Privacy Notice

1. Who we are

This Privacy Notice describes how Orbit Labs South Africa (PTY) LTD ("Orbit Labs", "we", "us") collects, uses, and protects your personal data when you use OrbitCowork (the "Service"). Orbit Labs South Africa (PTY) LTD acts as the data controller of personal data processed in connection with the Service.

2. Personal data we collect

• Account information — name, email address, password (hashed), profile photo, and authentication identifiers.
• Workspace content — pages, tasks, calendar events, chat messages, files, and other content you upload.
• Usage and telemetry — pages visited, features used, error logs, device type, browser type, and timestamps.
• Device and connection data — IP address, approximate location derived from IP, device identifiers, and operating system.
• Support communications — messages you send to support and any attachments.
• Billing data — limited customer reference data needed to provision your subscription. Full payment details (card numbers, billing addresses) are collected and processed by our payment provider Paddle, not by us.

3. How we use your personal data

• Provide the Service — create and run your account, store your workspace, route messages and notifications. (Legal basis: performance of a contract.)
• Security and fraud prevention — detect abuse, prevent unauthorized access, protect users. (Legitimate interests.)
• Customer support — respond to your questions and troubleshoot issues. (Performance of a contract / legitimate interests.)
• Product improvement — understand how features are used so we can improve them. (Legitimate interests.)
• Billing and tax compliance — manage subscriptions, process payments, and meet legal obligations. (Performance of a contract / legal obligation.)
• Legal obligations — comply with laws, respond to lawful requests. (Legal obligation.)
• Marketing — only with your consent or where permitted by law. You can opt out at any time.

4. Who we share data with

• Service providers and subprocessors — hosting, database, email delivery, analytics, error monitoring, and customer-support tooling. These vendors are bound by contract to use your data only to provide services to us.
• Paddle.com (Merchant of Record) — Paddle processes the sale of OrbitCowork subscriptions on our behalf. Paddle handles payments, tax calculation and remittance, invoicing, refunds, and chargebacks. See Paddle's Privacy Policy.
• Other workspace members — content you create inside a workspace is visible to other members of that workspace, in line with the access controls you configure.
• Professional advisers — lawyers, auditors, and accountants where reasonably required.
• Authorities — where required by law, court order, or to protect our rights or others' safety.
• In a corporate transaction — if Orbit Labs is involved in a merger, acquisition, or sale of assets, your data may be transferred, subject to this Notice.

5. International transfers

Your data may be processed in countries other than the one you live in, including by our subprocessors. Where data is transferred out of South Africa, the UK, or the EEA, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

6. Data retention

We keep personal data only as long as necessary to provide the Service and to meet legal, accounting, or reporting obligations. When you delete content or your account, we will delete or anonymize the associated personal data within a reasonable period, except where we are required to retain it (for example, billing records for tax purposes).

7. Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you;
• Have inaccurate personal data corrected;
• Have your personal data deleted (subject to legal retention requirements);
• Restrict or object to certain processing;
• Receive your personal data in a portable format;
• Withdraw consent where processing is based on consent;
• Lodge a complaint with the South African Information Regulator (or your local data-protection authority).

To exercise any of these rights, email us at privacy@orbitcowork.app. We will respond within one month.

8. Security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit, encryption at rest for sensitive fields, role-based access controls, and regular reviews of our security practices. No system is completely secure — please choose a strong password and enable any additional authentication we offer.

9. Cookies

OrbitCowork uses essential cookies to keep you signed in and to remember your preferences. We may also use limited analytics cookies to understand how the Service is used. You can manage cookies through your browser. Disabling essential cookies will prevent the Service from working correctly.

10. Children

OrbitCowork is not intended for children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us so we can delete it.

11. Changes to this Notice

We may update this Notice from time to time. If we make material changes, we will notify you (for example, by email or in-app notice) before the changes take effect.

12. Contact

For privacy questions or requests, email privacy@orbitcowork.app. You can also write to: Orbit Labs South Africa (PTY) LTD, Privacy Team, South Africa.