Privacy and data practices
This page describes the data Orbyte actually stores or processes today, where, and by whom. It is generated from a registry that automated tests keep in step with the code. It states what is not available yet, such as self-service account deletion, and it is an explanation of practices, not legal advice.
What we store or process
- Account
- Your name, email address, role, language preference and a hash of your password (never the password itself).
- Sign-in sessions
- A session record with an expiry time, and the IP address and browser description of the device that signed in. Sessions are deleted when you sign out or an administrator deactivates you.
- Organization data
- What you and your team enter: organization settings, and as modules are released, clients, products, invoices, leads, tasks and documents. Each organization sees only its own data.
- Audit records
- An append-only record of changes: who or which AI run changed what and when. It cannot be edited or deleted, and is kept as long as the organization exists.
- AI processing
- AI features send the text, audio or images you choose to the model provider. We record a short summary, the model, token use and cost of each call, not the full content of your documents.
Cookies and local storage
| Name | Purpose | When |
|---|---|---|
| better-auth.session_tokenCookie | Keeps you signed in. First-party, expires after 7 days. | When you sign in or create an account |
| themeLocal storage | Remembers light or dark mode on your device. | When you switch the theme |
| localeLocal storage | Remembers your language in the app. | When you switch the language in the app |
| orbyte_consentLocal storage | Remembers your analytics choice so we do not ask again. | When you accept or decline analytics |
| _ga, _ga_*Cookie | Google Analytics 4 measurement of visits to the public pages. | Only after you accept analytics |
Who processes data for us
Meta Platforms (Meta Model API)(in development)
Runs the language, speech and image models behind the AI features.
Text and audio you send to AI features. During early access the models run on free credits, and Meta states that content may then be used to improve its products. Do not enter real client data into AI features.
Cloudflare
Delivers the site (DNS, proxy), stores files in R2 object storage and, once enabled, checks sign-ups with Turnstile.
Requests to the site (IP address, headers); uploaded files such as meeting recordings.
Google (Analytics 4)
Measures visits to the public pages.
Page views and clicks on calls to action on the public pages, only after you accept. Never inside the signed-in app.
Telegram(in development)
Delivers findings and approval buttons to the Telegram chat you link.
Your Telegram chat id and the messages the assistant sends and receives.
Not available yet
- Self-service account deletion and data export. Write to the contact address and we handle it by hand.
- Automatic deletion of audit records and AI run history.
- Email verification and multi-factor sign-in.
Questions or requests: [email protected]
Last updated: