OrbitoDesk

Legal

Privacy Policy

Effective date: June 3, 2026 · OrbitoDesk

🔒

Your data is yours

We never sell your data or customer data to third parties, ever.

🛡️

Secure by design

All data is encrypted in transit and at rest using industry standards.

🗑️

Delete anytime

Delete your account and all associated data at any time, no questions asked.

1

Introduction

OrbitoDesk ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information. By using OrbitoDesk, you consent to the data practices described here.

2

Information We Collect

Account informationName, email address, phone number, password (hashed), and optional profile details when you register.
Connected channel dataAccess tokens, account/page names and IDs for the Facebook Pages, Instagram accounts and WhatsApp Business numbers you connect. Used solely to send and receive messages on your behalf.
Conversation dataMessenger, Instagram and WhatsApp messages, comments, attached images and voice notes, and customer interactions — to provide the inbox and AI features.
Customer dataCustomer names, platform IDs, phone numbers, delivery locations, and order information that customers share with you through these channels.
Usage dataPlatform interactions, features used, and timestamps collected automatically to improve the Service.
3

How We Use Your Data

We use collected information to provide and improve the platform, process AI analysis on messages, send and receive messages on behalf of your Pages, build customer profiles for your business, send service-related communications, and comply with legal obligations.

We do not use your data or your customers' data for advertising. We never sell data to third parties.
4

AI Processing

OrbitoDesk uses AI to draft replies, detect buying intent, extract order and payment details, and understand attached images and voice notes. When processing occurs:

  • Message content, attached images, and your product catalog are sent to trusted third-party AI providers for reply generation and understanding, each governed by their own privacy policies.
  • Voice notes are transcribed by a third-party speech-to-text provider so they can be read and answered.
  • We send only what is necessary to provide the feature, and these providers do not use your data to train their models on our behalf.
  • AI never sends a reply on its own until you enable autopilot and its readiness check passes — you stay in control.
5

Data Storage and Security

Data is stored on Supabase (PostgreSQL) servers in secure data centers. Our security measures include:

  • TLS/HTTPS encryption for all data in transit
  • Passwords hashed using bcrypt (salt factor 12)
  • Restricted and audited database access
  • Short-lived JWT tokens for API authentication
  • Regular security reviews of our codebase and infrastructure
6

Data Sharing

We share your information only with:

Service providersThird-party AI providers (replies, understanding & voice transcription), our database & file hosting provider, and Meta (Messenger, Instagram & WhatsApp APIs) — only as necessary to deliver the Service.
Legal requirementsWhen required by law, court order, or governmental authority.
Business transferIn a merger or acquisition, with prior notice to you.
We never sell, rent, or trade your personal information or your customers' data.
7

Customer Data Responsibility

As a seller using OrbitoDesk, you are the data controller for your customers' personal information. You are responsible for having a lawful basis for processing customer data, responding to customer data requests, and complying with applicable data protection laws in your jurisdiction. OrbitoDesk acts as a data processor on your behalf.

8

Your Rights

Access

Request a copy of the data we hold about you

Correction

Update inaccurate information via account settings

Deletion

Delete your account and data from account settings

Portability

Export your data in a machine-readable format

Objection

Object to certain types of data processing

To exercise these rights, contact us at privacy@orbitodesk.com.

9

How to Delete Your Data

You can request deletion of all data OrbitoDesk holds about you at any time. Choose whichever is easiest:

  • In the app: go to Settings → Account and choose Delete account. This permanently removes your account and associated data.
  • By email: write to privacy@orbitodesk.com from your registered email with the subject “Delete my data”. We action verified requests within 30 days.
  • From Facebook: open Facebook → Settings & Privacy → Settings → Apps and Websites, remove “OrbitoDesk”, and choose Send Request. We receive the request automatically, delete the associated data, and provide a confirmation you can track.

Once a deletion request is verified, we erase your personal account data and your connected channel data on the timeline below, except where retention is required by law.

10

Data Retention

We retain your data while your account is active. When you delete your account:

  • Personal account data deleted within 30 days
  • Conversation and order data deleted within 90 days
  • Aggregated, anonymized analytics may be retained indefinitely
  • Data required for legal compliance retained as required by law
11

Cookies

We use only essential cookies for authentication (HTTP-only cookies) and session management. We do not use tracking, advertising, or third-party analytics cookies. Disabling essential cookies will prevent you from using the Service.

12

Children's Privacy

The Service is not directed to children under 18. We do not knowingly collect personal information from children. If we discover we have inadvertently done so, we will delete it promptly.

13

Changes to This Policy

We may update this Policy from time to time. We will notify you of material changes by email or through the Service at least 14 days before they take effect. Continued use after changes constitutes acceptance.

14

Contact Us

For privacy questions or requests: