orla.bio

Legal

Privacy Policy

How Orla collects, uses, and protects your personal data.

This Privacy Policy explains how Orla (“we”, “us”, or “our”), operated by 0xbellman (CVR 46506847), collects, uses, stores, and protects your personal data when you visit orla.bio or use our services.

By using our website or signing up for our waitlist, you agree to the practices described in this policy. If you do not agree, please do not use our website or services.

Who we are

What data we collect

Waitlist and account information

When you join our waitlist or create an account, we collect:

  • Email address
  • Instagram, TikTok, or other social media handle
  • Platform and content niche
  • Product categories and specific products you are interested in

We use this information to communicate with you, match you with suitable products, and onboard you as a brand partner.

Analytics and usage data

We collect information about how visitors use our website to improve performance and conversion. This includes:

  • A session ID stored in a cookie
  • Pages visited and time spent on the site
  • Referrer and UTM parameters (e.g. utm_source, utm_medium, utm_campaign)
  • Rough country/region based on IP address
  • IP address, used only for excluding internal traffic and preventing abuse

Cookies

We use a minimal analytics cookie (orla_sid) to associate your activity with a session. This cookie expires after 8 hours. We do not use third-party advertising cookies or trackers.

How we use your data

We use personal data for the following purposes:

  • To operate the waitlist and notify you when founding brand partner spots open
  • To match creators with relevant products and catalog updates
  • To communicate with you about your account, payouts, and support requests
  • To process orders, payments, and fulfillment as merchant of record
  • To analyse website usage and improve our landing page, onboarding, and product experience
  • To comply with legal obligations, including tax and accounting requirements

Legal basis for processing

We process personal data under the following legal bases:

  • Consent: when you join the waitlist or accept analytics cookies
  • Contractual necessity: to set up your storefront, process orders, and pay your commissions
  • Legitimate interest: to measure website performance, prevent fraud, and improve our services
  • Legal obligation: to meet tax, accounting, and consumer protection requirements

How we share your data

We do not sell your personal data. We share data only with trusted service providers who help us run our business, such as:

  • Cloud hosting and database providers (e.g. Cloudflare)
  • Payment processors (e.g. Stripe)
  • EU-based fulfillment and white-label manufacturing partners (e.g. for printing labels and shipping orders)
  • Email and customer support tools
  • Accounting and legal advisors

These providers are contractually bound to process your data only on our instructions and in compliance with applicable data protection laws.

International transfers

Our primary operations are in the EU, UK, and Switzerland. If any data is transferred outside the European Economic Area, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or equivalent protections.

Data retention

We keep your data only as long as necessary:

  • Waitlist data is retained while you remain on the list and for up to 2 years afterwards unless you request deletion
  • Account and transaction data is retained for as long as required by tax and accounting laws
  • Analytics session data is retained for up to 90 days, or longer in aggregated form

Your rights

Under the GDPR and similar laws, you have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate or incomplete data
  • Request deletion of your data (“right to be forgotten”)
  • Restrict or object to certain types of processing
  • Receive your data in a portable format
  • Withdraw consent at any time
  • Lodge a complaint with your local data protection authority

To exercise any of these rights, contact us at [email protected].

Security

We use industry-standard technical and organisational measures to protect your personal data, including encryption in transit, access controls, and regular security reviews. No online service can guarantee complete security, but we take reasonable steps to keep your data safe.

Children

Our services are not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us and we will delete it.

Changes to this policy

We may update this Privacy Policy as our service evolves. We will post the revised version on this page with an updated effective date. Significant changes will be communicated via email where appropriate.

Contact us

If you have questions about this Privacy Policy or how we handle your data, contact us at [email protected].

Effective date: 26 July 2026