Privacy Policy

Last updated: April 28, 2026

1. Who We Are

KeywordOrbit is operated by Balmer Island Media Inc., a corporation registered in British Columbia, Canada ("KeywordOrbit", "we", "us", or "our"). This Privacy Policy explains how we collect, use, share, and protect personal information when you use the KeywordOrbit desktop application and associated services (collectively, "the Software"). For purposes of the EU/UK General Data Protection Regulation, Balmer Island Media Inc. is the "controller" of personal data described in this Policy. For purposes of the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), Balmer Island Media Inc. is the "business".

2. Information We Collect

We collect the minimum information needed to operate the Software:

• Account information: your email address and (optionally) name provided at sign-up, trial start, or purchase.
• Billing information: processed and stored by our payment processor (currently Paddle, acting as merchant of record). We do not receive or store full payment card details.
• License and usage data: subscription plan, trial status, license key activations, credit balance (monthly, annual, or credit pack), credit consumption, feature usage, and error reports, used to operate the service, enforce plan limits, and prevent abuse.
• Device information: operating system, app version, and anonymized diagnostic information for support and debugging.
• Communications: the content of emails or support messages you send us.

What we do NOT collect: We do not collect, receive, transmit, or store any credentials, cookies, session tokens, or browsing data from third-party accounts (such as a Google account) that you sign into from inside the Software. All such authentication happens locally on your device and remains on your device. We do not proxy, inspect, or log any traffic between your device and third-party services.

3. How We Use Your Information

• To provide, operate, and maintain the Software and related services.
• To process payments, manage subscriptions, and issue license keys.
• To send transactional emails (receipts, license keys, account alerts, important service updates).
• To send product announcements and marketing emails (you can opt out at any time).
• To respond to support requests and improve the product.
• To detect, prevent, and investigate fraud, abuse, and security incidents.
• To comply with legal obligations.

Lawful basis (EU/UK users). Where the GDPR applies, we rely on the following lawful bases for processing: (a) performance of a contract with you, for account creation, billing, license enforcement, and providing the Software; (b) our legitimate interests, in operating, securing, and improving the Software, preventing fraud and abuse, and conducting basic product analytics, where those interests are not overridden by your rights; (c) your consent, for marketing emails and any optional analytics, which you may withdraw at any time without affecting service; and (d) compliance with legal obligations, such as tax, accounting, and responding to lawful requests.

We do not use your data to train third-party AI models, and we do not sell or rent your personal information.

4. Keyword Queries, Search Volume Data, and Google Services

When you use features that look up search volume through a third-party data provider (such as DataForSEO), the keywords you query are transmitted to that provider so they can return the requested data. These queries are processed in order to fulfill your request and are not linked to your personal identity beyond what is strictly necessary for billing and fraud prevention.

Google Services. When you use features that access Google services (including Google Ads, Google Keyword Planner, Google Search, Google Trends, or Google Search Console) by signing in with your own Google account from within the Software, those requests go directly from your device to Google. KeywordOrbit does not act as an intermediary or proxy for that traffic, does not receive or store your Google credentials, OAuth tokens, cookies, or session data on our servers, and does not transmit your Google account information to any third party. Your interaction with any Google service is governed by Google's own privacy policy and terms, available at policies.google.com/privacy, and is subject to the additional risk disclosures in Section 5A of our Terms of Service, including the risk that Google may suspend or terminate your Google account.

5. Data Sharing

We do not sell your personal information. We share data only with the following categories of service providers, and only as needed to operate KeywordOrbit:

• Payment processor (currently Paddle) — billing, tax compliance, and fraud prevention.
• Email provider (currently Resend) — transactional and marketing email delivery.
• Search volume data provider (currently DataForSEO) — keyword queries you submit via the API lookup feature.
• Hosting and infrastructure providers — for storing account data, logs, and backups.
• Legal authorities — if required by a valid legal process (subpoena, court order, or similar).

6. International Data Transfers

Our servers and third-party service providers may be located in Canada, the United States, or other countries. By using the Software, you consent to the transfer of your information to these jurisdictions, which may have different data protection laws than your country of residence.

7. Data Storage, Retention, and Security

Account and billing data is stored on secured servers. We use industry-standard encryption (TLS) for data in transit and encryption at rest where supported by our infrastructure providers. No security measure is perfect, however, and we cannot guarantee that personal data will never be subject to unauthorized access, disclosure, alteration, or destruction.

Typical retention periods, subject to extension where required by law or for the establishment, exercise, or defence of legal claims:

• Account and license data: for the life of your account and up to 7 years after closure for tax, accounting, and audit purposes.
• Billing records: 7 years (Canadian and US tax retention norms).
• Operational logs and diagnostics: typically up to 90 days.
• Support correspondence: typically up to 3 years from the last interaction.
• Marketing preferences and unsubscribe lists: indefinitely, to honor your opt-out.

You may request deletion at any time (see Section 8). We may retain limited information after a deletion request where necessary to comply with legal obligations, resolve disputes, prevent fraud, or enforce our agreements.

8. Your Rights

Depending on your jurisdiction, you may have the right to access, correct, delete, export, restrict, or object to the processing of your personal data, and the right to withdraw any consent you have previously given. To exercise any of these rights, email us at contact@keywordorbit.com from the email address on file or include sufficient information for us to verify your identity. We will respond within 30 days (extendable by an additional period where permitted by law for complex requests). We will not discriminate against you for exercising your rights.

EU/UK (GDPR) residents additionally have the right to lodge a complaint with a supervisory authority (in the UK, the Information Commissioner's Office; in the EU, your local data protection authority).

California (CCPA/CPRA) residents have the right to know what personal information we collect and how it is used and shared, the right to delete personal information (subject to exceptions), the right to correct inaccurate information, the right to limit the use of sensitive personal information, and the right to opt out of any "sale" or "sharing" of personal information. We do not sell or share personal information for cross-context behavioral advertising as those terms are defined under California law. An authorized agent may submit a request on your behalf with proof of authorization.

Do Not Track. Our website does not respond to "Do Not Track" browser signals because no industry standard for honoring them has been adopted; however, we limit our website tracking to the minimum cookies described in Section 9.

9. Cookies

Our website (keywordorbit.com) may use minimal cookies for essential functionality and basic analytics. The desktop application does not use tracking cookies.

10. Children's Privacy

The Software is not directed at children under 16 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If a change is material, we will notify you by email or in-app notice before it takes effect. The "last updated" date above will always reflect the current version. Continued use of the Software after the effective date of an update constitutes acceptance of the updated Policy.

12. Limitation of Liability

To the maximum extent permitted by law, our liability for any claim arising out of or relating to this Privacy Policy or the processing of your personal data is governed by, and limited as set out in, the Terms of Service, including the limitation of liability and dispute-resolution provisions in those Terms. Nothing in this Policy limits or excludes any right or remedy that cannot be limited or excluded under applicable law.

13. Contact

Questions, requests, or concerns? Contact us at contact@keywordorbit.com.

Mailing address: Balmer Island Media Inc., British Columbia, Canada.