Skip to content
Menu

MCTnexus LLC Privacy Policy

Last updated: October 26, 2026.

Who we are and what this notice covers

MCTnexus LLC, an Ohio company, operates mctnexus.com and the Orbit application at mctorbit.com. This notice covers our websites, inquiries and support, billing and subscriptions, and Orbit accounts and workspaces. Contact us at info@mctnexus.com.

Your organization and its workspace

We determine how information is used for our business relationships, inquiries, billing, subscription administration and service security. Your organization determines what information to enter into Orbit, whom to invite and how to use its workspace. We operate that workspace for the organization. Its workplace policies and customer agreement also apply. If you use Orbit through an employer or another organization, ask it about its purposes and authorized access.

Information we handle

  • Inquiries and support: names, company and contact details, project requirements, and correspondence you send us. Do not send passwords or sensitive production files in an initial inquiry.
  • Accounts and billing: names, usernames, email and billing details, company identifiers, plans, seats, subscription dates, payment references and status, and account communications. Our website and Orbit exchange company and owner details, plan and seat information, billing identifiers and subscription events to provision and manage access.
  • Workspace records: information entered by your organization and users, including projects, tasks, assignments, schedules, time entries and approvals, costs, budgets, meeting notes, comments, priorities, scorecards, forms, directory details, goals and time-off information. Available records depend on the features and plan used.
  • Security and operation: connection information, IP addresses or derived security identifiers, browser/device information, session and account identifiers, authentication and administrative events, timestamps, request identifiers and errors. We process credentials and account-security records to authenticate users and protect access.
  • Order attribution: referral and campaign information, landing pages, device type and session activity associated with commerce visits and orders, as described below.

Why we use information

We use information to respond to inquiries; provide services and support; create and secure accounts; provision workspaces; manage subscriptions and seats; process payments and subscription changes; deliver requested workspace functions and service messages; diagnose failures; investigate misuse; understand sources of orders; and keep records for accounting, disputes and applicable legal obligations.

Who can access workspace information

Orbit scopes ordinary application access to the user’s company. Operational project information is shared within that company; projects are not private spaces with separate project membership. Roles restrict changes and access to financial and administrative information. Company administrators manage accounts and permissions. Time-off and people-management records have additional role and reporting-line restrictions.

Authorized MCTnexus operators and infrastructure administrators can have technical access needed to operate, recover, troubleshoot or support the service. Company role restrictions do not prevent separately authorized infrastructure access. Information in a shared workspace is not necessarily visible only to its author.

Providers and disclosures

Microsoft Azure hosts Orbit and its MySQL database in Central US, including managed database backups and configured web-server logs. DreamHost hosts our WordPress website and database and provides website SMTP email. Inquiries, billing records, email content and associated technical information are processed on those systems. Recovery copies also exist on operator-controlled storage and DreamHost and can contain information from the systems they back up.

Stripe processes payment, payment-method, transaction and fraud-prevention information. Its commerce components can receive browser and connection information. Our billing system retains payment and customer references and transaction information. See Stripe’s privacy notice. Stripe’s payment flow can also load hCaptcha, operated by Intuition Machines, which processes connection/device information and interactions for abuse prevention. See hCaptcha’s privacy notice.

Have I Been Pwned’s Pwned Passwords service helps screen new Orbit passwords. Orbit sends the first five hexadecimal characters of a password’s SHA-1 hash from its server and compares the results locally. It does not send the full password or full hash. The provider also receives our server’s connection information.

WordPress, WooCommerce and other installed software support these functions; installation does not mean a publisher receives all information stored in that software. Separately linked services have their own privacy practices. We may disclose information at your or your organization’s direction, under applicable law or valid legal process, to address fraud or security incidents, to establish or defend legal rights, or in connection with a business transfer subject to applicable protections.

Advertising and AI

Our business policies prohibit selling personal information, sharing it for targeted advertising, and using customer workspace content to train general-purpose AI models. These restrictions do not prevent the hosting, payment, security and other service processing described here. Payment and security providers may use automated models for fraud and abuse detection.

Cookies and browser storage

Account, session, cart, checkout and security functions use cookies or browser storage. Orbit also stores interface preferences in the browser. Blocking or removing storage can interrupt sign-in or checkout.

WooCommerce order attribution is currently enabled. It uses first-party Sourcebuster cookies, including cookies with names beginning sbjs_, to associate referral sources, campaign parameters, landing pages, device type and session activity with orders. Order-attribution information is stored with an order when one is placed. Browser controls can block or remove these cookies. See WooCommerce’s order-attribution documentation.

Retention, cancellation and deletion

Cancelling a subscription, ending a trial, disabling a user or archiving a project does not automatically erase its information. Expired Orbit subscriptions normally restrict workspace changes while retaining records. Exports depend on permissions and the relevant feature; Orbit does not provide general self-service workspace erasure.

Our billing settings do not set automatic time limits for removing inactive accounts, orders, ended subscriptions or Stripe-related records. Workspace and audit records also do not have a general automatic deletion deadline. Records can remain until a separate deletion or retention action is carried out. Requests are assessed against the record’s purpose, the organization’s instructions, other people’s information, accounting and legal requirements, disputes and security needs.

Orbit’s Azure web-server logs have a three-day retention setting, subject to a 100 MB size limit; database audit and security records are separate. Azure database backups have a seven-day retention setting. Manual, deployment and website recovery copies do not have a verified uniform expiry schedule. Deleting an active record does not immediately remove every recovery copy, and the seven-day setting does not apply to all copies.

Requests and choices

Email info@mctnexus.com to ask about your information or request access, correction or deletion. Identify the account or inquiry without sending a password. Zaid Hanandeh is responsible for privacy requests. We may verify identity and authority using reasonably necessary information; do not send identity documents unless we explain why they are needed. For organization workspace data, contact its administrator first; you may also contact us to help route your request.

Depending on applicable law, you may have rights to receive a copy, correct or delete information, restrict or object to processing, withdraw consent where processing relies on consent, or complain to a regulator. We will not discriminate for exercising rights provided by law. Reply to the privacy contact to request review of a response; we will explain any applicable appeal process. Exceptions and procedures depend on the law and records involved. Withdrawal of consent does not affect earlier lawful processing.

Locations, security and updates

Orbit’s application and database are hosted in the United States. Other providers, recovery storage and authorized operational access may involve additional locations. Provider processing is not limited to Orbit’s primary database location. We use access restrictions and security measures, but no service guarantees complete security. Keep credentials private and report suspected unauthorized access promptly.

Orbit is offered to U.S. business customers and their authorized users. Our services are not intended for children. A customer’s location does not determine every user’s location or which laws apply. Contact us if you believe a child has supplied personal information. We will update this notice as practices change and provide additional notice where required. This notice does not override applicable law or the customer agreement.