Orbbit Data Privacy Policy

Who we are

Orbbit Data is a commerce data service run by Orbbit Inc. ("Orbbit", "we"). It includes the console at data.orbbit.co, the API at data-api.orbbit.co, and the connection that lets AI assistants such as Claude and ChatGPT use Orbbit Data.

This policy covers Orbbit Data only. Orbbit's invoice funding product, Orbbit Capital, is a separate service with its own policy.

What we collect

• Account details: your email address, first and last name, and your organization name, entered when you sign up.
• API keys: we keep a one-way fingerprint of each key to check it, plus an encrypted copy so you can view it again in the console. We record each time a key is viewed or replaced, and by whom.
• Usage records: for each paid request to the API, including requests made by an AI assistant you connected, we record your organization, the key or connection used, which data was requested, the search values sent, the cost, and the time.
• Server logs: details of each request, including IP address and the name of the browser or app that sent it. API keys, sign-in tokens and passwords are removed from these logs.
• Payment records: the amounts you paid and Stripe reference numbers. We never see or store your card number.
• Waitlist sign-ups: if you join the Orbbit Data waitlist on orbbit.co, your name, work email, company name and company website.

AI assistants

When you connect Orbbit Data to an AI assistant, you sign in and approve the connection. After that, the assistant sends requests to Orbbit Data on your behalf, and we record them the same way as API requests.

We only receive the requests the assistant sends to Orbbit Data. We do not receive your conversations, files, or anything else you share with the assistant.

How we use it

• To sign you in and keep your account secure.
• To answer your API and AI assistant requests.
• To charge for usage, keep your balance up to date, and show your usage history in the console.
• To find and fix errors.
• To contact you about your account or the waitlist.

We do not sell your personal data, and we do not use it for advertising.

Legal bases (EU and UK users)

We use your data to provide the service you signed up for (contract), to keep it secure and fix errors (legitimate interests), to keep billing and tax records (legal obligation), and to contact waitlist sign-ups (consent).

Who we share it with

We share personal data only with the service providers that run parts of Orbbit Data for us:

• Stytch: sign-in, including sending your one-time sign-in codes, and approving AI assistant connections. Receives your email, name and organization name.
• Stripe: payments. Receives your email and handles your card details directly.
• Amazon Web Services: hosting, storage and logs, in the United States.
• Sentry: error reports from the console and the API.
• PostHog: counts of page visits on orbbit.co.
• Google: stores waitlist sign-ups from orbbit.co.

Cookies

• The console sets a sign-in cookie that keeps you signed in for up to 7 days.
• The console sets a cookie that remembers whether the side menu is open, for 7 days.
• We use no advertising cookies.

How long we keep it

• Account details, API key records and usage records: while your account is open, and afterwards for as long as billing, tax and legal rules require.
• Server logs: 14 days.
• Payment records: as long as tax and accounting rules require.
• Waitlist sign-ups: until you ask us to remove them.

Where your data is stored

Orbbit is based in the United States, and your data is stored and processed there. If you use Orbbit Data from another country, your data is transferred to the United States.

How we protect it

Data is encrypted when sent and when stored. API keys are never stored in readable form, and the key that decrypts them is kept in a separate secrets store.

Your rights

Wherever you live, you can ask us to:

• Show you the personal data we hold about you, or give you a copy of it.
• Correct it.
• Delete it.
• Stop or limit how we use it, or object to a use.

Email info@orbbit.co. We will reply within 30 days, except for records the law requires us to keep. We do not sell personal data, and we will not treat you differently for using these rights. EU and UK users can also complain to their local data protection authority. You can revoke API keys and disconnect AI assistants at any time.

Children

Orbbit Data is a business service and is not meant for anyone under 16.

Changes to this policy

If we change this policy, we will update the date at the top of this page. If a change affects how we use your data, we will email account owners before it takes effect.

Contact us

Questions about this policy or your data: email info@orbbit.co.