Privacy Policy — Orbiter

1. Software publisher

Orbiter is a software developed and distributed by D4.FR, a simplified joint-stock company under French law.

2. Scope of this document

This document describes the data that the Plesk extension Orbiter collects on the servers where it is installed, as well as the data processed in the context of the associated technical support.

It applies to any version of Orbiter from version 1.5.4 onwards and covers the relationship between D4.FR and the server administrators who install the extension (hereinafter "the administrator").

This policy is accessible before any installation via the extension listing in the Plesk Marketplace. Installing the extension constitutes acceptance of the conditions described in this document.

D4.FR may act as a data controller when processing data for its own purposes (telemetry, support), and as a data processor when the administrator uses Orbiter to manage environments hosting third-party data. In the latter case, the administrator remains the controller with respect to its own end users.

3. Data transmitted — telemetry

Orbiter makes exactly two HTTPS requests over its lifetime on a given server: one at installation or update, the other at uninstallation. No request is made during normal operation.

This telemetry is inherent to the software's operation. It allows D4.FR to identify the servers on which Orbiter is installed, track version adoption and ensure compatibility coverage of supported environments.

Each request transmits the following information:

This data is transmitted via a secure HTTPS connection to D4.FR servers. The transmission is non-blocking: in case of failure, the install or uninstall operation continues normally and the failure is logged locally.

4. Data not transmitted

Orbiter does not transmit, during telemetry or otherwise, the following information under any circumstances:

• Email addresses, names or contact details of hosted customers
• Domain names hosted on the server
• Container names or per-container resource usage
• Database names, users, schemas or content
• Application logs, error reports or technical traces
• Server IP address (not included in the request body)
• Plesk license key, customer ID or Plesk account
• Cookies, session tokens or browser fingerprints

The server's IP address is naturally visible at the network layer during any outbound connection. D4.FR does not include it in the telemetry request body and does not retain it for identification purposes.

5. Data stored locally on the server

Independently of telemetry, Orbiter maintains a local database on the server. This database describes the containers managed (domain / container / PHP version mapping, ports, configuration options). It never leaves the server and cannot be accessed remotely by D4.FR.

Orbiter's operational logs are also stored locally. They are not transmitted to D4.FR.

This local data survives the uninstallation of the extension to allow later restoration of configurations.

6. Technical support and request handling

Support organization

Orbiter's technical support is organized in two successive levels:

Level 1 — AI Agent. Any support request submitted by email is first handled by an artificial intelligence agent. This agent analyses the content of the request and formulates an automated response. It operates strictly in a consultative and informational mode: it does not make any decision affecting the requester's rights, service access or contract.

Level 2 — Human operator (escalation). If the AI agent's response is unsatisfactory — either because the requester explicitly says so, or because the complexity of the request justifies it — the request is automatically escalated to a human D4.FR operator.

Response time commitment (SLA)

Maximum first response time: 48 business hours

This timeframe starts from the creation of the request and applies to business days from Monday to Friday, excluding French legal public holidays.

Data processed in the context of support

When interacting with support, D4.FR processes the information communicated in the request: email address, message content, technical information provided to describe the issue.

The history of exchanges is retained to improve service quality. Data processed by the AI agent is not used to train general artificial intelligence models unrelated to the provision of the support service.

When D4.FR intervenes on your server as part of a support service, it acts as a data processor within the meaning of the GDPR. Any access is strictly limited to the scope necessary to resolve the reported issue and ends at the conclusion of the intervention.

7. Retention periods

When the applicable period expires, the data is deleted or irreversibly anonymized. D4.FR may proceed with early deletion upon a substantiated request, unless retention is required by a legal obligation.

8. Security and international transfers

Security measures

D4.FR implements appropriate technical and organizational measures to protect the data processed against unauthorized access, loss, alteration or disclosure. Data transmissions are carried out via HTTPS connections with TLS verification. Access to D4.FR systems is restricted to authorized personnel as part of their duties.

Transfers outside the European Union

D4.FR is a company established in France. Telemetry and support data is processed primarily on infrastructure located within the European Union. Should certain operations involve a transfer to a third country, D4.FR ensures that such transfer is governed by appropriate safeguards in accordance with Chapter V of the GDPR, in particular by recourse to standard contractual clauses (SCCs) adopted by the European Commission.

9. Automated decisions and artificial intelligence

D4.FR uses an artificial intelligence agent as part of its technical support (see section 6). This agent generates informational and consultative responses.

D4.FR does not make any fully automated decisions producing legal effects or significantly affecting the data subjects, within the meaning of Article 22 of the GDPR. Any decision with a substantial impact is subject to human intervention.

Data processed by the AI agent is not used to train artificial intelligence models for purposes other than providing the support service.

10. Minors

Orbiter is a software intended for hosting and server administration professionals. D4.FR's services are not directed at persons under 18 years of age and D4.FR does not knowingly collect personal data from them.

If D4.FR were to learn that it had collected data relating to a minor without the required parental consent, it would proceed to delete this data as soon as possible.

11. Legal bases and data subject rights

In accordance with the GDPR, every data subject has the following rights:

• Right of access (art. 15) — Obtain confirmation that data concerning you is being processed and receive a copy.
• Right to rectification (art. 16) — Have inaccurate data concerning you corrected.
• Right to erasure (art. 17) — Request the deletion of your data, subject to applicable legal retention obligations.
• Right to restriction (art. 18) — Request restriction of processing in cases provided for by the regulations.
• Right to portability (art. 20) — Receive your data in a structured, commonly used and machine-readable format.
• Right to object (art. 21) — Object to processing based on legitimate interest by justifying your particular situation.

D4.FR commits to responding to any request within one month of receipt, extendable by two months for complex requests.

You also have the right to lodge a complaint with the CNIL (the French data protection authority) — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — or with your local supervisory authority, if you believe that the processing of your data does not comply with applicable regulations.

12. Contact and exercising rights

For any question regarding this policy, to exercise your rights or for any technical support request:

13. Changes

D4.FR reserves the right to update this policy to reflect functional changes to Orbiter or applicable legal and regulatory requirements. The update date in the header is refreshed with each revision.

In the event of a substantial change affecting the nature of the data collected or its purposes, a notification will be included in the extension's release notes. Continued use of the extension after publication constitutes acceptance of the new provisions.