Privacy Policy

OrbitB2B ("OrbitB2B," "we," "us," or "our") provides an AI-powered B2B matchmaking and outreach platform that helps trading and manufacturing companies find, qualify, and communicate with business leads. This Privacy Policy explains what information we collect, how we use it, how we protect it, and the choices you have — including specific commitments about data we access through Google APIs.

By creating an account or using OrbitB2B, you agree to the practices described in this policy.

Account information. Name, email address, password (hashed, never stored in plain text), organization/company details, and role within your team.

Business data you provide. Trade offers, catalog items, lead and prospect records, deal and pipeline data, campaign and message content, and any files you upload.

Google user data. If you connect a Google account, we access and process the specific data described in Section 4 below, and only for the purposes described there.

WhatsApp and email delivery data. Message content, delivery status, and reply content when you send outreach through WhatsApp or SMTP integrations you configure.

Billing information. Subscription plan and payment status. Payment card details are collected and processed directly by our payment processor (Paddle) — OrbitB2B never receives or stores your full card number.

Usage data. Log data, IP address, browser type, and actions taken within the app, collected automatically for security, rate-limiting, and reliability purposes.

• To provide, operate, and maintain the core matchmaking, CRM, and outreach features of OrbitB2B
• To send outreach emails, WhatsApp messages, and calendar invitations on your behalf, at your direction
• To score and prioritize leads using AI, based on your business profile and catalog
• To detect, prevent, and respond to fraud, abuse, and security incidents
• To process subscription payments and manage your billing plan
• To communicate with you about your account, security notices, and material changes to our service

We do not sell your personal information or your customers' data to third parties.

OrbitB2B's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

When you connect your Google account, OrbitB2B requests the following scopes, each used strictly for the purpose described:

• Gmail send — used only to send outreach and deal-related emails that you explicitly compose or trigger inside OrbitB2B, from your own Gmail address. We never send email on your behalf without an action you initiated.
• Gmail read — used only to detect and display replies to emails sent through OrbitB2B, so conversations stay in context inside your inbox and pipeline view. We first look only at who a message is from and which conversation it belongs to; a message that is not a reply to something you sent through OrbitB2B is never opened, read, stored or processed. For a reply, we copy its text and any attached files into your workspace so you can read and open them there.
• Calendar events — used only to create and manage calendar events for inspection calls and meetings you schedule through OrbitB2B.
• Calendar read-only (calendar.readonly) — used only to check your existing calendar for free/busy time when OrbitB2B suggests a meeting slot, so it can avoid double-booking you.
• Email address (userinfo.email) — used only to identify which Google account is connected and display it back to you in Settings.
• Profile (userinfo.profile) and OpenID (openid) — standard identity scopes requested alongside the above so Google can verify your account during sign-in; we do not currently display or store your name or profile photo beyond what's needed for that verification.

How this data is stored. OAuth access and refresh tokens are encrypted at rest (AES-256-GCM) before being stored in our database and are never exposed to your browser or any party other than the OrbitB2B servers that need them to make an authorized API call on your behalf. Gmail message content and Calendar event details relevant to a specific outreach or scheduling action are stored only as needed to display that activity inside OrbitB2B — we do not replicate or archive your full mailbox or calendar.

Human access. We do not allow any human to read your Gmail or Calendar data except: (a) with your explicit consent, (b) to investigate a security incident or abuse report, (c) to comply with applicable law, or (d) where the data has been aggregated and anonymized.

No use for advertising. We do not use Google user data for serving advertisements, and we do not transfer Google user data to any third party for their own independent use, except as strictly necessary to provide the OrbitB2B service you requested (e.g., our infrastructure and database providers, who are themselves bound by confidentiality obligations).

Deletion. You can revoke OrbitB2B's access to your Google account at any time from Settings → Google Integration → Disconnect, or directly from your Google Account permissions page. Disconnecting immediately revokes our stored tokens and prevents any further access. Upon disconnect or account termination, we delete stored Google OAuth tokens and any cached Gmail/Calendar data tied to that connection within 30 days.

Data is stored on Supabase (PostgreSQL), with row-level security policies enforcing that each organization can only access its own data. All traffic to and from OrbitB2B is encrypted in transit via HTTPS/TLS. Sensitive credentials — including Google OAuth tokens and any custom SMTP passwords you configure — are encrypted at rest using AES-256-GCM before storage. Access to production systems is restricted to authorized personnel only.

We share data only with service providers who help us operate OrbitB2B, including:

• Supabase — database, authentication, and file storage
• Vercel — application hosting
• Anthropic — AI-powered lead scoring and message drafting (only the specific business/lead data needed for that request is sent, never your full mailbox)
• Paddle — subscription billing and payment processing
• Our WhatsApp messaging provider — WhatsApp message delivery, if you enable WhatsApp outreach
• n8n — automated prospecting workflows, if enabled for your organization

Each provider is contractually restricted to using data only to provide their service to us.

We retain your data for as long as your account is active. If you close your account, we delete your personal data and organization data within 30 days, except where retention is required by law or for legitimate business records (e.g., billing history). You can request deletion at any time by contacting us at the address below.

• Access, correct, or export your account data at any time from within the app
• Disconnect any third-party integration (Google, WhatsApp, SMTP) from Settings
• Unsubscribe from any outreach-related notification via the link in that message
• Request full account and data deletion by contacting us

OrbitB2B is a business tool intended for use by adults acting on behalf of a company. We do not knowingly collect information from anyone under 18.

Your data may be processed and stored in countries other than your own, through the infrastructure providers listed in Section 6. We rely on those providers' own compliance safeguards for cross-border data transfers.

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above, and where required, we will notify you directly.

Questions about this policy or your data? Contact us at privacy@orbitb2b.app.