Privacy Policy

Orbinly is operated by Picxer Technologies, LLC, a Florida limited liability company. In this policy “Orbinly”, “we” and “us” mean that company. We act in two different roles, and this policy says which applies:

• Controller: for information about the people and organisations who sign up for Orbinly and visit our website (agency owners and their team members, people who contact us, and visitors). We decide why and how that information is used.
• Processor (service provider): for the information our customers store in their workspaces about their own clients and contacts. The customer decides why and how that information is used, and we handle it on their instructions under our Data Processing Addendum. If you are a client of one of our customers, see section 14.

We collect the following categories of data:

• Account information: name, email address, and a password hash when you register (we never store your password itself), and the role you hold in a workspace.
• Workspace information: agency name, branding assets, and billing information (card details are processed by Stripe, which never shares the full card number with us).
• Usage and device information: pages visited, features used, IP address, browser and device type, and error logs to help us operate, secure and improve the product.
• Content you create: files, messages, project data, invoices, proposals, contracts and client records you create or upload within the Service, including personal data about your clients.
• Security records: an audit log of important actions, such as sign-ins (including failed ones), changes to security settings and AI use, kept to protect accounts and workspaces. When you create an account, accept an invitation to join a workspace, or are asked to review our terms again, we also record that you accepted our Terms, Privacy Policy and Data Processing Addendum. If you use a client portal and acknowledge this Privacy Policy there, we record that too. In each case we keep which versions, when, and the IP address and browser you used.
• Communications: what you send us when you email us or use the contact form, and the emails we send you.
• From others: your customer or colleague who invites you to a workspace gives us your name and email; Stripe tells us whether a payment succeeded; and if you sign in through your organisation’s single sign-on, your identity provider tells us who you are.

We do not ask you for, and our service is not designed for, sensitive data such as health information, government identifiers or card numbers in free-text fields. Please do not put them in messages or files.

We use your data only to:

• Provide, operate, and improve the Service
• Process payments and send billing notifications
• Respond to support enquiries
• Keep the Service secure, prevent abuse and fraud, and keep an audit trail
• Generate AI-assisted drafts and answers, only when a workspace has turned on the optional AI features (see section 5)
• Send product updates (opt-out available)
• Comply with legal obligations

Where the GDPR or UK GDPR applies to us as controller, we rely on these legal bases:

We never sell your data to third parties or use it for advertising purposes. We do not “share” personal information for cross-context behavioural advertising, and we do not make decisions about you that have legal effects by automated means.

We share data only with the sub-processors required to deliver the Service (the full list, with locations, is on our sub-processors page):

• Supabase — Database, sign-in (authentication) and file storage
• Vercel — Hosting and the servers that run Orbinly
• Resend — Sending email: invitations, sign-in links, invoices, reminders and notifications
• Stripe — Payments: Orbinly's own subscription billing, and client invoice payments for workspaces that connect Stripe
• Anthropic — AI provider, used only if a workspace turns on the optional AI features (see section 5)
• Cloudflare (Turnstile) — Bot protection (a security check) on the sign-in, sign-up and password-reset forms

These providers process data under the data protection terms of their service agreements with us. We also share data when you ask us to (for example when you send an invoice, the recipient sees it, and when you connect accounting software such as QuickBooks Online or Xero, it receives your invoices, payments and client details); with professional advisers and insurers under duties of confidentiality; when the law, a court or a government authority requires it; to protect rights, safety and security; and with a buyer or successor if Orbinly is involved in a merger, sale or reorganisation (we will tell you first if your data would be subject to a materially different policy).

Orbinly offers optional AI features, such as drafting replies, summarizing activity, drafting proposals, and a client-facing assistant. They are off by default, available only if a workspace owner or admin turns on the AI Assistant, and never available in workspaces using HIPAA safeguards.

When someone uses an AI feature, the content needed for that request (for example, the messages in a conversation or the project and invoice details being summarized) is sent to Anthropic, PBC, to generate the response. Content is sent only at the moment a feature is used, never in the background. Anthropic processes it as our service provider under its Commercial Terms and Data Processing Addendum and, under those terms, does not use it to train its models. Anthropic may keep inputs and outputs for a limited period, currently up to 30 days, and longer where flagged for safety review or required by law.

AI output is a draft or an answer for a person to check. Orbinly doesn't send messages, change records or take payments based on AI output without a person's action.

Orbinly is based in the United States and our providers process data in the United States. If you are in the European Economic Area, the United Kingdom or Switzerland, your data is therefore transferred to the United States. Where the law requires a safeguard for that transfer, we rely on the European Commission’s Standard Contractual Clauses and the UK addendum to them, which are built into our Data Processing Addendum, together with the measures described in section 10. You can ask us for a copy of the safeguards using the contact details in section 17.

We keep data for as long as we need it for the purpose it was collected for:

We employ industry-standard security measures including encryption in transit (TLS), encryption at rest, row-level security on all database tables, and signed file URLs that expire automatically. Access to production systems is restricted to authorised personnel only. See our Security page. If a breach affects your personal data we will tell you and the authorities as the law requires.

Depending on where you live, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict certain types of processing
• Data portability (receive your data in a machine-readable format)
• Withdraw consent you have given, at any time
• Opt out of the sale or sharing of your personal information (we do neither)
• Lodge a complaint with your supervisory authority

To exercise any of these rights, email privacy@orbinly.com. We may need to confirm your identity first. We aim to answer within one month (45 days for California, extendable once where the law allows) and will not treat you worse for using your rights. You can ask an authorised agent to make a request for you. If we refuse a request, tell us if you want to appeal and we will review it, and you can then contact your regulator.

If your data is in a workspace run by one of our customers, we act on their instructions, so we will pass your request to them (see section 14). In the UK you can complain to the Information Commissioner’s Office; in the EU, to your national data protection authority; in the United States, to your state’s attorney general.

Beyond the contractual safeguards in section 6, we limit who can access production data, encrypt it in transit and at rest, keep an audit log, and will challenge or narrow a government request for customer data where we have good grounds to. We tell the customer concerned about a request unless the law prevents us.

This section applies to residents of California and other US states with privacy laws. In the last 12 months we collected the categories below, for the purposes described in section 3, and disclosed them only to the service providers described in section 4. We do not sell or share personal information, and we do not knowingly collect or sell the personal information of anyone under 16.

We keep each category as described in section 7. Your rights are in section 9; you can use them by email at privacy@orbinly.com. Because we do not sell or share personal information or track you across other sites, there is nothing to opt out of and browser Do Not Track and Global Privacy Control signals do not change how we handle your data.

We use strictly necessary cookies to maintain your session and ensure the Service functions correctly. We do not use tracking or advertising cookies. See our Cookie Notice for the details.

We send emails that are part of the Service, such as invitations, sign-in links, receipts, invoices, security alerts and notices about your account. You cannot opt out of these while you have an account. We also send product updates, which you can opt out of using the link in each one. Emails your customers send through Orbinly are sent for them, and they are responsible for their content.

If you were invited to a client portal run by an agency or freelancer, they are the controller of your information and Orbinly is their processor. They decide what information is kept about you and why, so questions, access, correction and deletion requests are best sent to them. If you contact us, we will pass your request to them, and we do not use your information for our own purposes beyond running and securing the Service. We keep a record that you signed in and what you viewed or did in the portal so the agency and we can see activity and keep it secure.

Orbinly is a business service and is not directed to children. You must be at least 18 years old, or the age of majority where you live if that is higher, to use it, and we do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, contact us at the address in the Contact section below and we will delete it.

We will notify you by email of material changes to this policy at least 14 days before they take effect. The “Last updated” date at the top of this page reflects the most recent changes.

Privacy questions, requests or DPA requests:

Picxer Technologies, LLC, a Florida limited liability company, operates Orbinly. Email privacy@orbinly.com.