1. Who we are and when this notice applies
1.1 This Privacy Notice explains how Cadensys Ltd, trading as Orb ("Orb", "we", "us"), collects and uses personal data. Cadensys Ltd is registered in England and Wales under company number 16171356, with its registered office at 128 City Road, London, United Kingdom, EC1V 2NX.
1.2 It applies when you visit getorb.ai, use our web workspace (app.getorb.ai) or iOS app, message Orb on WhatsApp or Telegram, or otherwise deal with us. Words with capital letters, such as Connected Accounts, Inputs and Memory, have the meanings given in our Terms & Conditions.
1.3 When we are the controller. We decide how and why your data is used, and are the controller under UK GDPR, for:
-
your account, billing and contact details
-
website visits, cookies and advertising
-
marketing, sales and support
-
data you give Orb when you use it for yourself as an individual professional.
1.4 When we are a processor. If your organisation has a Business Agreement with us, we process Your Data on its behalf and under its instructions. Your organisation is the controller, and our Data Processing Addendum applies. Questions about that data should go to your organisation first.
1.5 Contact our privacy team at privacy@getorb.ai.
1.6 Registration and EU representative. We are registered with the UK Information Commissioner's Office under registration number ZB976133. Our representative in the European Union under Article 27 EU GDPR can be reached at privacy@getorb.ai.
2. Personal data we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Contact and account data | Name, email address, phone number, account ID, login details | You, when you sign up, book a demo, fill in a form or contact us |
| Professional data | Job title, company, industry, public professional profile (e.g. LinkedIn) | You; publicly available sources |
| Messages and Inputs | Messages, voice notes and files you send to Orb on WhatsApp, Telegram, the iOS app or the web workspace | You |
| Connected Account data | Emails, calendar events, documents and other content in accounts you connect (e.g. Google Workspace, Microsoft 365, Notion, Slack) | The provider of the account you connect, with your permission |
| Outputs and Memory | Drafts, summaries and Actions Orb produces; preferences and context Orb keeps to help you | Generated by the Service |
| Billing data | Plan, invoices, payment status. Card details are held by our payment provider or Apple, not by us. | You; our payment provider; Apple |
| Device and usage data | IP address, device and browser type, operating system, language, pages viewed, clicks, referring site, dates and times | Your device, through cookies and similar technologies |
| Advertising data | Cookie and click IDs, ad interactions, hashed email address or phone number | Your browser; ad platforms; our sign-up and contact forms (see section 4) |
Other people's personal data can appear in your Inputs and Connected Accounts, for example in emails you receive. We process it only to provide the Service to you.
3. How we use your data and our lawful bases
| Purpose | Data used | Lawful basis |
|---|---|---|
| Provide the Service: run your account, respond in each Channel, connect your tools, take Actions, keep Memory | Contact and account data, Messages and Inputs, Connected Account data, Outputs and Memory | Contract |
| Billing and payments | Contact and account data, Billing data | Contract; legal obligation (tax and accounting records) |
| Support and service messages | Contact and account data, Messages and Inputs | Contract |
| Security, fraud prevention and keeping the Service running | Device and usage data, account data | Legitimate interests (protecting users and the Service) |
| Improving the Service, using aggregated or de-identified usage statistics | Device and usage data | Legitimate interests (making Orb work better) |
| Marketing emails and messages about Orb | Contact and professional data | Consent where the law requires it; otherwise legitimate interests (telling business contacts about our products). You can opt out at any time. |
| Sales and lead qualification | Contact and professional data | Legitimate interests (growing our business) |
| Advertising and measuring ad performance | Advertising data, hashed contact data | Consent for cookies and pixels; legitimate interests for server-side uploads (see section 4) |
| Complying with law and enforcing our Terms | Any relevant data | Legal obligation; legitimate interests |
We do not train AI models on Your Data. We do not use Your Data to train or fine-tune any AI model, ours or anyone else's. We require our AI model providers not to train on it either.
4. Advertising and measurement
4.1 We advertise Orb on Meta (Facebook and Instagram), Google Ads and LinkedIn. To find out which ads work, and to show relevant ads to people who are likely to be interested, we share limited data with these platforms.
4.2 Cookies and pixels on our website. With your consent, our website uses the Meta Pixel, the Google tag and the LinkedIn Insight Tag. These record actions such as visiting a page or signing up and link them to the ad you clicked. They do not run until you accept advertising cookies in our cookie banner. You can change your choice at any time in our Cookie Notice.
4.3 Contact data we upload. We may send the email address or phone number you gave us when you signed up, booked a demo or filled in a form to:
- Meta, through the Conversions API and Custom Audiences
- Google, through enhanced conversions and Customer Match
- LinkedIn, through the Conversions API and Matched Audiences.
We use these to:
-
measure which ads led to sign-ups
-
avoid showing ads to people who already use Orb
-
show ads to people similar to our customers.
4.4 How the data is protected. We hash email addresses and phone numbers (convert them into a scrambled code) before we send them. The platform compares the code with its own users' details. If there is no match, the platform discards it. Hashed data is still personal data, so we treat it as such.
4.5 Lawful basis. We rely on your consent for cookies and pixels. For contact data we upload, we rely on our legitimate interests in measuring and improving our advertising to business customers. We have assessed that these interests are balanced against your rights, given the limited data involved, the hashing and your right to object.
4.6 What we never do. We never send any of the following to advertising platforms:
-
data from your Connected Accounts, such as Gmail, Google Calendar or Google Drive
-
the content of your messages to Orb on WhatsApp, Telegram or any other Channel
-
data collected through our iOS app.
4.7 The platforms' role. Meta, Google and LinkedIn also use this data under their own privacy policies. For the website pixels, Meta and LinkedIn may be joint controllers with us for collecting and transmitting the data. Their policies:
-
4.8 How to opt out.
-
Website tracking: decline or withdraw advertising cookies through our Cookie Notice.
-
Contact data uploads: email privacy@getorb.ai with the subject "Advertising opt-out". We will stop including you in future uploads and remove you from audience lists we control.
-
Ad settings on each platform: you can also adjust these directly in your Meta, Google or LinkedIn account.
5. Google user data and other Connected Accounts
5.1 Orb's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
5.2 In particular, data from Gmail, Google Calendar and Google Drive:
-
is used only to provide and improve user-facing features of Orb that you can see and use
-
is not used to develop, improve or train generalised AI or machine-learning models
-
is not sold, transferred to data brokers, or used for advertising, including the advertising described in section 4
-
is not read by humans unless: - you give us permission for a specific message or file - it is needed for security or to comply with law - it has been aggregated and anonymised for internal operations.
5.3 We apply the same rules to data from other Connected Accounts, such as Microsoft 365, Notion and Slack.
5.4 You can disconnect an account at any time in the iOS app or web workspace. We then stop collecting new data from it. Data already collected is deleted as described in section 8.
6. Who we share data with
We do not sell your personal data. We share it only with:
| Recipient | Why | Role |
|---|---|---|
| Cloud hosting, database and infrastructure providers | To run the Service | Processor (sub-processor) |
| AI model providers | To generate Outputs; under contract not to train on your data | Processor (sub-processor) |
| Meta (WhatsApp) and Telegram | To deliver messages between you and Orb in those Channels | Independent controllers under their own terms |
| Connected Account providers (e.g. Google, Microsoft, Notion, Slack) | To read and act in the accounts you connect | Independent controllers |
| Payment providers and Apple | To take payments and manage subscriptions | Independent controllers or processors, depending on the service |
| Meta, Google and LinkedIn (advertising) | Ad measurement and audiences, as described in section 4 | Independent or joint controllers |
| Analytics, email, CRM and support tools | To understand website use, send emails and support you | Processors |
| Professional advisers and auditors | Legal, accounting and audit services | Independent controllers |
| Authorities and courts | Where required by law, or to protect rights and safety | Independent controllers |
| A buyer or successor business | In a merger, acquisition or sale of assets, under confidentiality | Independent controller |
Our current list of sub-processors is at trust.getorb.ai/subprocessors. Business customers will be told of changes to it as set out in our Data Processing Addendum.
7. International transfers
7.1 Some of our providers process data outside the UK and the European Economic Area, mainly in the United States. This includes AI model providers, cloud providers, Meta, Google and LinkedIn.
7.2 When we transfer personal data outside the UK or EEA, we use at least one of these safeguards:
-
an adequacy decision or UK adequacy regulations, including the UK Extension to the EU–US Data Privacy Framework where the recipient is certified
-
the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses
-
another safeguard allowed by law.
7.3 You can ask privacy@getorb.ai for more information about the safeguard that applies.
8. How long we keep data
| Data | How long |
|---|---|
| Your Data (Inputs, Outputs, Memory, Connected Account data) | While your account is open. Deleted within 30 days of you deleting your account, and from backups within a further 30 days. |
| Data from a disconnected account | Deleted within 30 days of disconnection |
| Billing and invoice records | 6 years, for tax and accounting law |
| Marketing and sales contacts | 24 months after our last contact, or until you opt out |
| Hashed contact data shared for advertising | Removed from future uploads when you opt out or delete your account. Each platform's own retention also applies. |
| Website and advertising cookies | As set out in our Cookie Notice |
| Security and server logs | 12 months |
You can delete your account and all Memory at any time in the Orb workspace or mobile app by following these instructions. We may keep some data for longer where the law requires it, or to resolve disputes or enforce our Terms.
9. Your rights
9.1 Under UK GDPR, and EU GDPR where it applies, you have the right to:
-
access a copy of your personal data, including the names of the recipients we have shared it with
-
correct data that is wrong or incomplete
-
delete your data
-
restrict how we use it
-
receive data you gave us in a portable format
-
object to processing based on legitimate interests, including the advertising uploads in section 4
-
object at any time to direct marketing, which we will always respect
-
withdraw consent at any time, for example for advertising cookies. This does not affect processing before you withdrew it.
9.2 To use these rights, email privacy@getorb.ai. We will respond within one month, and may ask you to confirm your identity first. If we process your data for your organisation under a Business Agreement, we may pass your request to your organisation.
9.3 Complaints. Please contact us first so we can try to help. You can also complain to the UK Information Commissioner's Office (ico.org.uk, 0303 123 1113). If you are in the EEA, you can complain to the data protection authority in your country.
10. Cookies, security, children, changes and contact
10.1 Cookies. We use cookies and similar technologies on our website. Strictly necessary cookies are always on. Analytics and advertising cookies are used only with your consent. Our Cookie Notice explains this and lets you change your choices.
10.2 Security. We protect personal data with appropriate technical and organisational measures, including encryption in transit and at rest and access controls. No system is completely secure, but we will tell you and the ICO about a personal data breach where the law requires it.
10.3 Children. Orb is for professionals aged 18 or over. We do not knowingly collect data from children. If we find that we have, we will delete it.
10.4 Changes. We may update this Privacy Notice. We will post the new version here with a new "Last updated" date and tell you about material changes through a Channel, by email or in the app.
10.5 Contact. Privacy questions: privacy@getorb.ai. Post: Cadensys Ltd, 128 City Road, London, United Kingdom, EC1V 2NX.