Orbit
Log inGet started free

Privacy Policy

Last updated: August 10, 2026

This Privacy Policy explains how Orbit ("Orbit", "we", "us", or "our") collects, uses, shares, and protects information when you use the Orbit CRM at inorbit.one and app.inorbit.one (the "Service").

Orbit is a simple, AI-powered CRM for individuals and small teams. We take privacy seriously: we do not sell your personal information, and we access connected accounts only to provide the features you ask for.

1. Information we collect

We collect the following categories of information:

Account information

When you create an account, we collect your name, email address, and a password (stored only as a secure hash). If you sign up or sign in with Google, we receive your basic profile (name and profile photo) and email address from Google to create and access your account.

Relationship data you add

Contacts, notes, tasks, deals, calendar events, journal entries, files, email and message content you compose, and any other content you create or import into Orbit. You control this data and may export or delete it at any time.

Google Calendar (only if you connect it)

With your permission, Orbit accesses your Google Calendar events so it can show your schedule, create bookings, and two-way sync the events you create in Orbit. Orbit does not request access to your Gmail or any other Google data.

Data you save with the Orbit browser extension

The optional Orbit browser extension lets you save a person's public profile details (such as name, title, and photo) from a web page you are viewing, including LinkedIn, X, Instagram, and Facebook. It reads a page only when you click to save a contact. Orbit does not connect to, log into, or continuously access those accounts, and you can remove the extension at any time.

Email you send through Orbit

When you send, schedule, or automate email in Orbit, we process the recipients, subject, content, and delivery events (such as opens, clicks, bounces, and replies) to deliver the message and show it on your timeline. Outbound email is delivered through our email infrastructure provider. You may optionally connect your own sending domain, in which case you are responsible for that domain and its DNS.

Messaging and calls

If you use the SMS, WhatsApp, or calling features, we process the phone numbers, message content, and call metadata needed to send, receive, and log those communications through our telephony provider.

AI features

Orbit includes AI assistant and agent features. When you use them, the relevant content (such as a contact, thread, or your prompt) is sent to our AI model providers to generate the response. This data is not used to train their models, and is processed only to provide the feature you requested.

Payment information

If you purchase a paid plan, payments are processed by a third-party payment provider (Stripe), and we do not store full card numbers on our servers.

Usage and device data

Basic, privacy-respecting information such as log data, device and browser type, and product events used to operate, secure, and improve the Service.

2. How we use information

  • Provide, maintain, and operate the Service and its features.
  • Sync your calendar and saved contacts so your relationships stay current.
  • Send, schedule, and automate email and messages on your behalf when you ask us to, and show replies and delivery events on your timeline.
  • Power AI assistant and agent features you choose to use.
  • Secure the Service, protect sending reputation, prevent abuse and spam, and troubleshoot problems.
  • Communicate with you about your account, security, and important changes.
  • Comply with legal obligations.

3. Google user data and Limited Use

Orbit uses Google for two things only: signing in (Google Sign-In, which gives us your name, email, and profile photo) and, if you connect it, Google Calendar. Orbit does not request or access Gmail or any other Google data. Access is granted only with your explicit consent during the Google sign-in and connection flow.

Orbit's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

  • We only use Google Calendar data and Google profile data to provide user-facing features that are visible and prominent in Orbit (signing you in, showing your schedule, creating bookings, and two-way syncing the events you create in Orbit).
  • We do not transfer or sell Google user data to third parties for advertising, marketing, or other purposes.
  • We do not use Google user data to develop, improve, or train generalized or third-party artificial intelligence or machine learning models.
  • Humans do not read your Google user data unless it is necessary for security purposes (such as investigating abuse), to comply with applicable law, or the data is aggregated and anonymized for internal operations.
  • You can revoke Orbit's access to your Google account at any time in your Google Account permissions (myaccount.google.com/permissions) or by disconnecting the integration in Orbit settings.

4. How we share information

We do not sell your personal information. We share information only in these limited cases:

  • Service providers (sub-processors) who help us run Orbit and process data only on our instructions: database and hosting (Supabase, Vercel), email delivery (Mailgun and Resend), SMS, WhatsApp, and calling (Twilio), AI features (such as Anthropic and OpenAI), and payments (Stripe).
  • Google and other accounts you connect, to the extent needed to deliver the feature you requested (for example, writing an event to your Google Calendar).
  • Legal and safety reasons, when required by law or to protect the rights, safety, and security of users or the public.
  • Business transfers, if Orbit is involved in a merger, acquisition, or sale of assets, in which case we will notify you and honor this Policy.
  • With your consent, for anything else.

5. Data retention

We keep your information for as long as your account is active or as needed to provide the Service. When you delete content or your account, we delete the associated personal data within a reasonable period, except where we must retain it to comply with legal obligations, resolve disputes, or enforce our agreements.

6. Security

We use industry-standard safeguards, including encryption in transit, scoped access to connected accounts, row-level access controls, and least-privilege practices. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work hard to protect your data.

7. Your rights and choices

Depending on where you live, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Orbit gives you direct control:

  • Access and edit your data at any time inside the app.
  • Export your data from the app.
  • Delete individual records or your entire account, which removes your associated personal data.
  • Disconnect Google Calendar, or remove the Orbit browser extension, at any time.

US state privacy rights

If you are a resident of a US state with a comprehensive consumer privacy law, including California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon, Montana, and a growing list of other states, you have rights regarding your personal information. Subject to the conditions and exemptions in your state's law, these include the rights to:

  • Know and access the personal information we have collected about you, and how we use and share it.
  • Correct inaccurate personal information.
  • Delete personal information we hold about you.
  • Obtain a portable copy of your data.
  • Opt out of the "sale" or "sharing" of personal information and of targeted advertising and profiling. We do not sell or share your personal information or use it for targeted advertising or profiling, so there is nothing to opt out of.
  • Not receive discriminatory treatment for exercising any of these rights.
  • Where your state provides one (such as Virginia, Colorado, and Connecticut), appeal a decision we make about your request.

California notice (CCPA/CPRA)

In the past 12 months we have collected the categories of personal information described in "Information we collect" above (identifiers, customer records, internet/usage activity, and the contact data you choose to add), for the business purposes described in "How we use information."

We do not sell or share personal information and have not done so in the past 12 months, and we do not use or disclose sensitive personal information beyond providing the Service. You may use an authorized agent to submit a request, and we will verify your identity before acting on it. California's "Shine the Light" law: we do not share personal information with third parties for their own direct marketing.

EEA, UK, and Swiss rights (GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, Orbit is the controller of your personal data. Our legal bases for processing are: performing our contract with you (providing the Service), your consent (for example, connecting Google Calendar), our legitimate interests in operating, securing, and improving the Service, and compliance with legal obligations.

Subject to applicable law, you have the rights to access, rectify, erase, restrict, and port your data, to object to processing based on legitimate interests, and to withdraw consent at any time without affecting prior processing. Where we transfer data internationally, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. You may also lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office).

How to exercise your rights

To make a request under any of these laws, email us at privacy@inorbit.one. We will verify your request and respond within the timeframe your law requires (generally 45 days in the US, extendable where permitted, and one month under GDPR). Exercising these rights is free, and we will not discriminate against you for doing so.

8. Cookies and similar technologies

We use essential cookies and local storage to keep you signed in and to operate the Service. We do not use third-party advertising cookies.

We measure traffic to our website and app with Sonar, first-party analytics software we built and host ourselves. What Sonar records stays on our own infrastructure. We do not sell it, and we do not pass it to a third-party analytics or advertising provider. Separately, our marketing pages at inorbit.one load Google Analytics; the Orbit app at app.inorbit.one does not.

Sonar stores one item on your device: a randomly generated ID kept in your browser's local storage under the key sonar_pid. It contains no name, no email address, and no other personal information. Its only purpose is to help us understand which marketing brought a visitor to Orbit, including when the first visit and the sign-up happen on different days. Because it stays until you remove it, it is a persistent identifier rather than a session-only one.

Alongside it we record the page URL, the referring site, any campaign parameters on the link you followed, your country, and the general type of device, browser, and operating system you use. Your IP address is used only at the moment of the request, to derive a rotating anonymous fingerprint that lets us count a visitor once, and it is not stored.

To opt out, open your browser's developer console on any Orbit page and run localStorage.setItem('sonar_ignore', '1'). We will stop collecting from that browser. Clearing this site's data from your browser also removes the ID.

9. International data transfers

Orbit is operated from the United States and may process data in other countries where our service providers operate. Where required, we rely on appropriate safeguards for international transfers.

10. Children

Orbit is not intended for anyone under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us information, please contact us and we will delete it.

11. Changes to this Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the date above and, where appropriate, notify you. Your continued use of the Service after changes take effect means you accept the updated Policy.

12. Contact us

If you have questions about this Policy or your data, contact us at privacy@inorbit.one.