Privacy Policy

1. Who we are

AI Orbit, Inc. (“AI-Orbit,” “we,” “us”), a Delaware corporation, provides an AI-powered email and meeting platform for businesses. This Privacy Policy explains how we handle information when you use our website and our Service. AI-Orbit is a business-to-business service; the Service is intended for business and professional users, not consumers.

This Policy covers our website and the Service. It does not cover third-party services you connect to the Service (such as Google or Microsoft), which are governed by their own privacy policies.

Contact for privacy matters: privacy@ai-orbit.io

AI Orbit, Inc. 601 21st Street, Suite 300
Attn: Focustar Advisors
Vero Beach, FL 32960
United States

2. Information we handle

• Account information: name, business email, company, and billing details. Payment card data is handled by our processor, Stripe; we do not store full card numbers.
• Contact details you give us directly: when you register for the Service, join a waitlist, or ask us for information, we collect the details you enter — typically name, business email, phone number, and company. These are collected by AI-Orbit's own systems, and a copy is exported to our customer-relationship and marketing platform. See Section 8.
• Connected data (“Customer Data”): with your authorization (OAuth), we access email content, calendar events, contacts, and attachments from your Google and Microsoft accounts in order to provide the Service.
• Availability information from people who are not our users: when you invite someone to a meeting who does not have an AI-Orbit account, we may ask them to share their availability. See Section 5.
• Usage and device data: log data, IP address, browser and device information, and product-usage events.
• Communications: messages you send to support.

Customer Data you connect may contain other people’s personal data, and may contain sensitive or special-category information (for example, health, financial, or similar details that happen to appear in email, calendar entries, or attachments). As the business customer, you are responsible for having a lawful basis to submit that data to the Service. We process it only to provide the Service. See Section 6.

3. How we use information

• To provide, operate, secure, and improve the Service (triage, drafting, scheduling, meeting follow-up).
• To process AI features using our AI vendor (Anthropic’s Claude API). We do not use your Customer Data to train AI models, and we do not permit our AI vendor to use it to train their models.
• To process payments, provide support, send service and administrative messages, and comply with law.
• We do not sell your personal information, we do not “share” it for cross-context behavioral advertising, and we do not use Customer Data for advertising.

Where “improve the Service” is a purpose, we mean maintaining, securing, debugging, and enhancing the features described above. We do not use Customer Data to build advertising or profiling products.

4. What the Service does not do

We do not record, transcribe, or listen to your meetings. We process meeting-summary emails that your own tools generate. AI Output is automated; you review and approve before anything is sent or booked.

5. People who are not AI-Orbit users

Scheduling a meeting often involves people who have no relationship with us. We handle their information narrowly and briefly.

What happens

When you ask AI-Orbit to find a time with someone who is not an AI-Orbit user, we send that person a form. The form explains who is requesting the meeting and what it is asking for. They choose whether to respond. They are never required to create an account, and they can simply decline or ignore the request.

What we receive

Only what is needed to find a time that works. On Google, we receive free/busy information — whether a period is open or blocked, without event details. On Microsoft, the available interface may return calendar content such as event subjects, attendees, or locations; where a free/busy-only method is available for the request, we use it, and we do not seek event details we do not need.

What we do with it

We use it to compute mutual availability for the one meeting being scheduled. We do not add it to a profile, we do not build a contact record from it, and we do not use it for any other meeting, any other customer, or any marketing purpose.

How long we hold it

The connection to their calendar is closed as soon as they answer. The computed availability — the times shown to us as open or blocked — is held only while that meeting is being arranged, and is deleted within seven days in every case, whether or not the meeting is ever scheduled.

What we do not do

We do not sell it, we do not use it for advertising, and we do not retain it after the scheduling request is resolved.

Anyone who receives one of these forms may contact privacy@ai-orbit.io.

6. Sensitive data

Email and calendar content may contain special-category or otherwise sensitive personal data — for example, information revealing health, finances, or similar matters that appears incidentally in messages, events, or attachments. We process this information only to provide the Service. We do not use it for any other purpose, we do not sell it, we do not use it for advertising, and we do not use it to train AI models. Where you are our business customer, you are responsible for ensuring you have a lawful basis to submit such data to the Service.

7. Google user data — Limited Use disclosure

AI-Orbit’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use access to Gmail and Google Calendar data only to provide and improve user-facing features of the Service (triage, drafting, scheduling, meeting follow-up) that are prominent in the Service’s interface.
• We do not transfer Google user data to third parties except as necessary to provide or improve those user-facing features (for example, to the subprocessors listed below), to comply with applicable law, or as part of a merger, acquisition, or asset sale with notice to you.
• We do not use Google user data for serving advertisements, including retargeting, personalized, or interest-based advertising.
• No humans read your Google user data unless (a) you affirmatively consent for specific data (for example, a support case you initiate), (b) it is necessary for security purposes such as investigating abuse, (c) it is required to comply with applicable law, or (d) the data has been aggregated and anonymized for internal operations.
• We do not use Google user data to train AI models, and we do not permit our AI vendor to use it to train their models.

Our use of Microsoft account data accessed via Microsoft Graph is likewise limited to providing and improving the Service, and is subject to the Microsoft APIs Terms of Use.

8. How we share information

We share information with vendors who help us run the Service, under confidentiality and data-protection obligations:

• Anthropic — AI processing
• Google and Microsoft — email and calendar integration, at your authorization
• Heroku — application hosting
• Bucketeer — object storage
• Neon — database
• Vercel — front-end hosting
• Stripe — payment processing
• Help Scout — customer support

Customer relationship and marketing

Separately from the vendors above, the contact details described in Section 2 — name, business email, phone number, and company — are collected by AI-Orbit's own systems and a copy is then exported to EngageBay, our customer-relationship and marketing platform, which uses Mailgun to deliver email on our behalf. These two vendors receive contact details only. They do not receive Customer Data: your email content, calendar events, contacts, and attachments are never sent to them.

We may also disclose information to comply with law, enforce our terms, or in connection with a merger, acquisition, or asset sale. A current subprocessor list is available on request from privacy@ai-orbit.io. Business customers may ask to be notified of, and to object to, new subprocessors; those mechanics are set out in our Data Processing Agreement (see Section 14).

9. Retention

• Connected data. We retain email and calendar data accessed from your connected accounts for 30 days on a rolling basis, and delete it after that.
• Availability information from people who are not our users. The connection to their calendar is closed as soon as they answer. The computed availability is held only while that meeting is being arranged, and is deleted within seven days in every case. It is never added to a profile or a contact record. See Section 5.
• Account contact information. We retain the contact details associated with your account — name, business email, company — for as long as your account is active, and afterwards as needed for our business records and to meet legal, tax and accounting requirements. This information is not deleted on the 30-day cycle described above.
• Other account and billing records. Retained for as long as your account is active, and afterwards only as required for legal, tax, and accounting purposes.
• After termination. For 30 days after your account terminates or expires, you may export your Customer Data. We delete or de-identify it within 30 days after that export window closes, unless longer retention is required by law. This matches Section 14 of our Terms of Service.
• Backups. Data may persist in encrypted backups after it is deleted from active systems. Those backups are overwritten on our ordinary backup rotation, after which the data is no longer recoverable.

10. Security

We use commercially reasonable safeguards, including OAuth 2.0, encryption in transit and at rest, access controls and least-privilege, and multi-tenant data isolation (organization-scoped). No system is perfectly secure.

11. Breach and incident notification

If we become aware of a personal-data breach affecting information we hold, we will notify affected individuals and/or our business customers without undue delay and consistent with applicable law. Where AI-Orbit acts as a processor of Customer Data on a business customer’s behalf, we notify that business customer without undue delay after becoming aware, in accordance with our Data Processing Agreement, and assist them with their own notification obligations; the business customer, as controller, is generally responsible for notifying affected individuals and regulators. Where AI-Orbit acts as controller (for example, for account, website, or usage data), we will notify affected individuals and any regulators as required by law.

On becoming aware of a suspected incident we will investigate and contain it, assess what data and individuals are affected, notify the appropriate parties within the timeframes applicable law requires, and describe the nature of the incident, the likely consequences, and the measures taken or proposed.

12. Your privacy rights

12.1 US state privacy rights

This section applies to residents of US states with comprehensive privacy laws, including California. Under the California Consumer Privacy Act as amended (CCPA/CPRA), the categories below serve as our notice at collection. The CCPA applies to personal information collected in a business-to-business context, so it can cover business contact and account data.

Notice at collection. In the past 12 months we have collected the following categories of personal information: identifiers (name, business email, company); commercial and billing information; internet and network activity (usage and device data, log data, IP address); and the contents of connected email, calendar, contacts, and attachments where you authorize the Service (Customer Data). We collect this information from you, from your use of the Service, and from the accounts you connect. We use it for the purposes in Section 3, disclose it to the service providers in Section 8, and retain it as described in Section 9.

Do not sell or share. We do not sell your personal information and we do not “share” it for cross-context behavioral advertising, and we have not done so in the prior 12 months.

Sensitive personal information. To the extent email or calendar content contains sensitive personal information, we use it only to provide the Service and for purposes that do not require offering a right to limit. We do not use or disclose sensitive personal information to infer characteristics. Where a right to limit applies, you may direct us to limit the use of your sensitive personal information by contacting privacy@ai-orbit.io.

Your rights. Depending on your state, you may have the right to: know and access the personal information we hold about you; delete it; correct it; obtain a portable copy; opt out of the sale or sharing of personal information and of targeted advertising (we do none of these); limit the use of sensitive personal information; appeal a denial of a request; and not be discriminated against for exercising your rights.

How to exercise. Submit a request to privacy@ai-orbit.io. We will verify your identity using the information associated with your account before responding, and we do not use verification information for any other purpose. You may use an authorized agent to submit a request on your behalf; we may require proof of the agent’s authorization and verification of your identity.

Opt-out preference signals. We honor the Global Privacy Control (GPC) and similar browser-based opt-out preference signals as a valid request to opt out of sale/share and targeted advertising for that browser or device.

Response timeframe. We will acknowledge and respond within the timeframe applicable law requires — for CCPA requests, generally within 45 days, with one permitted extension where necessary and with notice to you.

California “Shine the Light.” California residents may request information about disclosures of personal information to third parties for their direct-marketing purposes. We do not share personal information with third parties for their own direct marketing; you may confirm this by contacting privacy@ai-orbit.io.

Nevada. Nevada residents may submit a request that we not sell certain covered information. We do not sell such information; you may direct questions to privacy@ai-orbit.io.

Other states. These rights extend to residents of other states with comprehensive privacy laws now in effect. We honor the equivalent rights available under each applicable state law.

12.2 Canada

For business customers in Canada, you may request access to the personal information we hold about you and ask us to correct it. Contact privacy@ai-orbit.io. We handle personal information in accordance with applicable Canadian privacy law, and you may raise concerns with the Office of the Privacy Commissioner of Canada.

12.3 GDPR and UK GDPR

We do not currently offer the Service in the European Economic Area or the United Kingdom. Where the GDPR or UK GDPR nonetheless applies to personal data submitted to the Service, the following applies.

Roles. For Customer Data that we process on a business customer’s behalf, that business customer is the controller and AI-Orbit is the processor; we act on the customer’s documented instructions and direct data-subject requests to that customer. For account, website, and usage data, AI-Orbit is the controller.

Legal bases (Article 6). Where we act as controller, we rely on: performance of a contract (to provide the Service and manage your account and billing); legitimate interests (to secure, operate, and improve the Service, to communicate with you, and to compute mutual availability under Section 5), balanced against your rights and freedoms; consent (where required, for example for certain cookies or optional communications), which you may withdraw at any time; and legal obligation (to comply with tax, accounting, and other legal requirements).

Special-category data. See Section 6. Where email or calendar content contains special-category data, we process it only to provide the Service; the business customer is responsible for its lawful basis under Article 9.

Your rights. Subject to the law, you may access your data; correct it; delete it; restrict or object to certain processing; port it; withdraw consent where processing is based on consent; and lodge a complaint with your data-protection supervisory authority. To exercise rights, contact privacy@ai-orbit.io. Where we hold data as a processor, we will refer your request to the relevant business customer.

13. International transfers

We operate in the United States, and information is processed in the United States. Our hosting, database, storage and AI-processing vendors listed in Section 8 process data in the United States. Because we serve business customers in Canada as well as the United States, personal data may be transferred across the Canada–US border and will be handled as described in this Policy. Should we begin offering the Service in the European Economic Area or the United Kingdom, we will put an appropriate transfer mechanism in place and publish an updated version of this Policy before doing so.

14. Data Processing Agreement

Business customers who require a Data Processing Agreement (DPA) governing our processing of Customer Data on their behalf — including processor obligations, subprocessor notice and objection, international-transfer mechanisms, and security measures — may request and execute one by contacting privacy@ai-orbit.io. The DPA forms part of the Terms of Service where executed.

15. Automated decision-making and AI

The Service uses AI to assist you — for example, to triage email, draft replies, and propose meeting times. It does not make solely automated decisions that produce legal or similarly significant effects about you. A human remains in the loop: you review and approve AI Output before anything is sent or booked. As stated above, we do not use your Customer Data to train AI models, and we do not permit our AI vendor to use it to train their models.

16. Cookies and analytics

Our website uses cookies and similar technologies in two categories.

Essential cookies are necessary for the site to function.

Analytics cookies help us understand how the site is used. We use Google Analytics 4 (gtag.js). It sets cookies in the _ga family — typically _ga and a property-specific _ga_ cookie — which record a randomly generated identifier, and it collects usage and device information including a truncated IP address. We use this only to understand site traffic. We do not use it for advertising, and we have not enabled Google Analytics advertising or remarketing features.

Consent. Because the Service and this website are currently offered in the United States and Canada, we do not at present display a cookie consent banner. Before we offer the Service in the European Economic Area or the United Kingdom, we will implement a consent mechanism and set non-essential cookies only after consent.

Your controls. You can block or delete cookies through your browser settings, and you can opt out of Google Analytics using Google’s browser add-on. Blocking essential cookies may prevent parts of the site from working.

Do Not Track. Some browsers offer a “Do Not Track” setting. There is no common industry standard for responding to it, and our website does not respond to Do Not Track signals. We do honor the Global Privacy Control, as described in Section 12.1.

17. Children

The Service is a business tool and is not directed to anyone under 18, and we do not knowingly collect information from children.

18. Changes to this Policy

We may update this Policy and will post the new version number and effective date; material changes will be notified as required. The current version and effective date appear at the top of this Policy. Previous versions are available on request from privacy@ai-orbit.io.

19. Contact and requests

For privacy questions or to make a data-subject or consumer request, contact us at privacy@ai-orbit.io. You may also reach us at james@ai-orbit.io or via ai-orbit.io. We aim to acknowledge requests promptly and to respond within the timeframe applicable law requires (for example, generally 45 days for CCPA requests).

If you need this Policy in an alternative format, contact privacy@ai-orbit.io and we will accommodate the request.