Privacy policy

Privacy policy

Who we are. Orion RFX is run by Ross James Hayes, a sole trader, at Lytchett House, 13 Freeland Park, Wareham Road, Poole, Dorset, BH16 6FA, United Kingdom. We are the controller of the personal data described here. Contact: hello@orionrfx.com.

What we collect. When you buy: name, email, billing address, order details and, for indicators, your TradingView username (card details are handled by Shopify Payments and never reach us). Your account and licences: email, licence keys, plan and activation dates. When you contact us: your messages. When you browse: pages viewed, device and browser type, approximate location and how you arrived, through cookies (see below and our cookie policy). In the Nebula app: only what the Polaris and crash report sections below describe.

Who we share it with. Only the services that run the shop and the app: Shopify (store, checkout, payments, accounts and marketing emails you sign up for), Google (Google Analytics 4 and Google Ads, only with your consent), Cloudflare (licence checks, Polaris, crash reports), Resend (licence and download emails) and TradingView (your username, to switch on indicator access). We never sell your data.

International transfers. Shopify, Google, Cloudflare and Resend may process data outside the UK, including in the United States, under the UK International Data Transfer Addendum or the UK Extension to the EU-US Data Privacy Framework.

Complaints. If you are unhappy with how we handle your data, email hello@orionrfx.com with "Data complaint" in the subject. We acknowledge within 30 days and tell you what we will do. You can also complain to the ICO (ico.org.uk, 0303 123 1113).

LAWFUL BASIS FOR PROCESSING (UK GDPR Article 6)

We process your data under the following lawful bases:

- Contract performance: to fulfil orders, provide product access, and deliver mentorship sessions you purchase.
- Legitimate interest: to detect fraud, prevent abuse, improve our products, and send service-related communications (e.g. product updates, security notices).
- Consent: for marketing emails, optional analytics cookies, and any data processing not strictly necessary for the contract.
- Legal obligation: to retain accounting records for HMRC (6 years), respond to lawful requests from authorities, and meet AML/KYC obligations if applicable.

DATA RETENTION SCHEDULE

- Order and transactional data: 6 years (UK HMRC requirement)
- Customer account data: retained while account is active, deleted within 30 days of account closure unless legal hold applies
- Marketing data: deleted on unsubscribe or after 24 months of inactivity, whichever is sooner
- Support correspondence: 2 years from last interaction
- Server logs and security data: 90 days
- Polaris contributions (anonymised): bounded rolling store on Cloudflare, oldest deleted first; deleted on request by contributor tag
- Crash reports from the Nebula app: 90 days

COOKIES

Strictly necessary (no consent needed): cart, checkout, login, security and your cookie choice. Analytics (consent): Google Analytics 4 and Shopify Analytics. Advertising (consent): Google Ads. Until you choose, analytics and advertising stay off. Change your choice any time with "Cookie settings" in the footer. Full list: our cookie policy.

POLARIS SHARED LEARNING (NEBULA DESKTOP APP)

Nebula includes a shared learning network called Polaris. Each member's copy of Nebula contributes anonymised learning data and receives anonymised learning data from other members, so that the strategy-evaluation model running on each member's own machine improves with the experience of the whole network. Contributions are made by the app automatically; no person reads them. Polaris shares two kinds of anonymised data, and nothing outside these two lists is sent.

(a) Strategy research data, on by default, which you may opt out of at any time. When a backtest finishes, Nebula may send: the strategy's structure and settings, encoded as a numeric fingerprint and numeric features (never your strategy files, code or names); the backtest's outcome scores and statistics, with the market, timeframe and month tested; and the coarse configuration used for the test, as percentages and settings (never your account size, leverage, currency or balance).

(b) Anonymised performance outcomes, sent only with your express consent, which you give or decline in the app. Once a system you have deployed, or a system your copy of Nebula has re-tested on later market data, has produced at least 30 trades, Nebula may send, for that strategy fingerprint: whether it held up (yes or no); its profit factor, win rate, drawdown and trade count, each reduced to one of four coarse bands; the confidence grade Nebula had given it, and whether it was still profitable after 90 and 180 days (yes or no); whether the result landed inside the range Nebula had predicted for it; how much of each trade's best point the system kept, as one of four bands; whether the outcome came from real trading or from a re-test on later data; and the calendar month the outcome window ended in. These are bands and yes-or-no flags only. No amount of money, no account currency, no position sizes, no trade timestamps, no broker, no account or ticket numbers, and no trade-by-trade record is ever sent.

What is never sent, in either kind: your name, email address, postal address or licence key; your machine ID, hardware identifiers or IP-derived identity; any account, broker, balance, deposit, equity, position-size, currency or profit-and-loss figure; your strategy files or source; or any free text you type. Your copy of Nebula removes these before anything leaves your machine, and the network's servers independently reject them if they ever arrive.

Your consent to performance-outcome sharing. You give it by accepting the Nebula agreement on an installer that presents its Version 2 (or later) wording, or by choosing "Share anonymised live outcomes" when the app asks you. You may withdraw at any time in Settings > Collection. Withdrawal is as easy as giving consent, takes effect from that moment, and does not affect anything shared before it. Declining or withdrawing has one consequence: your copy of Nebula stops receiving the network's performance-derived learning. Everything else continues to work as before. If we change what is shared or how it is described, the app asks you again before sharing under the new description.

Anonymity. Each installation generates a random contributor tag. It is not derived from your name, email, licence, machine or IP address, and no record linking it to you is held anywhere. It exists so that identical data from one installation is not counted twice, and so that you can ask for your contributions to be removed. Figures are reduced to coarse bands, dates to months, and an outcome is shared only once it rests on at least 30 trades, so that neither we nor any other member can single you out or reconstruct your trading. We treat the shared data as anonymous information rather than personal data. Where any of it could nonetheless be personal data, our lawful basis is your consent (UK GDPR Article 6(1)(a)) for performance outcomes and our legitimate interest in improving Nebula for all members (Article 6(1)(f)) for strategy research data, against which you may object at any time by switching Polaris off.

Use. Shared data is used only to train and calibrate the strategy-evaluation model that runs on each member's own machine, and to show members anonymised, aggregated network statistics. It is never sold, rented or licensed; never used to identify, profile, score or market to you; never combined with your purchase, licence or support records; and never used to make any decision about you. Polaris influences suggestions inside your own software, which you remain free to accept or ignore.

Storage and retention. Contributions are stored on our network servers, which run on Cloudflare's global infrastructure and may be stored or processed outside the United Kingdom. Because the data is anonymised as described above, no international-transfer safeguard is required; where any of it were personal data, transfers are covered by Cloudflare's UK Addendum and Standard Contractual Clauses. The network keeps a bounded rolling store, deleting the oldest contributions first when it is full. A copy of the network's shared data is also held on each member's machine as part of their local model and is removed when they uninstall Nebula or clear its data.

Your rights and controls. You have the rights of access, rectification, erasure, restriction, objection and data portability, and the right to withdraw consent at any time. Because shared data is anonymous we cannot usually identify which contributions are yours; if you give us your contributor tag we will delete every contribution carrying it. To find it, open the Polaris tab → shared network in the app: the node marked “you” shows your tag. Send it to hello@orionrfx.com (or the live chat). You may complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113), or, in the EEA, to your local supervisory authority. Settings > Collection lets you turn Polaris off entirely, or keep strategy research sharing on while declining performance-outcome sharing. A choice to stay off is never overridden by updates or reinstalls on the same machine.

CRASH REPORTS (NEBULA DESKTOP APP)

When you press Report a problem in the Nebula app, or if you have turned on automatic crash reports, the app sends us a crash report. It contains the app's recent logs, including crash and error details, the app version, your operating system type, a random identifier for your installation, and any note you add. It does not contain your trading credentials.

The report is encrypted on your device before it is sent and can only be opened by our support team. We use crash reports only to find and fix problems in Nebula. We never sell them, never use them for marketing, and never combine them with Polaris data.

Our lawful basis is our legitimate interest in supporting you and keeping Nebula working (UK GDPR Article 6(1)(f)) for reports you choose to send, and your consent (Article 6(1)(a)) for automatic reports. Automatic reports are off unless you turn them on, and you can turn them off at any time in Settings > Support.

We keep crash reports for 90 days and then delete them. They are stored on Cloudflare's infrastructure and may be processed outside the United Kingdom under Cloudflare's UK Addendum and Standard Contractual Clauses. To have a report deleted sooner, contact us with its reference, which the app shows when you send it.

DATA PROTECTION CONTACT

Data protection enquiries: hello@orionrfx.com
Postal: Lytchett House, 13 Freeland Park, Wareham Road, Poole, Dorset, BH16 6FA, United Kingdom
You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.