Privacy policy

Last updated: 7 September 2026

Orbit is a social-media planning, publishing and analytics service operated by Orange X. This notice explains how we use personal data when you create an Orbit account, collaborate in a business workspace, connect Meta accounts or contact us. Questions and rights requests can be sent to chris@orangex.co.uk.

1. Who is responsible for your data

Orange X, operating the Orbit service, is the controller for account administration, security, service communications and operation of Orbit. A business using Orbit generally remains responsible for the content, customer information and other personal data it chooses to upload or publish; for that material, Orbit acts on the business’s instructions.

2. Information we collect

• Account and team information: name, email address, encrypted password credentials, workspace memberships, permissions and invitations.
• Business and brand information: business name, website, location, brand guidance, colours, logos, offerings and content preferences.
• Content: prompts, check-in answers, drafts, captions, schedules, uploaded images and videos, consent classifications, generated visuals and publishing history.
• Connected social-account data: Facebook Page and Instagram professional-account identifiers, usernames, encrypted access tokens and the permissions granted through Meta.
• Social content and analytics: posts published through Orbit and, when requested, eligible older posts from connected accounts; metrics may include likes, reactions, comments, shares, saves, reach, impressions, views, clicks, follower counts and permalinks.
• Service and security data: session identifiers, password-reset records, timestamps, error logs and technical information needed to secure and operate the service.

3. How we obtain information

We receive information directly from users, from invited collaborators, from content and media uploaded to Orbit, and from Meta when an authorised user connects Facebook or Instagram. We create derived information such as AI-generated drafts, media descriptions, content suggestions and performance summaries.

4. Why we use it and our lawful bases

• To create accounts, provide workspaces, prepare content, publish approved posts and provide analytics: performance of our contract with the user or customer.
• To secure the service, prevent misuse, diagnose faults and improve reliability: our legitimate interests in operating a safe and effective service.
• To send password resets, invitations, check-in reminders and essential service communications: performance of our contract and our legitimate interests in administering the service.
• To meet legal, regulatory or lawful disclosure requirements: compliance with legal obligations.
• Where we specifically ask for consent, you may withdraw it at any time without affecting earlier lawful processing.

5. Meta data

Orbit uses information received from Meta only to connect accounts, display authorised account information, publish content selected by the user, retrieve eligible post and account insights, and diagnose publishing activity. Orbit does not sell Meta data or use it for third-party advertising. Removing Orbit through Meta or disconnecting an account stops future access, subject to data already retained as described below.

6. AI processing

Information supplied for content generation or media understanding may be sent to our AI service provider to produce drafts, plans, descriptions or visuals. Users should not submit sensitive personal data unless it is necessary, lawful and suitable for the intended publication. AI output is provided for human review and should be checked before approval or publishing.

7. Who receives information

We use service providers to run Orbit, including Railway for application hosting, Cloudflare R2-compatible object storage for media, OpenAI for enabled AI features, Resend for transactional email, and Meta for Facebook and Instagram connection, publishing and insights. We may also disclose information to professional advisers, authorities or a successor organisation where lawfully required. Providers receive only the information needed for their role and are subject to applicable contractual and security controls.

8. International transfers

Some providers may process information outside the United Kingdom. Where required, we rely on recognised adequacy regulations or appropriate contractual safeguards and supplementary measures. Contact us if you would like more information about safeguards relevant to your data.

9. Retention

Account, workspace, content and media data are generally kept while the relevant account or customer relationship remains active. Social access tokens are retained while a connection is active. Password-reset links expire after one hour. We retain operational and security records only for as long as reasonably needed for support, fraud prevention, legal obligations and dispute resolution. Following a verified deletion request, we delete or anonymise relevant data unless retention is required by law; residual backup copies may remain until securely overwritten in the ordinary backup cycle.

10. Cookies and local storage

Orbit uses an essential, secure session cookie to keep users signed in and local browser storage to remember the light or dark theme. We do not currently use advertising cookies or third-party behavioural advertising trackers.

11. Security

We use measures designed to protect information, including password hashing, encrypted social-access tokens, private object storage, permission-based workspace access and time-limited security tokens. No online service can guarantee absolute security.

12. Your rights

Depending on the circumstances, UK data-protection law may give you rights of access, correction, erasure, restriction, portability and objection. Where processing relies on consent, you may withdraw it. You have the right to object to processing based on legitimate interests. Contact chris@orangex.co.uk to exercise a right. We may need to verify your identity. You may also complain to the UK Information Commissioner’s Office at ico.org.uk.

13. Children

Orbit is a business service and is not intended for children. We do not knowingly offer accounts to children.

14. Changes

We may update this notice when Orbit, our providers or legal requirements change. We will publish the revised date here and provide additional notice where a change materially affects users.