Legal
Privacy Policy
How Orbit handles the contact and relationship data members bring to the platform, and the rights of everyone in it, including people who never signed up.
Last updated 19 October 2026 · Draft pending legal review
If someone told you they were introducing you through Orbit, and you never signed up, someone who knows you added your details. You can see what we hold, or have it erased and never added again, at orbit45.com/privacy/request. No account needed.
Who we are
Orbit ([legal entity name, registered address — to be completed]) helps companies ("sellers") reach their sales goals through people with real professional relationships ("connectors"), who introduce them to buyers and are paid by the seller. Contact: hello@orbit45.com.
For contacts a connector brings to Orbit, Orbit is the business responsible for that data. For contacts a seller syncs from its own CRM (HubSpot, Salesforce), the seller is responsible and Orbit processes that data on the seller's behalf, as its service provider.
Whose data, and what data
Members (connectors and sellers)
Account details (name, email, login provider), profile (title, company, employment history, country, bio), agreements, introductions, payouts and the payment records a seller adds when it pays a connector (an optional reference and, optionally, a proof of payment such as a transfer confirmation), notification preferences, and security and usage logs.
People in a member's network (who may never have signed up)
| Source (chosen by the member) | What we keep |
|---|---|
| Google Contacts, Microsoft 365 contacts | Name, email, organisation, job title |
| Google Calendar, Microsoft 365 calendar | That a meeting took place with you: date and number of attendees. Never titles, descriptions or notes. |
| Gmail / Outlook (only where enabled) | Headers only: how many messages were exchanged per month and in which direction, and one-way hashes of subject lines. Never message bodies. |
| LinkedIn data export uploaded by the member | Name, company, position, the date you connected, email if LinkedIn included it; from messages, only counts per month (message text is discarded as soon as the file is processed) |
| Apple Contacts / vCard / CSV files uploaded by the member | Name, email, phone numbers, organisation, job title, LinkedIn URL |
| A seller's CRM (HubSpot, Salesforce) | Contact fields, the company, deals, and activity counts and types |
From this we derive: which company you work at, your seniority, an estimate of how strong the member's relationship with you is (from dates and counts only), and how well a seller's program may fit you.
We do not collect sensitive categories of data (health, religion, politics and similar), and we do not buy data from brokers.
Why we use it
- To run the service for members: accounts, matching, introductions, payouts.
- To let members find people they know who may benefit from an introduction, and to score relationship strength and program fit. We keep the minimum (no message content), your details stay private to the member who added you, Orbit never contacts you itself, and you can opt out at any time.
- Payment records, tax, fraud prevention and legal obligations. Orbit does not process payments: sellers pay connectors directly.
Profiling. Relationship and fit scores are automated estimates. They only rank suggestions shown to the member who already knows you; they never produce a decision with legal or similarly significant effects on you. You can opt out of them at any time; the fastest way is the erasure form.
Who can see it
- Only the member who added you. Other members and sellers cannot browse or search it.
- A seller sees your name, job title, email and company only once the connector who added you records that you met that seller through their introduction. Before that, the seller sees only how many people each connector is working on, never who. If you ask the connector or Orbit, the seller stops seeing your details (Orbit cannot recall what the seller already received).
- Orbit staff see counts, not names, except when a dispute review is opened; every such access is logged.
- Service providers acting on our instructions (list below).
Your details reach a seller only after you have met that seller through an introduction. If any disclosure were still treated as a "sale" or "sharing" of personal information under a US state law, you can opt out with the erasure form, which also works as a "Do Not Sell or Share My Personal Information" request.
Service providers (subprocessors)
| Provider | Purpose | Location |
|---|---|---|
| Render | Application hosting | United States |
| Neon | Database and backups | United States |
| Anthropic (default), OpenAI (fallback) | Drafting introduction text, resolving company names, and suggesting companies like a seller's buyers (Anthropic, with web search). They receive only a first name, company, job title or email domain, or a seller's description and the names of companies, never an email address or phone number. | United States |
| Langfuse | Quality monitoring of those AI calls | European Union |
| Resend | Sending email | United States |
| Sentry | Error monitoring (configured not to send personal data) | United States |
| Google, Microsoft, HubSpot, Salesforce | The sources a member chooses to connect | Various |
Each provider is bound by a contract that limits its use of personal data to providing its service to us.
Google and Microsoft data
Orbit's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. That data is used only to provide the member-facing features described here. It is never used for advertising, never sold to data brokers, never read by people except with the member's consent or for security and legal reasons, and never used to train generalized AI models. The same limits apply to Microsoft data.
How long we keep it
- Uploaded files: deleted as soon as they are processed. Files that fail to import are deleted within 7 days.
- Member data exports: deleted after the 24-hour download window.
- A network contact: kept while the member who added it keeps an account. It is removed when the member deletes their account (7-day grace period), or when you ask us to erase it.
- Introductions, attributions and payouts: kept as financial records for as long as tax and accounting law requires. If you ask us to erase your data, your name and details are removed from them.
- Opt-out list: kept indefinitely. It holds only a one-way hash of your email, phone or LinkedIn URL, so we can keep you off the platform.
Your rights
Depending on the US state where you live (for example California, Virginia, Colorado, Connecticut, Oregon or Texas), you may have the right to:
- know what data we hold and receive a copy;
- correct it;
- have it deleted;
- opt out of its sale or sharing, and of profiling;
- not be discriminated against for using these rights.
- Not a member? Use orbit45.com/privacy/request.
- Members can export or delete their data from Settings → Data.
- Anything else: hello@orbit45.com.
We answer within 45 days. If we decline a request, you can appeal by replying to our answer, and you can contact your state attorney general (or, in California, the California Privacy Protection Agency).
Security
We protect data with:
- provider tokens encrypted at rest;
- database row-level security, so each member's contacts are isolated;
- the minimum permissions requested from each provider;
- audit logs for administrative access.
Children
Orbit is a professional service and is not directed at anyone under 18.
Changes
We will post changes here and notify members of material changes before they take effect.