Orbit

Privacy Policy

Effective date: 18 July 2026 · Last updated: 18 July 2026

Who we are. Orbit is a product and sub-brand of The Universe Ministry (the ministry behind Club DAO), a religious organisation registered in the United States (EIN 87-1704844), referred to here as "the Ministry", "we", "us" or "Orbit". The Ministry is the operator of the Orbit service and the data controller for the personal data described below. Contact: expand@orbitdao.io. Postal: 13815 SW Benchview Place, Tigard, OR 97223, USA.

How Orbit is run during beta. Orbit currently operates as a community service of the Ministry. It is not run for profit while under the Ministry: any revenue is reinvested into building and operating the service, and its primary purpose is to serve projects within Club DAO and the Ministry's community.

Beta notice. Orbit is currently in active beta. The service is provided on an "as available" basis, features may change, and you should not yet store data you cannot afford to lose. This policy applies to the beta and to general availability unless we publish a superseding version.

1Scope of this policy

This policy explains how the Ministry collects and processes personal data when you visit orbitdao.io, create an Orbit account, and use the service. It covers two distinct roles:

Where we are the controller: your account and billing data, and your use of the site and product.
Where we are the processor: the contact, member and CRM records you upload about your own customers, community members or contributors. For that data, you are the controller and we process it on your behalf under our Terms. See section 9.

2Data we collect

You give us

Account data: name, email, password, workspace name, organisation, logo and brand settings.
Billing data: processed by Stripe. We receive limited billing metadata (plan, status, last four digits, country); we do not store full card numbers.
Content & CRM data: contacts, deals, messages, quests, contributions, files and notes you create or import.
AI inputs: voice notes, uploads, and text you submit to AI features.
Support & feedback: messages you send us, including beta feedback and bug reports.

We collect automatically

Usage data: pages viewed, features used, actions taken, timestamps.
Device & log data: IP address, browser, device type, and diagnostic logs.
Cookies: essential cookies for authentication and, where enabled, limited analytics. See section 12.

3How we use data

To provide, operate and secure the Orbit service.
To process payments and manage subscriptions and AI credits.
To run AI features you invoke (enrichment, the Operator, Studio, Beam and similar).
To communicate service, security and account messages, and, where permitted, product updates.
To improve reliability and fix bugs, especially during beta.
To comply with legal obligations and enforce our Terms.

We do not sell your personal data, and we do not use the CRM data you upload to train foundation-level AI models.

4Legal bases (UK/EU GDPR)

Where GDPR applies, we rely on: contract (to provide the service you signed up for), legitimate interests (to secure and improve the product), consent (for optional analytics and marketing, which you may withdraw), and legal obligation (for tax and compliance).

5Sub-processors

We use trusted third parties to run Orbit. Each processes data only as needed to provide their function:

Provider	Purpose
Stripe	Payment processing and billing
Resend	Transactional and campaign email delivery
Google (Calendar, Gmail, Drive)	Integrations you choose to connect
Microsoft (Outlook, OneDrive)	Integrations you choose to connect
AI model providers (e.g. OpenAI, Anthropic)	Processing AI inputs for features you invoke
Hosting & infrastructure provider	Application hosting, storage, databases
Other connected integrations	Only those you explicitly enable (Slack, Notion, HubSpot, Salesforce and others listed on our integrations page)

A current list is available on request at expand@orbitdao.io. We will give notice of material changes to our sub-processors.

6AI processing

When you use an AI feature, the relevant input (text, file or voice) is sent to a model provider listed above to generate a response. Providers act as our sub-processors and are contractually restricted from using your content to train their models except as permitted. AI output may be inaccurate; you remain responsible for reviewing it.

7Sharing & disclosure

We share personal data only with the sub-processors above, with parties you direct us to (for example an integration you connect), where required by law, or in connection with a corporate or organisational transfer. We never sell it.

8International transfers

Orbit operates across borders and our providers may process data outside your country, including in the United States. Where GDPR applies, such transfers rely on appropriate safeguards such as Standard Contractual Clauses.

9Data you upload about others (our role as processor)

Orbit is a CRM, so you will upload personal data about your contacts, members and contributors. For that data you are the controller and we are your processor. You are responsible for having a lawful basis and any required notices or consents to upload it. We process it only to provide the service, on your instructions, and we will assist with data subject requests as required. This section operates as a basic data processing agreement; a standalone DPA is available on request.

10Retention

We keep personal data for as long as your account is active and as needed to provide the service, then delete or anonymise it within a reasonable period, subject to legal retention requirements. You can export or request deletion of your data at any time.

11Security

We use encryption in transit, access controls and reputable infrastructure providers to protect data. No system is perfectly secure, and during beta you should not store highly sensitive or mission-critical records. We will notify you and any regulator of a qualifying data breach as required by law.

12Your rights

Depending on where you live, you may have rights to access, correct, delete, port, restrict or object to processing of your personal data, and to withdraw consent. California residents have rights under the CCPA/CPRA, including the right to know, delete, correct, and to opt out of "sale" or "sharing" (we do neither). To exercise any right, contact expand@orbitdao.io. You may also complain to your local data protection authority.

13Cookies

We use essential cookies for login and security, and, where enabled, limited analytics cookies to understand product usage. You can control non-essential cookies through your browser or any cookie banner we provide.

14Children

Orbit is not intended for anyone under 18, and we do not knowingly collect their data. The account holder who agrees to our Terms must be an adult.

15Changes

We may update this policy. Material changes will be notified in-product or by email, and the "last updated" date above will change.

16Contact

The Universe Ministry, operator of Orbit. Contact: expand@orbitdao.io. Postal: 13815 SW Benchview Place, Tigard, OR 97223, USA.

Not legal advice. This document is a starting template tailored to your setup. Have a qualified lawyer review it before general availability or once you incorporate a dedicated Orbit entity, and confirm the Ministry's ability to operate a commercial product with a US non-profit accountant.