Privacy policy

Orbitr is a workspace that social media and video agencies use to plan, produce, approve, publish and report on content for their clients. It is operated by Orbitr App Pty Ltd (“we”). This policy explains what personal information we collect, why, and how you can access, correct or delete it. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).

Who this covers

• Agency team members who sign in to Orbitr.
• Agency clients who review content or send requests through a private link.
• People who interact with a connected social media account, for example by commenting on a post or sending a message to a business that uses Orbitr.

What we collect

• Account details: name, email address, role and notification preferences.
• Work content: posts, captions, videos, images, designs, documents, comments, tasks and the activity history around them.
• Connected social accounts: when an agency connects Instagram, Facebook, TikTok or LinkedIn, we receive access tokens and the account's public profile, posts, insights, comments and direct messages, only as permitted by each platform and only for accounts the agency manages.
• Messages and comments from the public: the name, username, profile picture and content of comments and messages sent to a connected account, so the agency can read and reply to them.
• Technical information: device and browser type, IP address and error logs, used to keep the service secure and working.

How we use it

• To provide the service: scheduling and publishing posts, showing comments and messages in the inbox, sending replies the agency writes or approves, reporting on performance and notifying team members.
• To draft content: text may be sent to our AI provider (Anthropic) to draft captions, briefs and replies. It is not used to train AI models.
• To keep the service secure, fix problems and meet legal obligations.

We do not sell personal information, and we do not use data from connected social accounts for advertising or to build profiles of individuals.

Automated replies

Agencies can set rules that reply automatically to some comments and messages. Replies are limited in number and timing, never sent in response to complaints or sensitive messages (these go to a person), and can be switched off by the agency at any time.

Who we share it with

We use trusted providers to run Orbitr. Each only receives what it needs:

• Supabase (database and sign in, hosted in Sydney, Australia)
• Cloudflare R2 and Mux (file storage and video playback)
• Vercel (hosting)
• Resend (email notifications)
• Anthropic (AI drafting)
• Meta, TikTok and LinkedIn, when the agency publishes or replies through them

Some providers may process data outside Australia. Where that happens we require them to protect it to a standard comparable to the Australian Privacy Principles.

How long we keep it

We keep work content while the agency's workspace is active. Data from connected social accounts is refreshed regularly and removed within 30 days of the account being disconnected. When a workspace is closed, its data is deleted within 90 days, except where we must keep records by law.

Your choices

• Access or correct your information by emailing privacy@orbitr.com.au.
• Ask us to delete your information. See our data deletion page for how.
• Disconnect a social account at any time from the workspace settings, or from the platform's own settings.

Security

Data is encrypted in transit and at rest, access is limited by role, and files are backed up nightly to a separate location.

Complaints

If you have a concern about how we handle your information, email privacy@orbitr.com.au and we'll respond within 30 days. If you're not satisfied, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.