Privacy Policy

When you create an Orbit360 account, we collect your email address, display name, and profile avatar (if provided via OAuth). We use this information to authenticate you, create your workspace, and maintain your session. We support email/password authentication and Google OAuth sign-in. If you use Google OAuth, we receive your name, email, and profile picture from Google. We do not access any other Google account data. Your authentication credentials are managed by our secure identity provider. Passwords are never stored in plain text. Session tokens are encrypted and expire after a defined period of inactivity.

Your workspace is the central container for all your Orbit360 data. Each workspace has a unique identifier, name, and slug. We store workspace membership records to control who can access your data. Workspace data includes: - Posts, drafts, and content ideas - Approval workflows and feedback comments - Publishing schedules and job queues - Brand configurations and content pillars - Activity logs and audit trails All workspace data is scoped to your workspace. Other workspaces cannot access your data. Workspace owners and members with appropriate roles can access data within the workspace according to the role-based permissions system.

When you connect a social account (such as LinkedIn), we store the connection metadata including the platform type, account identifier, account name, and connection status. Access tokens for publishing are stored securely and are scoped to your workspace. For LinkedIn connections, we request the minimum necessary permissions to publish content on your behalf. You can disconnect your social accounts at any time from the Connections page. Disconnecting removes the stored tokens and stops all publishing activity for that account. We do not post content without your explicit action (direct publish or scheduled publish that you configured). We do not access your social network, connections list, or private messages.

When you create and publish content through Orbit360, we store the post content (title, caption, media), publishing target (platform and account), and publishing status. Published content is sent to the connected social platform using the stored access tokens. We maintain a publishing history that includes: - Post content and metadata - Target platform and account - Publishing timestamps - Success or failure status - Error messages (if publishing failed) This history is retained for operational and auditing purposes. You can view and retry failed publications. Deleting a post from Orbit360 does not remove it from the social platform if it was already published.

We collect anonymized usage analytics to improve Orbit360's performance and user experience. This includes page views, feature usage patterns, and error reports. Analytics data is aggregated and does not contain personal content from your posts or workspace. We do not use your content or workspace data for advertising purposes. We do not sell or share your data with third parties for marketing. For operational monitoring, we log system events such as publishing attempts, connection health checks, and scheduled job executions. These logs are used to maintain service reliability and troubleshoot issues.

When you invite team members to your workspace, we collect the invited email address to send the invitation. The invited person receives an email with a secure invitation link. Invitation emails are sent through our transactional email service. The invitation link contains a unique token that expires after a set period. If the invitation is not accepted, the token becomes invalid and the email record is retained for audit purposes. We do not use invitation email addresses for any purpose other than delivering the invitation. Invited users control whether to accept the invitation and create an account.

Orbit360 uses cookies and browser local storage for essential functionality: - Authentication session tokens: stored in local storage to keep you signed in - Theme preference: stored in local storage to remember your dark/light mode setting - Chart preset preferences: stored in local storage for dashboard customization We do not use tracking cookies for advertising or cross-site tracking. All client-side storage is used solely to improve your experience within Orbit360. You can clear Orbit360's local storage and cookies through your browser settings. Doing so will sign you out and reset your preferences.

Your data is stored in secure cloud infrastructure with encryption at rest and in transit. Access to production databases is restricted to authorized personnel. We implement Row-Level Security (RLS) policies to ensure that workspace data is only accessible to authenticated members of that workspace. Social account tokens are encrypted and never exposed in client-side code. You have the right to: - Access your personal data - Update your profile information - Delete your account and associated data - Export your workspace content To request data deletion or export, contact support. Account deletion removes your profile, workspace memberships, and personal data. Workspace data may be retained if other members remain in the workspace.