Last updated: May 7, 2026
This Privacy Policy describes how Orbis ("Orbis", "we", "us") collects, uses, and protects information when you use our AI assistant service (the "Service"). By using the Service you agree to the practices described here.
Orbis is operated by Orbis, Inc., a Delaware corporation. Contact us at hello@imorbis.com for any privacy-related question or request.
When you connect a third-party tool (Notion, HubSpot, Google Drive, etc.) via Pipedream Connect, Orbis can read and write data in those tools at your direction. We store only what's necessary to operate the integration — typically a reference token managed by Pipedream, plus cached query results to avoid redundant API calls. We do not bulk-export or store mirror copies of your tool data.
When you subscribe to a paid plan, payment processing is handled by Stripe. Orbis stores only the metadata (plan, subscription ID, period, last 4 digits of card) — Stripe holds the full payment instrument.
We do not use your content to train AI models. Orbis sends your messages to Anthropic's Claude API to generate responses. Anthropic's API terms commit to not training their models on customer-routed traffic. Your content stays in the Orbis–Anthropic API boundary; it's used only to generate the response you asked for.
Aggregate, non-identifying patterns (e.g., "average response length grew 12% this month") may inform product decisions. Individual messages do not.
When you sign in to Orbis with Google, we request access to a limited set of Google API scopes. Our use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.
https://www.googleapis.com/auth/calendar.readonly — so Orbis can show upcoming meetings in your daily brief, surface conflicts when scheduling, and answer questions like "what's on my calendar tomorrow?". We never write to your calendar with this scope.You can revoke Orbis's access to your Google account at any time at myaccount.google.com/permissions. You can also delete your Orbis account (which removes all stored Google data) by emailing hello@imorbis.com — see Section 8 for full deletion procedures.
Orbis uses these third-party services to operate. Each is bound by their own privacy commitments and applicable data-protection terms.
| Vendor | Purpose | Data shared |
|---|---|---|
| Anthropic | AI model inference (Claude) | Your messages and tool context, transient — not retained for training |
| Cloudflare | Hosting, databases (D1), object storage (R2), embeddings (Vectorize) | All Orbis-stored data lives on Cloudflare infrastructure |
| Stripe | Payment processing, subscriptions, webhooks | Billing email, name, payment instrument (held by Stripe), invoice metadata |
| Pipedream | Third-party tool OAuth + action execution | OAuth tokens for tools you connect, action invocation payloads |
| OAuth sign-in, Calendar (read-only) | Profile (name, email, picture), calendar events when granted | |
| Meta (WhatsApp Cloud API) | WhatsApp messaging | Phone number, message content sent via WhatsApp |
| Slack | Slack messaging integration | Workspace metadata, channels Orbis is added to, message content |
| Resend | Transactional email (receipts, alerts) | Email address, message body for emails Orbis sends on your behalf |
Orbis hosts data on Cloudflare's global network. By default, primary storage is in regions closest to your origin (typically United States or Europe). For tenants with data-residency requirements, we can pin storage to a specific region — contact us at hello@imorbis.com.
If you are located in the European Economic Area, the United Kingdom, or Switzerland, your data may be transferred to and processed in the United States. Such transfers are made under appropriate safeguards including Standard Contractual Clauses where applicable.
Depending on where you live, you may have the right to:
To exercise any of these rights, email hello@imorbis.com. We respond within 30 days.
If you are a California resident: we do not sell your personal information and do not share it for cross-context behavioral advertising. The categories of personal information we collect are described in Section 2 above. You have the right to know, delete, correct, and opt out of certain processing as outlined in Section 9.
Orbis is intended for business use by adults. We do not knowingly collect data from anyone under 16. If we learn we have collected such data, we will delete it.
Our web interfaces use only essential cookies — session tokens for authentication and security. We do not use third-party advertising cookies, behavioral tracking, or cross-site identifiers.
Orbis applies industry-standard security practices: encryption in transit (TLS 1.2+) and at rest, scoped access tokens, audit logging of every action, and per-tenant data isolation enforced at the database layer. No system is perfectly secure — if you believe your account has been compromised, contact us immediately at security@imorbis.com.
If a breach affecting your personal data occurs, we will notify affected users without undue delay and consistent with applicable law.
We may update this Privacy Policy as the Service evolves or as laws change. Material changes will be communicated by email and through the Service at least 14 days before they take effect. Continued use of the Service after the effective date constitutes acceptance.
Privacy questions, requests, or concerns: hello@imorbis.com
Security issues: security@imorbis.com