HAPPY ORBIS · 2026-11-02
Privacy Policy
How Happy Orbis processes personal data when you use our public platform, community and Ocean Gifts.
These legal documents are available in English and Czech. This page shows the English version.
Happy Orbis — MAŃSKI s.r.o.
Nové sady 988/2, Staré Brno, 602 00 Brno, Czech Republic
Company ID: 08901651 · VAT ID: CZ08901651
hello@happyorbis.com
MAŃSKI s.r.o. is the legal operator of Happy Orbis and the seller of Ocean Gifts.
Controller and contact
MAŃSKI s.r.o. is the controller for Happy Orbis. Contact hello@happyorbis.com for privacy questions or requests. Operator details are set out above.
Accounts, profiles and community
We store your name, email address, password hash, verification and password-reset records, and sign-in sessions to provide your account (GDPR Article 6(1)(b)). Profiles start private. If you publish a profile, selected profile fields, avatar, interests, country and public activity can be seen by visitors and search engines. Discussion posts, replies, reactions, follows, event and observation records are linked to your account. Private messages and contact requests are stored to provide member communication; they are not public and are not end-to-end encrypted. Do not upload sensitive personal data, private addresses or information about another person without an appropriate basis.
Contact and service requests
Contact forms and professional service requests store the details you submit, including name, email, organisation, message and requested scope. We use these to respond and take steps at your request before a contract, or on our legitimate interest in handling other inquiries (Article 6(1)(b) or (f)). Account security and order messages are transactional. Submitting an inquiry or buying a gift does not subscribe you to a marketing newsletter.
Ocean Gifts and payments
To fulfil a purchase we process the buyer’s contact details, recipient and sender names, dedication, animal, language, delivery choice, order and payment references (Article 6(1)(b)). Recipient details supplied by the buyer are used to deliver the requested gift on our legitimate interest in fulfilling it (Article 6(1)(f)); recipients can contact us to object. The buyer must be an adult and authorised to provide those details. Payment and tax records are also processed to meet legal obligations (Article 6(1)(c)). Stripe handles payment credentials; Happy Orbis does not store full card numbers or card security codes. Personalised order details are encrypted in application storage. A certificate verification URL can reveal recipient and sender names, species, issue date and validity to anyone who has its identifier. Public social sharing is off by default and excludes the dedication and email addresses. Optional Guardian recognition requires a separate choice and can be withdrawn.
Technical data and browser storage
Hosting processes request metadata, including IP address, browser information, time and errors, for delivery and security. The application uses hashed identifiers for rate limiting, operational event records and pseudonymous gift interaction records. These are not all anonymous. We use legitimate interests in service reliability, abuse prevention and understanding service use (Article 6(1)(f)). Necessary account and order-access cookies and stored preferences are explained in the Cookies notice. No advertising trackers are installed.
Providers and international access
The platform is hosted through OpenAI Sites on Cloudflare infrastructure, with Cloudflare D1 database and R2 file storage. Resend sends account and gift emails and processes delivery information. Stripe processes payments, fraud checks and applicable tax information, in some cases as an independent controller. Better Auth is the account software running in our application, not a separate hosted identity provider. A legacy Supabase session can be refreshed when a corresponding existing cookie is present; current community registration uses the application database. Environmental imagery is requested from public data providers, including NASA and EMODnet, using map area and date rather than contact details. External links and publicly shared content may be accessed outside the EEA. Infrastructure and payment providers can process data internationally under their applicable data-protection arrangements, including contractual safeguards where required. We do not claim that all processing takes place exclusively in the EU. Contact us for information about safeguards relevant to your data.
Retention
Account data is kept while the account is used and as needed to handle closure, disputes or legal obligations. Public content remains until withdrawn or moderated; search engines and recipients may retain copies outside our control. Contact requests are kept while being handled and as needed to document the resulting relationship or claims. Order, tax and payment evidence is retained for applicable accounting and tax periods; Czech VAT documents are generally retained for ten years. This does not mean all optional recipient details must be retained for that period. Gift access cookies expire after 30 days and the guest order cookie after 180 days. Rate-limit entries expire after two minutes and are removed during request-driven cleanup. Non-order gift events and delivery receipts are eligible for cleanup after 90 days when the maintenance job runs; this is not a guarantee of deletion on day 90. There is no universal automatic deletion deadline for all application records. We assess deletion requests against the purpose and any legal retention requirement.
Your rights
You may request access, correction, erasure, restriction or portability where applicable, object to processing based on legitimate interests, and withdraw consent for optional public recognition without affecting earlier lawful processing. Write to hello@happyorbis.com; we may need proportionate identity verification. We normally respond within one month; legally permitted extensions will be explained. You may complain to the Czech Office for Personal Data Protection (uoou.gov.cz) or your local supervisory authority. Account deletion can be requested by email; making a profile private alone does not delete the account. We do not use these records for solely automated decisions producing legal or similarly significant effects.