Privacy policy

Last update: September 2026

This Privacy Policy describes how MUSHDESK, S.L. (hereinafter, "Orbe", "we", "us") collects, uses, and discloses personal data through the website https://orbe.app and the Orbe applications available on the Shopify App Store.

This policy is not intended to provide legal advice. If you have concerns about how privacy laws apply to your specific situation, we recommend consulting a lawyer.

1. Who is responsible for processing your data?

The data controller for the personal data collected through the website https://orbe.app and associated support channels is MUSHDESK, S.L. (hereinafter, "Orbe"), with Tax Identification Number ESB09677048 and registered office at Paseo de la Castellana, 194, 28046, Madrid, Spain.

Contact email: support@orbe.app

This Privacy Policy comprises (i) general terms, which apply to all Orbe applications published by Orbe in the Shopify App Store, and (ii) product-specific terms. Product-specific terms apply solely if and for so long as the Customer has the relevant Orbe application installed in their Shopify store. Product-specific terms relating to an application that is not installed have no legal effect and do not describe any processing, feature or obligation. Installation of any Orbe application constitutes acceptance of this Privacy Policy in its entirety; such acceptance does not activate product-specific terms for an application that is not installed.

Important information about the use of Orbe applications on Shopify

  • When Orbe processes personal data from visitors/end users of the merchant's store (your Shopify store) to provide the functionalities of an installed Orbe application, Orbe acts as the DATA PROCESSOR, and the merchant (owner of the Shopify store) acts as the DATA CONTROLLER. This processing is governed by the Data Processing Agreement (DPA), attached to Orbe's T&Cs.
  • Orbe is RESPONSIBLE for data linked to its corporate website, communication with merchants, billing via Shopify, and support.

Orbe is a B2B solution for businesses; it is not intended for minors. If, exceptionally, information on minors is processed at the merchant's request, the merchant shall guarantee the required legitimacy and consent.

2. Recommendations

Please read carefully and follow the recommendations below for safe use of the Orbe website and Orbe applications:

  • Keep your equipment and devices updated with effective and properly configured antivirus software to protect yourself against malicious software, spyware, or unauthorised access that could put your Internet browsing or the information stored on your equipment at risk.
  • Periodically review this Privacy Policy and other legal texts made available by Orbe on the website https://orbe.app and in the Shopify App Store, as they may be updated to reflect legal, technical or operational changes.
  • Manage and configure your privacy and cookie preferences correctly in your browser and, if you are a merchant, ensure that you implement the appropriate privacy policies and consent mechanisms in your own Shopify store.
  • Do not share your Shopify or Orbe login credentials with unauthorised third parties and use strong, unique passwords.
  • If you detect any incident related to the security or privacy of Orbe, please notify us immediately at support@orbe.app.

3. Information about the data you provide us

For the proper functioning of the corporate website and the Orbe applications integrated into Shopify, Orbe may have access to the following data, either provided directly by the Customer (merchant) or generated automatically through the use of the installed applications:

  1. Customer identification and contact details: name and surname of the legal representative, company name, address, postcode, country, telephone number and email address, within the framework of the B2B contractual relationship with Orbe.
  2. Communication and support data: contents of queries, support requests or incidents that the Customer directs to the Orbe team via email, support forms or any other enabled channel.

Orbe Geolocation

This section applies solely if and for so long as the Customer has Orbe Geolocation installed.

  1. Technical and connection data: IP address, country of connection, browser agent and language, operating system and approximate geolocation data. This data is anonymised and is not attributed to specific end users, and may include cookies or similar technologies necessary for the provision of redirection and personalisation features for the user experience.
  2. Orbe Geolocation usage data on Shopify: information relating to display preferences (language, currency, selected market), redirection history within the store, welcome pop-up settings or market selectors. Under no circumstances does Orbe access the content of purchases, financial data or sensitive information of the Client's end customers.
  3. Data collected indirectly through integrations with Shopify Markets or Global-e: Orbe may receive limited technical information related to market settings, currencies, languages, and redirection rules, for the sole purpose of properly providing the Services. This data does not allow for the individual identification of end users and remains under the control and responsibility of the Customer as the Data Controller.

Orbe Translate

This section applies solely if and for so long as the Customer has Orbe Translate installed.

  1. Store content for translation: catalogue, theme and other store content provided by the Customer, processed solely to translate that content through Orbe's architecture and the AI providers listed in the DPA. Orbe does not access the content of purchases, financial data or sensitive information of the Client's end customers.

4. Information about the data that Orbe collects through the Website and Orbe

The Orbe corporate Website and the Orbe applications integrated into Shopify use cookies and similar technologies which, depending on the settings made by the User and/or the Customer, may result in the processing of certain technical data.

Generally, the information collected through the Website includes:

  • IP address of the device or server from which access is made (anonymised to prevent direct identification).
  • Country and approximate connection area.
  • Browser used, browser language and operating system.
  • Date and time of access to the Website or use of an Orbe application.

Orbe Geolocation

This section applies solely if and for so long as the Customer has Orbe Geolocation installed. In that case, the information collected may also include:

  • Technical configuration preferences within Orbe Geolocation (language, market or currency selected).
  • Data linked to the operation of redirects, market selectors, and welcome pop-ups.

This information is used exclusively to ensure the proper functioning of the Website and the installed Orbe applications, to improve the user experience and, where Orbe Geolocation is installed, to offer geolocation and personalisation features. Under no circumstances is it used to personally identify end users or to create profiles with significant legal effects.

You can obtain detailed information about the use of cookies and how to configure your preferences in our Cookie Policy [include link to cookie policy].

5. What are the purposes of processing your personal data?

The personal data collected by Orbe through the corporate website and the Orbe applications may be used for the following purposes:

  1. Management of requests for information and support: to attend to and respond to queries, requests for information, technical or commercial incidents, complaints and claims submitted by Customers or Users through the forms provided, email or any other available contact channel.
  2. Provision of service and technical support: to enable the installation, configuration, maintenance and updating of each installed Orbe application in the Customer's Shopify store, as well as to manage access to the support and technical assistance area.
  3. Contract management: complying with the obligations arising from the contractual relationship with Customers, including billing and subscription management through the Shopify App Store.
  4. Compliance with legal obligations: to meet the legal, regulatory or administrative requirements applicable to Orbe in relation to tax, accounting, data protection or information society services.
  5. Geolocation and technical customisation (Orbe Geolocation only; this purpose applies solely if and for so long as the Customer has Orbe Geolocation installed): processing technical data (such as anonymised IP addresses, browser language, country of connection or display preferences) for the sole purpose of enabling Orbe Geolocation's geolocation, automatic redirection and user experience customisation features, without this implying the individual identification of end users.
  6. Store content translation (Orbe Translate only; this purpose applies solely if and for so long as the Customer has Orbe Translate installed): processing store content provided by the Customer for the sole purpose of translating that content through Orbe's architecture and the AI providers listed in the DPA.
  7. Statistical and usage analysis: depending on the configuration of cookies and similar technologies, to carry out measurements and statistics on the use of the applications and the Website in order to improve their functionalities, as well as to produce aggregate metrics on browsing habits in an anonymised manner and not linked to specific users.

The legal basis that legitimises Orbe to process the data of Users and/or Customers through the corporate website and the Orbe applications varies depending on the purposes described in this Policy:

  1. Management of information and contact requests: when a potential or existing Customer contacts Orbe through the available forms or customer service, the basis for legitimacy will be the application of pre-contractual measures or, where applicable, the execution of a contract (Art. 6.1.b GDPR).
  2. Technical support and assistance: the processing of data to manage complaints, incidents or support requests is also based on the performance of the contract or the implementation of pre-contractual measures (Art. 6.1.b GDPR).
  3. Contract management and access to the customer area: if you log in or configure an Orbe application in the Customer's Shopify store, the processing of personal data is covered by the performance of the contract entered into through the Shopify App Store (Art. 6.1.b GDPR).
  4. Compliance with legal obligations: Orbe may process certain data in compliance with applicable tax, accounting, commercial and data protection obligations (Art. 6.1.c GDPR).
  5. Geolocation and technical customisation (Orbe Geolocation only; this basis applies solely if and for so long as the Customer has Orbe Geolocation installed): the processing of technical data (e.g. anonymised IP address, country of connection, browser language or market settings) to enable Orbe Geolocation's geolocation and redirection features is covered by the execution of the contract signed between Orbe and the Customer (Art. 6.1.b GDPR).
  6. Store content translation (Orbe Translate only; this basis applies solely if and for so long as the Customer has Orbe Translate installed): the processing of store content to provide Orbe Translate is covered by the execution of the contract signed between Orbe and the Customer (Art. 6.1.b GDPR).
  7. Use of cookies and statistical analysis: the processing of data derived from cookies or similar technologies for analytical, metric and personalisation purposes is based on the User's informed, free, specific and unambiguous consent (Art. 6.1.a GDPR).

Orbe takes the protection of the privacy and personal data of its Clients and Users very seriously. For this reason, personal data is processed with the utmost care, in accordance with Regulation (EU) 2016/679 (GDPR), the LOPDGDD and other applicable regulations.

At any time, the User or Customer may withdraw their consent for processing based on this legal basis, without this affecting the lawfulness of the processing carried out previously. To exercise this right, simply send an email to: support@orbe.app.

7. Accuracy of the data provided by Users or Customers

The Customer guarantees that the personal and professional data provided to Orbe through the Website or during the process of installing and using any Orbe application on Shopify is accurate, complete and truthful, and undertakes to keep it duly updated at all times.

The Customer shall be solely responsible for the accuracy of the data provided and for any direct or indirect damage or harm that may be caused to Orbe or third parties as a result of providing inaccurate, incomplete or false information.

Orbe reserves the right to deny or suspend access to the Services if it is detected that the Customer has provided false, inaccurate, outdated or inauthentic data, without prejudice to any other legal actions that may be applicable.

Likewise, Customers and Users are advised to protect their credentials and data with the utmost diligence, using appropriate security measures (e.g., strong passwords, Shopify authentication systems, etc.). Orbe shall not be liable for unauthorised access, loss, theft or unlawful manipulation of data resulting from the Customer's negligence in managing their own information or the security of their Shopify store.

Any modification or update of the data must be communicated to Orbe through the contact channels provided in this Privacy Policy or through the tools available in the Shopify App Store.

8. Data retention

The protection of privacy and personal data processed through Orbe is a priority for Orbe. Therefore, only authorised and duly trained personnel will have access to such data, always under the principles of confidentiality and security.

Personal data provided by Customers or collected in connection with the use of Orbe will be retained for the time strictly necessary to fulfil the purposes of processing described in this Policy and for as long as the contractual relationship between the Customer and Orbe remains active.

In particular:

  • Customer identification and contact details (B2B): these will be kept for the duration of the contractual relationship and, subsequently, for the periods necessary to meet any legal, administrative or tax liabilities (generally five (5) to six (6) years in accordance with tax and accounting regulations).
  • Technical data of end users processed through Orbe Geolocation (e.g. anonymised IP address, country of connection, browser language, market preferences): this data is only stored temporarily and is deleted or anonymised once the purpose of geolocation and personalisation of the experience has been fulfilled. Orbe does not permanently store this data. This bullet applies solely if and for so long as the Customer has Orbe Geolocation installed.
  • Data obtained through cookies or similar technologies: this will be kept for the periods established in the Cookies Policy, depending on the nature of each cookie and always based on your consent.
  • Data processed for B2B commercial communications purposes: this will be kept for as long as the Customer has not expressed their opposition or requested to be removed.

Once the contractual relationship has ended, Orbe will keep the data blocked exclusively for the legally established periods in order to deal with any possible claims or liabilities. Once these periods have elapsed, the data will be securely deleted or, where appropriate, irreversibly anonymised.

Orbe undertakes to comply at all times with its duty of confidentiality and secrecy with regard to personal data, in accordance with the provisions of Regulation (EU) 2016/679 (GDPR), the LOPDGDD and other applicable regulations.

9. Users' rights

In compliance with the provisions of Articles 12 to 22 of Regulation (EU) 2016/679 (GDPR) and the LOPDGDD, data subjects may exercise the following rights in relation to the processing of their personal data:

  • Access: obtain confirmation as to whether or not Orbe processes personal data concerning them, as well as access to such data.
  • Rectification: request the correction of inaccurate data or the updating of incomplete data.
  • Erasure: request the deletion of their data when it is no longer necessary for the purposes for which it was collected.
  • Restriction of processing: request that your data be stored but not processed temporarily, in certain cases provided for in the GDPR.
  • Objection: to object to the processing of your personal data in certain circumstances and for reasons related to your particular situation.
  • Portability: request the direct transfer of your data to another controller, where technically possible.
  • Not to be subject to automated individual decision-making: including profiling, except in cases where it is legally permitted.
  • Withdrawal of consent: in processing based on this legal basis, the data subject may withdraw their consent at any time, without this affecting the lawfulness of the processing prior to such withdrawal.

Channels for exercising rights

Data subjects may exercise their rights by sending a written request to Orbe via:

  • Email: support@orbe.app
  • Post: Mushdesk S.L., Paseo de la Castellana, 194, 28046, Madrid, Spain.

The communication must contain sufficient information to verify the identity of the applicant. If it cannot be reasonably verified, Orbe may request additional information to confirm the identity before processing the request.

Clarification of roles in processing

  • In the case of personal data of the Customer (B2B) provided within the framework of the contractual relationship with Orbe, the rights may be exercised directly before Orbe, in its capacity as Data Controller.
  • In the case of personal data of end users of Shopify stores processed through an installed Orbe application (including, where Orbe Geolocation is installed, geolocation or personalisation, and where Orbe Translate is installed, store content submitted for translation), the Customer (owner of the Shopify store) acts as Data Controller. In these cases, Orbe will act as Data Processor, forwarding any requests it receives to the relevant Customer, in accordance with the DPA (Data Processing Agreement).

Right to lodge a complaint with the supervisory authority

In any case, data subjects shall have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) or another competent supervisory authority if they consider that the processing of their personal data infringes the applicable data protection regulations.

10. Data security

Orbe applies appropriate technical and organisational measures to ensure the security of the data processed through Orbe, including communication encryption, access control, limited storage of anonymised technical information and service continuity plans.

Where Orbe Geolocation is installed, Orbe does not permanently store end users' personal data, limiting itself to processing necessary and anonymised technical metadata (such as partial IP, browser language or country of connection).

The Customer is responsible for the security and configuration of their own Shopify store. Orbe will maintain its duty of confidentiality and notify the Customer of any relevant security incidents in accordance with the terms set out in the DPA.

11. Transfers and/or assignments to third parties

The data will be processed by third-party providers to carry out the purposes, such as hosting services. Likewise, data may be transferred to competent authorities and bodies, courts, tribunals or any other third parties entitled to do so in order to comply with applicable regulations.

Your Personal Data may be communicated to third parties, namely:

  • Third parties who help us provide IT services, such as website providers, hosting services, maintenance and support for our databases, as well as our software and applications that may contain data about you.
  • Third parties who help us provide digital services and reviews, CRM, web analytics and search engines.
  • Advertising, marketing and digital media agencies to help us deliver advertising, marketing and campaigns, to analyse their effectiveness and to manage your contact and enquiries.
  • Third parties for compliance with legal regulations.

User data may only be used by Orbe for any purpose that serves to correctly fulfil the purposes of personal data processing set out in point 5 of this Privacy Policy.

12. How Orbe supports your GDPR compliance

Orbe Geolocation

This section applies solely if and for so long as the Customer has Orbe Geolocation installed.

GDPR compliance is not an afterthought for Orbe — it is the reason the product was built the way it was.

No automatic redirection on the first visit

Orbe never automatically redirects a visitor on their first visit to a store. Instead, on the first visit, Orbe shows an informational popup allowing the visitor to voluntarily choose their preferred country, language or market. Redirection only occurs on subsequent visits, once the visitor has made an explicit choice that is stored in a functional preference cookie.

This is a fundamental design decision. Automatically redirecting visitors without their consent — as many internationalisation tools do — is not compliant with GDPR. Orbe eliminates this risk by design.

Only after the visitor takes an explicit action in the popup (accepting or selecting a country, language or market) does Orbe generate a functional preference cookie. This cookie stores the human's explicit choice — not tracking data. Under applicable data protection regulations, including interpretative criteria from the Spanish Data Protection Agency (AEPD) and the general principles of EU privacy regulations, a functional cookie that exclusively remembers a choice made voluntarily by the user does not require specific prior consent, as it is a service expressly requested by the user.

Privacy-by-design technical architecture

The initial geolocation detection (before any popup interaction) uses the visitor's IP address and browser language on a one-time, non-persistent basis, for the sole purpose of recommending the most appropriate version of the store. This processing:

  • Does not install cookies or create persistent identifiers.
  • Does not store information for subsequent visits.
  • Does not track or profile visitors.
  • Is not used for advertising, analytics or marketing.
  • Is covered by the legitimate interest of the data controller (Art. 6.1.f GDPR) and falls outside the scope of cookie consent requirements.

Data minimization

Orbe processes only the minimum data strictly necessary: anonymised IP address, browser language, country of connection, and market/language preferences selected by the user. Orbe never accesses order content, payment information, financial data or any sensitive customer data.

DPA provided to all merchants

Every merchant who installs Orbe automatically accepts a Data Processing Agreement (DPA) as part of Orbe's Terms and Conditions. This DPA governs the conditions under which Orbe processes personal data on behalf of the merchant, in full compliance with GDPR. No separate bilateral contract or manual process is required.

Merchant remains in full control

The merchant acts as Data Controller at all times and Orbe as Data Processor. Merchants using Orbe can support their visitors' right to land on the correct country-specific storefront. Merchants are responsible for their own cookie banner, consent management platform, and compliance obligations towards their end customers.

Privacy regulations supported

Orbe's architecture supports merchants operating under the following regulations:

  • GDPR (EU/EEA and UK): data minimization, legitimate interest basis, functional cookie exemption, DPA included.
  • CCPA / CPRA (California): no sale of personal data, no cross-context behavioural advertising, data deletion on request.
  • VCDPA (Virginia) and similar US state laws: transparent data practices, data subject rights support.

13. Shopify mandatory compliance webhooks

In compliance with Shopify's requirements for apps listed on the Shopify App Store, Orbe responds to all mandatory compliance webhooks:

  • customers/redact: when a merchant requests deletion of a customer's personal data, Orbe deletes all associated data for that customer.
  • shop/redact: 48 hours after a merchant uninstalls an Orbe application, all data associated with that store is permanently deleted from that application's systems.
  • customers/data_request: when a customer requests access to their personal data stored by Orbe, we provide the relevant information to the merchant to fulfil the request.

14. Changes to the privacy policy

Orbe reserves the right to revise its Privacy Policy at any time it deems appropriate. For this reason, we ask that you regularly check this Privacy Policy to read the most recent version.

However, any changes to this Privacy Policy will be communicated to the User.

The Orbe website may contain links to third-party websites (external companies, entities or platforms). Access to these links is the sole responsibility of the User.

Orbe does not control, supervise or take responsibility for the way in which these third parties treat the protection of privacy and personal data. For this reason, we recommend that Users carefully read the corresponding Privacy Policies and Legal Notices before browsing or providing personal information on these websites.

The fact that the Website includes links to third parties does not imply in any case the existence of a relationship, recommendation, promotion or approval by Orbe with regard to the content of such sites, nor does it imply the assumption of liability for any damages that may arise from accessing or using them.

16. Questions

If you have any questions about our Privacy Policy, please contact us by sending an email to support@orbe.app.

Likewise, if you consider that your rights are not properly safeguarded, you have the right to file a complaint with the Spanish Data Protection Agency, whose contact details are:

17. Acceptance

The User acknowledges having read and understood this Privacy Policy, declaring that they are informed of the conditions applicable to the processing of their personal data and freely, specifically, knowingly and unequivocally accepting the processing thereof by MUSHDESK, S.L. in the manner and for the purposes described in this document.

Acceptance of this Privacy Policy is a necessary requirement for using the Website and/or the features associated with Orbe's services. If the User does not agree, they must refrain from using the Website or the linked services.

"MUSHDESK, S.L.". Total or partial reproduction is prohibited. All rights reserved.