Privacy Policy

This Privacy Policy explains how Orbit Technologies, LLC ("Orbit," "we," "us," or "our") collects, uses, shares, and protects personal information. It applies when you visit goorbit.app, use the Orbit web application or a client portal hosted by Orbit (including portals on a customer's custom domain), open a share link, receive our emails, or otherwise interact with us (together, the "Services").

Company: Orbit Technologies, LLC
Address: 627 Opelousas Ave STE 71290, New Orleans, LA 70114
Privacy contact: hello@goorbit.app (subject: "Privacy")

Capitalized terms not defined here (such as Customer, Team Members, Client Users, and Customer Content) have the meanings given in our Terms of Service.

The short version:

• Agencies own their content. Orbit hosts it to provide the Services and for no other purpose.
• We do not sell personal information, and we do not use your content to train AI models.
• We use a small set of named service providers (listed in Section 7) to run the Services.
• Orbit is available only to businesses in the United States, and we store and process data in the U.S.
• You can export your data anytime. After cancellation it is deleted on a published schedule (Section 9).

---

1. Who is responsible for your information

1.1 Customer Content: the agency is in charge. Orbit is a business tool that agencies ("Customers") use to share work with their clients. When a Customer uploads media, invites clients, or adds contacts, the Customer decides what is collected and why. For this information, the Customer is the "controller" or "business" (U.S. state privacy laws), and Orbit is its "processor" or "service provider." We process Customer Content only on the Customer's instructions, as set out in our Terms and any Data Processing Addendum ("DPA").

1.2 Orbit's own information: Orbit is in charge. For information we collect to run our own business, Orbit is the controller. This includes website visitors, account and billing details for our Customers, product analytics, security logs, and support and marketing communications.

1.3 If you are a client of an agency. If you were invited to an Orbit portal by an agency, that agency controls the content you see and the information it holds about you. Please send requests about that content (for example, to access, correct, or delete it) to the agency. If you contact us instead, we will forward your request to the agency and help them respond.

2. Information we collect

2.1 Information you or your workspace provide

2.2 Information collected automatically

• Log and device information: IP address, browser and device type, operating system, referring URL, pages or screens visited, and timestamps.
• Security information: sign-in events, one-time-code requests, failed sign-in attempts, and actions recorded in audit logs (for example, invitations, role changes, deletions, and approvals).
• Product analytics: which features are used, clicks and navigation events, and performance timings. Where we use session replay to diagnose issues, text typed into form fields is masked, and passwords and payment details are never recorded.
• Error diagnostics: when something breaks, technical details of the error (stack traces, browser details, and the page involved) so we can fix it.
• Approximate location: country and region derived from IP address. We do not collect precise GPS location.

2.3 Information we do not want

Please do not upload health records or protected health information, payment-card numbers, government ID numbers, or other sensitive data (see Section 5 of our Terms). Orbit is not designed or certified for regulated data such as HIPAA-covered information.

3. How we use information

We use personal information to:

1. Provide the Services: create and manage workspaces, portals, and accounts; store, process, and deliver files; generate previews and thumbnails; enable review, approvals, requests, chat, reports, and notifications.
2. Authenticate and secure accounts: send one-time sign-in codes and invitations, enforce roles and permissions, detect and prevent fraud, abuse, and security incidents, and keep audit logs.
3. Bill and administer subscriptions: process payments, trials, renewals, plan changes, and add-ons; send receipts, renewal reminders, and payment-failure notices; calculate taxes.
4. Communicate with you: send service emails (such as new review requests, approvals, comments, storage warnings, and security alerts), reply to support requests, and, with the ability to opt out, send product updates.
5. Improve and troubleshoot: understand how features are used, measure performance, and find and fix bugs, using analytics and error diagnostics. Where possible, we use aggregated or de-identified data.
6. Comply with law and enforce our Terms: respond to lawful requests, meet tax and accounting obligations, and handle copyright notices and disputes.

We do not:

• sell personal information;
• share personal information for cross-context behavioral advertising;
• use Customer Content for advertising;
• use Customer Content to train or fine-tune any artificial-intelligence model, whether ours or a third party's.

4. AI features

Orbit may offer optional AI-assisted features, such as summaries, recaps, or search. When a workspace uses them, the relevant content is sent to a third-party AI provider (currently Anthropic) only to return a result. The provider is contractually prohibited from using that content to train its models, and keeps it only as long as needed to provide the result and meet its legal and safety obligations. Orbit does not use Customer Content to train AI models. If AI features are not enabled for your workspace, no content is sent to an AI provider.

5. United States only

Orbit is offered only to businesses located in the United States, and all data is stored and processed in the U.S. We don't offer the Services to customers in the European Economic Area, the United Kingdom, or Switzerland. If you're located outside the U.S. and received a portal invitation from a U.S. agency, your data is handled as described in this policy and under U.S. law.

6. Cookies and similar technologies

6.1 Essential cookies. These keep you signed in, remember your workspace and security settings, and protect against cross-site request forgery. They cannot be switched off without breaking the Services.

6.2 Preferences. We store settings such as theme, layout, and filters in your browser.

6.3 Analytics. We use PostHog for product analytics and, where enabled, session replay. For visitors from regions where the law requires consent, analytics cookies are off until you accept them. You can opt out at any time using the cookie settings link in our website footer. We honor Global Privacy Control (GPC) signals as an opt-out of analytics cookies.

6.4 No advertising trackers. We do not use third-party advertising pixels or cross-site advertising cookies on the Orbit application or in client portals.

7. How we share information

7.1 Service providers (sub-processors)

We share information only with providers that help us run the Services, under written agreements that require them to protect it and use it only for the services they provide to us.

We will update this list before adding a new sub-processor that processes Customer Content. Customers with a DPA can subscribe to advance notice of changes by emailing hello@goorbit.app.

7.2 Within a workspace

Information in a workspace is visible to the people the Customer grants access to. For example:

• Team Members see the portals they are assigned to.
• Client Users see only their own portal, according to their role.
• Share links show only the items shared.

Your name, profile photo, and comments are visible to others who can see the same item.

7.3 Legal and safety

We may disclose information if we believe in good faith that it is necessary to:

• comply with law, regulation, subpoena, or court order;
• protect the rights, property, or safety of Orbit, our users, or the public;
• investigate fraud, abuse, or security incidents; or
• enforce our Terms.

Where lawful, we will notify the affected Customer before disclosing Customer Content, and we will challenge requests we believe are overbroad.

7.4 Business transfers

If Orbit is involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction, subject to this Privacy Policy.

7.5 With your direction

We share information when you tell us to. Examples are publishing to a share link, connecting an integration, or asking us to help another party.

8. Security

We use administrative, technical, and physical safeguards designed to protect information, including:

• encryption in transit (TLS) and at rest;
• tenant isolation enforced in the database with row-level security, so one workspace cannot access another's data;
• role-based access control for Team Members and Client Users;
• one-time-code sign-in and time-limited invitation and share links;
• audit logging of sensitive actions;
• limited, logged access by Orbit personnel, only for support you request, security, legal compliance, or keeping the Services running;
• error monitoring and dependency updates.

No system is perfectly secure. If we confirm a breach affecting personal information in our systems, we will notify affected Customers without undue delay. Where feasible, we will do so within 72 hours of confirmation, and we will notify individuals and regulators where the law requires.

9. Retention and deletion

We may keep information longer if needed to resolve disputes, enforce our agreements, or comply with law.

10. Your rights and choices

10.1 Your rights. Depending on where you live, you may have the right to:

• Access: know what personal information we have about you and get a copy.
• Correct: fix inaccurate information. Much of it can be changed in your profile settings.
• Delete: ask us to delete your personal information.
• Portability: receive your information in a portable format.
• Object or restrict: object to, or ask us to limit, certain processing.
• Withdraw consent: where we rely on consent.
• Opt out: of "sale," "sharing," or targeted advertising. We do none of these, but you may still submit a request.
• Appeal: a decision we make about your request, where your state provides this right.
• Non-discrimination: we will not treat you differently for exercising your rights.

10.2 How to make a request. Email hello@goorbit.app with the subject "Privacy Request."

• We will verify your identity, usually by confirming your account email, before acting.
• An authorized agent may submit a request for you, with proof of authorization.
• We respond within the time required by law, usually 30 to 45 days.

10.3 Requests about portal content. If your request concerns content held in an agency's workspace, we will forward it to that agency, which is responsible for deciding it (see Section 1.3).

10.4 Emails.

• You can unsubscribe from product updates with the link in any such email.
• Team Members can adjust notification emails in Settings → Notifications. Client Users can do so from the link in the email.
• Security, billing, and legal notices cannot be turned off while your account is active.

10.5 Questions or complaints. Contact us at hello@goorbit.app and we'll respond within the time the law requires.

11. U.S. state privacy disclosures

This section supplements the Policy for residents of California and other U.S. states with comprehensive privacy laws.

• Categories collected in the last 12 months:
  • identifiers (name, email, IP address);
  • commercial information (plan and purchase history);
  • internet or network activity (usage, logs);
  • approximate geolocation (from IP);
  • audio and visual information (media you upload);
  • professional information (job title, company).
• Sources: you, the Customer that invited you, your devices, and service providers (Section 7).
• Purposes: as described in Section 3.
• Disclosures for business purposes: to the service providers listed in Section 7.1, for the purposes listed there.
• Sale or sharing: we do not sell personal information or share it for cross-context behavioral advertising, and we have not done so in the last 12 months. We do not knowingly sell or share the personal information of anyone under 16.
• Sensitive personal information: we do not use sensitive personal information to infer characteristics. Account sign-in credentials are used only to authenticate you.
• Retention: see Section 9.
• "Shine the Light": we do not share personal information with third parties for their own direct marketing.

12. Where data is stored

We store and process data in the United States using the providers listed in Section 7.1. We don't transfer customer data outside the U.S. for processing.

13. Children

The Services are for businesses and are not directed to children under 13 (or under 16 in some regions). We do not knowingly collect personal information from children. Creative media that Customers upload may incidentally show minors; the Customer is responsible for holding the required releases and consents. If you believe a child has given us personal information, contact hello@goorbit.app and we will delete it.

14. Data Processing Addendum

Our standard Data Processing Addendum is published at goorbit.app/dpa and applies automatically. Customers who need a countersigned copy can request one at hello@goorbit.app. It includes processor commitments, the sub-processor list, and security measures.

15. Changes to this Policy

We may update this Privacy Policy from time to time. We will post the new version with a new effective date. If a change materially affects how we handle personal information, we will notify workspace owners by email or in the app at least 30 days before it takes effect, unless an earlier change is required by law.

16. Contact

Orbit Technologies, LLC
627 Opelousas Ave STE 71290, New Orleans, LA 70114
hello@goorbit.app (subject: "Privacy")