessary	Exempt (ePrivacy)
Language cookie	Strictly necessary (explicit choice)	Exempt (ePrivacy)
Theme cookie	Consent	Art. 6(1)(a)

4. Retention Periods

Data	Duration	Justification
API logs (IP, User-Agent)	12 months	Aviation traffic is seasonal; a full annual cycle is needed for abuse detection
Preference cookies	12 months	User convenience
Consent cookie	6 months	CNIL recommendation
Rate-limit temp files	60 seconds	Real-time abuse protection

An automated purge deletes API logs older than 12 months daily.

5. Data Recipients

Collected data is accessible only to the Orbifly system administrator. No personal data is shared with third parties.

Map tiles are provided by third-party services (OpenStreetMap, CARTO) via your browser. These services receive your IP address when loading tiles, subject to their own privacy policies.

6. Transfers Outside the EU

No personal data is transferred outside the European Union by Orbifly.

7. Your Rights

Under Articles 15 to 21 of the GDPR, you have the following rights:

Right of access (Art. 15) — obtain a copy of your data
Right to rectification (Art. 16) — correct inaccurate data
Right to erasure (Art. 17) — request deletion of your data
Right to object (Art. 21) — object to processing based on legitimate interest
Right to data portability (Art. 20) — receive your data in a structured format

To exercise these rights, contact: info@orbifly.com

Response time: 1 month maximum (Art. 12(3)).

8. Complaint to the CNIL

If you believe that your data is not being processed in compliance with the regulation, you may file a complaint with the French Data Protection Authority (CNIL):

https://www.cnil.fr/fr/plaintes

9. Changes

This policy may be updated. The last modification date is indicated at the top of the page. We encourage you to review it regularly.