Privacy Policy

1. Information we collect

We collect information that users provide directly, including names, email addresses, business details, client records, project information, tasks, time entries, invoices, expenses, proposals, contracts, signatures, and files or file links associated with those records.

When you authenticate, we receive basic identity information from the selected identity provider, such as your name, email address, provider identifier, and authentication status. We also process technical information needed for security, such as session identifiers, timestamps, IP addresses, and browser information.

2. Google user data

If you connect a Google account, Orbit may request basic Google identity information and permission to send email through Gmail. Orbit uses the Gmail send permission only to send messages that are visible within Orbit’s client-management features, such as client portal invitations, login codes, invoice reminders, proposal reminders, and contract reminders.

Orbit does not request permission to read, download, index, analyze, or train models on your Gmail messages. OAuth access and refresh tokens are encrypted before storage and are used only to provide the connected feature.

Orbit’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3. Microsoft and OneDrive data

If you connect Microsoft OneDrive, Orbit receives basic Microsoft account information and permission to browse and link files you select. Orbit stores selected file metadata and links, such as file name, type, size, modification date, and OneDrive URL. Microsoft OAuth tokens are encrypted before storage. Access to a linked file remains governed by the permissions configured in Microsoft OneDrive.

4. How we use information

We use information to provide and secure Orbit; authenticate users; manage clients, projects, finances, documents, signatures, files, and communications; deliver requested emails; troubleshoot errors; prevent abuse; comply with legal obligations; and improve user-facing application functionality.

We do not sell personal information. We do not use connected Google or Microsoft user data for advertising, credit decisions, or training generalized artificial-intelligence models.

5. How information is shared

Information may be processed by service providers necessary to operate Orbit, including Cloudflare for hosting, security, and database services; Google for authentication and Gmail delivery; Microsoft for authentication and OneDrive access; and other infrastructure providers added with appropriate notice. We may also disclose information when required by law, to protect rights or security, or as part of a business transfer subject to applicable requirements.

Client-facing records are shared only through authenticated client portals or document links initiated by the Orbit account owner.

6. Data retention and deletion

We retain account and business information while the account remains active or as needed to provide the service, maintain security and audit records, resolve disputes, and meet legal obligations. Users may disconnect Google or Microsoft integrations at the provider, revoke OAuth access, or request deletion of stored account data. Some records may be retained where legally required or necessary to preserve signed-document evidence.

7. Security

Orbit uses HTTPS, encrypted OAuth token storage, hashed session and access tokens, access controls, tenant-scoped database queries, expiring login codes, and other reasonable safeguards. No method of electronic storage or transmission can be guaranteed completely secure.

8. Your choices and rights

You may update profile information in Orbit, disconnect third-party services, revoke access through Google or Microsoft, and request access, correction, export, or deletion of applicable personal information. Depending on your location, additional legal rights may apply.

9. Children

Orbit is intended for business use and is not directed to children under 13. We do not knowingly collect personal information from children under 13.

10. Changes to this policy

We may update this policy when Orbit’s practices or legal obligations change. We will update the date above and provide additional notice when a material change requires it.

11. Contact

For privacy questions or data requests, email orbitconsultingcenter@gmail.com.