Privacy Policy

Last updated: July 31, 2026

Who we are

Orbit is a product of Anyra, Inc.(“we”, “us”) — an AI-assisted outreach CRM that helps businesses research companies, find relevant professional contacts, and prepare outreach messages.

We are the data controller for your account and billing information. For the research and contact data inside your workspace, you are the controller and we act as your processor: you decide who is researched and what is sent, and we process that data on your instructions.

Data we process about you

Account data (name, email, password hash), the workspace content you create, usage and billing records (AI usage, credits, subscription state), and technical logs needed to operate and secure the service.

Data processed about third parties

When you run research, Orbit collects publicly available, business-related information about companies and professionals — names, job titles, business contact details such as LinkedIn profiles, work emails or office addresses, and the reasons they appear relevant to your product.

We process this on the basis of legitimate interest in business-to-business communication. We apply data minimization: only business-relevant fields are stored, and the sources behind each record are cited so any claim can be checked. We do not knowingly collect special-category data, and Orbit is not intended for consumer marketing.

Any person has the right to object to this processing. Where an objection is received, we stop processing and erase the record unless we are legally required to keep it.

How AI providers handle this data

Message drafting and personalization are sent to our AI provider with provider-side retention disabled. Company and people research runs as a long-running background task, which requires the provider to hold the response until it is collected; we delete that stored response as soon as we have processed it. Your data is not used to train third-party models.

Rights of the people in your workspace

Any person whose data is stored in Orbit may request access, correction, or deletion. Workspace users can permanently erase a person’s entire record — including generated messages, activity history and the research snapshots that mentioned them — with the built-in “Erase permanently” action.

Requests sent to us directly are honored without undue delay and within 30 days. Because the data sits inside a customer’s workspace, we may need to contact that customer to complete the request, and we will confirm to you when it is done.

Your rights as a user

You can permanently delete your account — your login, your workspace, and everything inside it — from Settings → Account at any time. Deletion is immediate and irreversible.

You can export your companies, contacts and messages as CSV from each campaign at any time. For a copy of anything not covered by those exports, or for any other access or correction request, write to us at our support address and we will respond within 30 days. If you are in the EU or UK and are unhappy with our response, you may complain to your local supervisory authority.

Sub-processors

• Supabase — database, authentication, realtime infrastructure
• Vercel — application hosting and serverless compute
• OpenAI — AI research and text generation
• Stripe — payment processing (card details never touch our servers)

These providers process data in the United States and other countries. Transfers out of the EU and UK rely on the providers’ Standard Contractual Clauses and, where applicable, their Data Privacy Framework certification.

How long we keep things

• Deleted items — projects, campaigns, companies, contacts and templates you delete are purged permanently 30 days later.
• AI usage records — kept 24 months, then removed. The credit entries they support remain, since they determine your balance.
• Message history — the ten most recent versions per contact.
• Research job data — the raw request and response behind a run are cleared 30 days after it finishes.
• Credit ledger and activity history — kept for as long as the account exists, because they underpin your balance and your pipeline reporting.
• Everything — removed immediately when you delete your account.

Security

Access is isolated per workspace with database-level row security. Secrets are held server-side only and are never exposed to the browser. Passwords are hashed, never stored in readable form, and checked against known-breached password lists at sign-up. Backups and point-in-time recovery protect against data loss.

Cookies

Orbit sets only the cookies required to keep you signed in. We do not use advertising cookies or cross-site tracking.

Changes

If we change this policy materially we will update the date above and notify account holders by email before the change takes effect.

Contact

For privacy requests about data held in a customer’s workspace, contact that workspace owner where you can, or reach us directly at our support address.