Skip to main content

Legal

Privacy Policy

Last updated: 1 October 2026

1. Introduction

Orbitable (“we”, “us”, “our”) operates the Orbitable platform, an autonomous marketing command centre. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

2. Information We Collect

Account Information: When you sign up, authentication is handled by Clerk. We receive your user ID, display name, email address, and profile image. We store this to create and manage your account.

Customer Data: Information you provide about your business: website URLs, brand details, competitor information, and marketing content. This is used exclusively to power your AI agents.

Usage Data: We track agent message counts, image generation counts, and feature usage to enforce plan limits and improve the service.

Connected Social Accounts: If you connect TikTok, we receive the account identifier, display name, avatar, permissions and access credentials needed to maintain that connection. We store the credentials encrypted. We also retain posting references and processing status so you can see the outcome of a video you chose to send.

Connected Services: If you connect a service such as a CRM, a knowledge base or a tool server, we store the credentials needed to reach it (encrypted), its name and address, which tools you have switched on, and a record of each call made through the connection. Section 6 explains what happens to data when you connect one.

Payment Information: Payment details are processed and stored by Stripe. We do not store credit card numbers or banking details on our servers. We receive your Stripe customer ID and subscription status.

3. How We Use Your Information

  • To provide, operate, and maintain the Orbitable platform
  • To power AI agent responses specific to your business context
  • To process payments and manage subscriptions via Stripe
  • To enforce usage limits based on your subscription plan
  • To show a connected social account and send a video to TikTok only after you review it and confirm the upload
  • To communicate service updates, security alerts, and support
  • To detect, prevent, and address technical issues or abuse

4. Data Isolation

Business data, conversations and generated content are associated with your workspace and customer worlds. Data is stored in shared database tables and access is controlled by workspace membership, roles and application checks. Authorised members of your workspace may access shared materials according to their permissions.

5. AI Processing

Relevant prompts and business context are processed by third-party AI providers, including Anthropic and OpenAI, to power the features you use. Provider API terms, privacy policies and applicable data processing agreements govern their handling, retention and use of that data.

6. Connected Services and Tools

You can connect other services to Orbitable, such as a CRM, a document store, or a tool server you add yourself. This is what happens to data when you do.

  • Data you connect (CRM records, documents and the results of tool calls) is sent to the AI providers listed in section 7, so that your agents can do the work you ask for.
  • You choose each connected service. That service handles your data under its own terms and privacy policy, and Orbitable does not control it.
  • When an agent reads from a connected tool server, the request may be made by an AI provider’s own connector, which reaches the server directly and is sent the access token for that call. The provider’s retention terms apply to what passes through its connector. The retention note in section 7 gives the detail.
  • Orbitable stores connection credentials encrypted, decrypts them only at the moment of a call, and never places them in a prompt.
  • A tool that changes data or spends money does not run because an agent asked. Each call is shown to a person to approve, edit or decline first, unless an owner or admin has chosen to approve that specific reviewed tool automatically.
  • Orbitable records every external call made through a connection: which tool, in which workspace and customer world, who or what started it, when, how long it took, whether it worked, the size of the result, and a short summary of the arguments with credentials removed. The credential and the full result are not recorded. Owners and admins can export this record, and it is kept for 400 days.

7. Data Sharing

We do not sell your personal information. We share data only with:

  • Clerk: for authentication and session management
  • Stripe: for payment processing
  • Anthropic: for AI agent processing. When a connected tool server is attached to a request through Anthropic’s MCP connector, that connector is not covered by zero data retention arrangements: the tool definitions and results that pass through it are kept under Anthropic’s standard retention terms
  • OpenAI: for AI agent processing on research and web-search agents
  • ElevenLabs: when Mission Control voice is configured and you use it, to transcribe recordings and generate spoken responses
  • TikTok: when you choose to connect an account or send a video for posting; TikTok handles the video under its own terms and privacy policy
  • Neon: for database hosting
  • Replit: for application hosting
  • Resend: for transactional email
  • Law enforcement: only when required by law

8. Data Retention

We retain account and workspace data to operate the service. Cancelling a subscription does not automatically delete the workspace. You can request deletion through account settings or by contacting us. Retention in provider backups and any records required for billing or legal obligations is handled separately; contact us to discuss the scope and timing of a deletion request.

If you disconnect a connected service, we delete the stored credentials, ask the service to revoke them where it supports that, and switch its tools off. The record of past calls through that connection is kept for 400 days, then deleted.

If you disconnect a TikTok account in Social Hub, we request revocation from TikTok and clear the stored access and refresh credentials. Orbitable may retain the posting reference and status as part of your workspace history; deleting an Orbitable record does not delete a video already transferred to TikTok.

9. Security

We use HTTPS connections, authentication managed by Clerk, and application access checks based on workspace membership and roles. Credentials for connected services are encrypted with AES-256-GCM before they are stored, and logs have credentials removed. Customer records are held in shared database tables scoped to a workspace identifier. Database encryption and backup retention depend on our hosting providers and deployment configuration. No method of electronic storage is 100% secure.

10. Your Rights

You may access, correct, or delete your personal data at any time through your account settings. You may also request a complete export of your data. To exercise these rights, contact us at the address below.

11. Cookies

We use a session cookie to maintain your authentication state. This is essential for the service to function and cannot be disabled. We do not use tracking cookies or third-party analytics cookies.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the “Last updated” date.

13. Contact

For questions about this Privacy Policy or your data, contact us at [email protected].