Privacy Policy

Last updated: 27 October 2026 · Version 1.21

1. Data controller

The controller of your personal data is:

• Owner: Mónica Lorenzo González (sole trader)
• Tax ID (NIF): 38131132F
• D-U-N-S Number: 374082016
• Registered address: C/ Garcilaso 26, 3º 1ª, 08027 Barcelona, Spain
• Contact email: orbita@orbitasolutions.org
• Website: www.orbitasolutions.org

2. What data we collect

2.1 User account

When you create an ōrbita account and use the service we may collect:

• Identification data: full name, email, postal address, phone number.
• Company data: trading name, tax details, contact details, industry, website.
• Information provided to draft your marketing plan: company description, products, services, value proposition, target audience and any other information you choose to share.
• Payment data: processed directly by Stripe (ōrbita does not store full card numbers).
• Product usage data: when you sign in, which features you use, errors and performance metrics.
• Content you upload or generate: text, images (including access to your device's photo library if you grant it) and microphone audio when you enable dictation.

2.2 Connected social network data

When a user connects their social network accounts (Meta, TikTok, X, Pinterest, LinkedIn, YouTube, Google Business Profile and others), ōrbita stores the identifiers and tokens needed to publish and to retrieve metrics, as well as public and performance data (followers, interactions, reach). We do not store passwords: authentication is performed via OAuth, in the same way as tools such as Metricool or Loomly. On the networks where ōrbita shows you the comments on your posts, the commenter's public data is held only in a temporary cache and for a limited time; the detail for LinkedIn is in section 8.9.

2.3 Waiting list (pre-launch sign-ups)

Before opening registration we ran a waiting list. If you signed up, we keep your name, email, company name, industry and the date and time of sign-up until you ask to be removed. This channel is no longer active: you can now create your account and start using ōrbita directly.

2.4 Location (marketplace search)

If you use the marketplace provider search and grant your device's location permission, we process your approximate coordinates (latitude and longitude) for a single purpose: sorting agency and freelancer results by proximity. Location is used only at the moment of the search, we do not keep a location history, and we neither share it with third parties nor use it for advertising. The permission is optional: you can deny it and search by city or postcode instead.

2.5 Newsletter

If you subscribe to our newsletter from the website, we process your email (and your preferred language, if you tell us). We use double opt-in: you are only subscribed if you confirm through the link we email you. You can unsubscribe at any time from the link included in every send, and choose which types of communication you want to receive when we offer several. The newsletter is managed by our processor Brevo (see section 6).

2.6 Information stored on your device

ōrbita stores and accesses information directly on your device or browser, and allows certain third parties to do so. Specifically:

• On the website (orbitasolutions.org): first-party and third-party cookies, local storage (localStorage and sessionStorage) and similar identifiers. Details of each cookie, its purpose, its duration and the responsible third party are set out in our Cookie Policy. Cookies that are not strictly necessary are only set if you accept them in the consent banner, and you can change your choice at any time.
• In the application (app.orbitasolutions.org and the iOS and Android apps): local device storage to keep you signed in, save your interface preferences and hold drafts while you work. This data is deleted when you sign out or uninstall the application.
• Third parties that may store or read information on your device from our website: Google (Google Analytics 4 and Google Tag Manager), Meta Platforms, TikTok, LinkedIn and OpenAI (OpenAI Ads measurement pixel), for measurement and, where you consent, advertising purposes. See our Cookie Policy.

Inside the application we do not display advertising and we do not allow third parties to serve advertising content, and data obtained from the APIs of connected social networks is never used for advertising purposes (see section 8.7).

2.7 How you found us

When you create an account we store, linked to it, the minimum information that tells us how you reached ōrbita. Specifically:

• The campaign parameters carried by the web address you arrived with (the usual utm_source, utm_medium, utm_campaign, utm_content and utm_term).
• The click identifier the advert itself adds to the address, if you came from one of our advertising campaigns.
• The domain of the site you came from (for example chatgpt.com or google.com). We store the domain only, never the full address of the referring page, and we discard ōrbita's own domains.
• The page of our website you landed on, without the parameters of the address.
• The platform you signed up from (web, iOS, Android or macOS) and the time of that first visit.

This data is collected in your own browser or device, kept for at most 7 days before the sign-up and discarded if you never create the account. No third party takes part in collecting it, it is not used to profile you or to show you advertising inside ōrbita, and it feeds no automated decision.

3. What we use your data for

• Waiting list (pre-launch sign-ups): sending product news to those who signed up before launch, until they ask to be removed.
• User account: providing the contracted service, managing your account, offering support and issuing invoices.
• Marketing plan and content: drafting your plan, generating content and publishing to your networks when you authorise it.
• Product improvement: aggregate usage analysis, error detection, performance metrics.
• Commercial communications: sending you information about new features, offers or relevant content (you can object at any time).
• Newsletter: sending the newsletters you subscribed to, with basic delivery, open and click metrics to improve the content (until you unsubscribe).
• Measuring how you found us: knowing which channel brought you to ōrbita (campaign, advert, search engine, social network or direct visit) so we can focus our outreach and measure the results of our campaigns.
• Legal compliance: accounting, tax and consumer protection obligations.

4. Legal basis for each processing activity

• Waiting list (pre-launch sign-ups), newsletter and commercial communications: your consent (art. 6.1.a GDPR).
• User account and service provision: performance of a contract (art. 6.1.b GDPR).
• Invoicing and accounting obligations: compliance with a legal obligation (art. 6.1.c GDPR).
• Product improvement, fraud prevention and security: legitimate interest (art. 6.1.f GDPR).
• Measuring how you found us: legitimate interest (art. 6.1.f GDPR): understanding how well our own outreach channels work, with minimal data and no profiling.
• Analytics and marketing cookies: your consent (art. 22 LSSI-CE).

5. How long we keep it

• Waiting list (pre-launch sign-ups): until you ask to be removed.
• Newsletter: until you unsubscribe or withdraw your consent.
• User account: for as long as your account is active. After closure, identification and billing-related data is kept for the legally required periods (up to 6 years for accounting and tax obligations, art. 30 of the Spanish Commercial Code and tax legislation).
• Technical logs: the maximum period legally permitted, with the minimum necessary for security, audit and compliance purposes (Spanish Law 25/2007 where applicable).
• Connected social network data: for as long as the connection remains active, revalidating it periodically against each platform's API. When you disconnect the account, revoke the permission or request its deletion, the associated identity data is deleted on the spot and residual copies within a maximum of 7 calendar days. Data obtained from the YouTube API Services and from Google APIs is additionally subject to the specific rules in section 8.7.
• Connected AI assistant (MCP connector): the authorisation and its permissions, until you withdraw it or it expires after 35 days without use; the technical log of operations, 90 days, including the executed instruction (text, network and date) when your assistant schedules, publishes or replies on your behalf (section 9.2).
• How you found us: for as long as the account exists. It is deleted together with the rest of the account data when you close it, subject to the legal retention periods stated above.
• Cookies and information stored on your device: as detailed in section 2.6 and in our Cookie Policy.

6. Who we share it with

To provide the service we work with suppliers acting as data processors. They only access the data strictly necessary and under a processing agreement (art. 28 GDPR). These are:

Where there is a legal obligation, we may also share data with competent public authorities (the Spanish tax agency, courts, law enforcement).

Session replay. To diagnose errors and improve usability we use Mixpanel's session replay feature, which records your interaction with the interface (clicks, navigation and scrolling) in anonymised form. We apply masking of sensitive fields (such as passwords and data entered into forms), so their content is not recorded. This data is processed on the legal basis of our legitimate interest in ensuring the security and correct operation of the service, and is enabled according to your consent to analytics cookies.

We do not sell or transfer your data to third parties for commercial purposes.

7. International transfers

Some of our suppliers are based, or have servers, outside the European Economic Area, mainly in the United States. In all cases we guarantee an adequate level of protection through:

• The supplier's adherence to the EU-U.S. Data Privacy Framework where available.
• Standard Contractual Clauses (SCCs) approved by the European Commission.
• A preference for European regions wherever the supplier allows it.
• Additional technical measures such as encryption and data minimisation.

8. Connecting social networks (third-party data)

8.1 How the connection is established

When you connect your business social network accounts to ōrbita, authentication is performed using the standard OAuth 2.0 protocol. ōrbita never receives or stores your password: the social network identifies you directly and returns an access token to us. That token is stored encrypted in our database and is used only for the actions you authorise (publishing content, reading metrics, refreshing permissions). You can revoke the connection at any time from ōrbita or from the social network itself, which invalidates the token immediately.

8.2 ōrbita's dual legal role

With respect to your own account data (public name, profile picture, identifiers the network returns when authenticating you), ōrbita acts as data controller, on the legal basis of performance of the contract (art. 6.1.b GDPR).

With respect to the personal data of your followers, contacts or people who interact with your posts (public names, comments, aggregate metrics), you are the data controller and ōrbita acts as data processor on your behalf. When you activate the connection and accept our Terms and Conditions, a Data Processing Agreement (DPA) governing this relationship under art. 28 GDPR is automatically entered into.

8.3 Data we receive from each platform

The exact data ōrbita receives depends on the scopes (permissions) you authorise when connecting and on each network's features. The main ones for each supported platform are summarised below.

• Meta (Facebook Pages, Instagram Business/Creator, Threads): identifier and public name of your page or account, profile picture, access token with limited permissions (typically pages_show_list, pages_manage_posts, instagram_basic, instagram_content_publish, threads_basic, threads_content_publish and equivalents), aggregate post metrics and public comment data where applicable. Meta identifies us as a verified application and sends us automatic notifications if you remove the app, in accordance with its Data Deletion Callback procedure.
• LinkedIn (personal profile and company pages): identifier and public name, public profile picture, access token with the ten permissions LinkedIn shows when you connect: r_basicprofile (identity and picture), w_member_social and w_member_social_feed (post and comment as a person), rw_organization_admin (read the pages you administer), r_organization_social and r_organization_social_feed (read the comments on your pages' posts), w_organization_social and w_organization_social_feed (post and comment on your company pages), r_organization_followers (suggest followers of your page when mentioning people; the lookup is live and we do not store the follower list) and r_member_postAnalytics (read the statistics of the posts on your profile made from ōrbita). Your company page statistics are read with rw_organization_admin. We do not request your contact network size, and we do not access your contact network or private messages. The detail of what we do on your behalf, what we read, what we store and for how long is in section 8.9.
• TikTok: identifier, public name and avatar, access token with limited permissions: user.info.basic (account identity), video.publish (post to your account) and, when you grant them on connecting, user.info.stats and video.list (read the statistics of your account and of your public videos for the Metrics section). When you connect TikTok, ōrbita also asks you for a second, separate consent, which you can decline without losing publishing, to read and answer the comments on your videos in the Interactions inbox through the TikTok for Business Accounts API with the permissions user.info.basic, user.info.username and user.info.profile (account identity), video.list (list your videos to read their comments) and comment.list and comment.list.manage (read the comments on your videos, reply to them, like them and hide them). We do not access your private messages, your bio or the list of accounts you follow. The detail of what we do on your behalf, what we read, what we store and for how long is in section 8.10.
• Google (YouTube, Google Business Profile): channel or listing identifier, public name, handle, profile image and access token with the minimum permissions required (youtube.upload and youtube.readonly for YouTube; business.manage for Google Business Profile). If you connect Google Search Console or Google Calendar, ōrbita also asks for webmasters.readonly (Search Console, read only) or calendar.app.created (only the calendars ōrbita creates), each with your basic identity (openid and email). We do not access private messages. On YouTube, ōrbita reads the statistics of your channel and its videos for the Metrics section. On Google Business Profile, ōrbita reads and edits your listing's data and photos, reads its reviews and publishes your replies, and reads its statistics. Full details, including the optional extended YouTube permissions and the update and deletion periods, are in section 8.7.
• X (Twitter), Pinterest: identifier, public name and access token with the minimum permissions required for the features enabled, once these networks are integrated into ōrbita.

8.4 What we use that data for

• Publishing content on your behalf, when you schedule or authorise it.
• Managing the interactions on the posts you have made from ōrbita: reading their comments when you open the interactions inbox, replying to them, adding or removing a reaction, and mentioning companies or page followers in the text. Each of these actions is initiated by a person in your workspace from inside ōrbita; none of them runs automatically.
• Managing your Google Business Profile listing: showing you its data, photos, reviews and statistics, and sending Google the changes and replies a person in your workspace decides on (details in section 8.7).
• Displaying your aggregate metrics inside ōrbita (reach, interactions, audience).
• Automatically renewing access tokens so you do not have to reconnect continuously.
• Detecting technical errors in the integration and logging them internally with minimal retention.

We do not use this data for third-party advertising, we do not sell it and we do not share it with other ōrbita users.

8.5 How long we keep social network data

While the connection is active, we keep the data described above. When you disconnect a network (from ōrbita or from the platform itself) or delete your account, we delete the access tokens and that account's identity data (public name, handle, profile picture and granted permissions) on the spot and, on the platforms that offer an endpoint for it (Google and LinkedIn), we also revoke the grant on the platform itself. All that remains is one technical identifier, the one linking the posts you already published to the account they went out through, plus residual copies in our technical logs: both are deleted within a maximum of 7 days, as described in our Data deletion instructions. The comment cache and the internal management state associated with that connection are deleted within that same maximum period of 7 days.

8.6 Data deletion initiated from the social network (Meta)

If you remove ōrbita from Facebook, Instagram or Threads (Settings → Apps and websites → ōrbita → Remove), Meta automatically sends us a Data Deletion Callback. We process that notification and delete the data associated with that connection, returning a confirmation code you can check from Meta's own platform. This integration meets Meta's requirements for third-party apps and forms part of our data deletion protocol.

8.7 YouTube API Services and Google data

What data we obtain. Through the YouTube API Services, ōrbita accesses only the data needed for the features you enable. Specifically, using the youtube.upload and youtube.readonly scopes, we store:

• Your channel identifier and its public name, the handle and the profile image URL, so we can show you which channel is connected and prevent you from publishing to the wrong channel.
• The authorisation token that lets us upload videos on your behalf, stored encrypted, together with the list of permissions you granted.
• The identifier and URL of the videos you publish from ōrbita, so we can show you the status of your posts and link you to them.
• For the Metrics section, every day, your channel statistics (subscribers, total views and number of videos) and, for the videos on your channel published in the last 12 months (up to 250, including those you did not publish from ōrbita), their public data (title, description, tags, thumbnail, link and publication date) and their statistics (views, likes and comments).

ōrbita does not read messages or private data from other channels or third parties.

Extended permissions (optional). When available for your account and explicitly activated when connecting, ōrbita additionally requests two extra permissions: youtube.force-ssl, to read and manage, from the Interactions inbox, the comments on the videos you publish from ōrbita (their text, date, identifier, and the public name and profile picture of the commenter), letting you reply to and moderate them (hide, unhide, delete and block their author); and yt-analytics.readonly, to read aggregated analytics data for your channel (watch time, subscriber gains and losses, and audience by age, gender, country and traffic source). We do not request the revenue permission (yt-analytics-monetary.readonly) and we do not access your financial data. Comments and audience data are deleted at the latest 30 days after we read them or 7 days after you disconnect the channel, whichever comes first; the rest of the analytics are statistics and are kept like those in Metrics (see below). It is never sold or used for advertising purposes.

What we use it for. Exclusively for the ōrbita features described in this section: publishing the content you schedule, showing you the status of your posts and your channel statistics in Metrics and, when you use them, the features of the extended YouTube permissions and those of your Google Business Profile listing. ōrbita's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use this data for advertising, we do not sell it, we do not transfer it to third parties and we do not use it to train artificial intelligence models.

How long we keep it and how often we refresh it. The YouTube data listed above (your channel identity and the references to the videos you publish from ōrbita) and your Google Business Profile listing data are revalidated against the Google APIs at least every 30 calendar days while the connection is active, so that what you see in ōrbita always matches the current data on the source platform. The data of your videos for Metrics is read again every night; if a video falls outside the last 12 months or is no longer on YouTube, its data is deleted no later than 30 days after it was last read. Your channel's daily statistics are kept as history while the connection is active. If the connection stops being active (because you disconnect it, because you revoke the permission or because it expires), all of that data, including the Metrics data, is deleted within a maximum of 7 calendar days, well inside the 30 calendar day ceiling the YouTube policies require. Authorisation tokens are kept while the connection remains active and are deleted immediately upon disconnection.

How to revoke access and how to delete the data. You can revoke ōrbita's access to your YouTube, Google Business Profile and general Google data at any time:

• From ōrbita itself, under Account → Connections → Disconnect. When you disconnect, we revoke the token with Google and delete the data associated with that connection.
• From your Google account security settings page: https://myaccount.google.com/connections?filters=3,4.
• By requesting deletion in writing at orbita@orbitasolutions.org. We handle these requests within a maximum of 7 calendar days, and usually within 24 to 48 hours.

The full procedure is set out in our Data deletion instructions.

Google Business Profile. With the business.manage permission, ōrbita accesses the business listings you manage with the Google account you connect. It only publishes or changes something on your listing because a person in your workspace decided so in ōrbita, or because you asked your own AI assistant to, with the permissions you gave it (section 9.2). We do not access any other data in your Google account. This is what we do with your listing:

• Posts. We publish on your listing the posts you schedule, with their text, their photo and, when they have one, their event, offer or button. We keep the identifier and the link of each one.
• Your Google listing. When you open this section we read, at that moment, your listing's data (name, categories, phone numbers, website, address, service area, opening hours, status, description, opening date, services, attributes and whether it is verified), its photos, including those your customers upload with their public name, and the average rating and number of reviews, without the reviews themselves. When someone on your team changes something, we send it to Google: that data, the photos you upload or delete and, as services of the listing, the catalogue items you mark to show on it. What we read from your listing is not copied to our servers. We only keep the listing's identifier, public name and profile image, which we revalidate against Google every 25 days, and the names of the services ōrbita has sent, so as not to touch the ones you added yourself on Google.
• Reviews, in the Interactions inbox. When someone on your team opens or refreshes the inbox, or your AI assistant checks it, we read the 50 most recent reviews. We also turn on, in your Google account, the review notifications towards ōrbita: when a review arrives or changes, Google tells us and we read that review at that moment, to show it in the inbox and to alert by email or notification the people on your team who have it turned on. From each review we read the public name and profile photo of the reviewer (without the name if the review is anonymous), the rating, the text, the date and your reply. The only thing we write on Google is the reply you send. The name, photo, text and reply are kept in a cache that expires 30 days after the last read; the rating, the date, the review identifier and its status in ōrbita (read, archived, assigned or replied) are kept while your listing stays connected. If you press "Add to reviews", the text, the reviewer's name and the rating become part of your company's reviews in ōrbita: they are kept until you delete them, and ōrbita uses them to write your content with its AI providers (section 6). If you turn on the automatic import, the same happens with every new review of 4 or more stars that has text.
• Statistics, in Metrics. Every night, and when you press refresh, we read your listing's daily figures (impressions on Google Maps and Search, on desktop and mobile, calls, direction requests, website clicks, conversations and bookings) and the searches that found you each month; the first time, up to 18 months back. They are aggregate figures, with no data about the people behind them. They are kept while the connection is active.

If you disconnect your listing, section 8.5 applies; the reviews you added to your company's reviews stay until you delete them. This processing is likewise governed by the Google Privacy Policy and by the Google API Services User Data Policy.

Google Search Console. If you connect Search Console, with the webmasters.readonly permission ōrbita reads, for the property of your website that you choose, the clicks, impressions, CTR, average position and the queries, pages and countries behind them, for the Web tab of Metrics and for your AI assistant if you ask it to. They are aggregated figures, with no data about the people who search. We store the tokens, encrypted, and the name of the chosen property; each answer from Google is reused for one hour and deleted after 7 days at most. ōrbita changes nothing in Search Console.

Google Calendar and iCal link. If you connect Google Calendar, with the calendar.app.created permission ōrbita creates its own calendar in your account («ōrbita · your company name») and can only see and change that calendar, never the others. In it, it keeps one event per item you choose to send (scheduled, published or dated draft posts, tasks with a due date and key dates), with its title, its date, the networks, the status, up to 300 characters of the post text, who created it or who the task is assigned to, and a link to ōrbita. We store the tokens, encrypted, and the Google identifier of each event. If you delete an event in Google, we do not create it again unless its date changes. The iCal link serves the same to any calendar: anyone with the link can read it, so you can generate a new one at any time and the previous one stops working at once. When you disconnect Google Calendar, ōrbita stops updating its calendar and deletes the tokens; the calendar stays in your account and you can delete it from Google.

Short links and link tracking. If you turn on link tracking, ōrbita adds UTM parameters to the links in your posts and can shorten them with its orbt.es domain. Before shortening a link, we send its destination address to Google Web Risk to check that it does not lead to a dangerous site; if Google flags it, it is not shortened. When someone opens a short link, ōrbita redirects them to the destination and adds one click to that day's count: we do not store the IP address, the browser or any other data about the person who clicks. Short links and their counts are kept while your company exists in ōrbita; when you delete it, its short links stop working, including those already published.

Shared metrics reports. The reports your AI assistant saves are text with the figures of your metrics and are kept in ōrbita until you delete them. If you share one, anyone with its link (orbitasolutions.org/informe/…) can see it, with your company's name and logo; if you stop sharing it, the link stops working at once, and if you share it again a new link is created.

8.8 Canva and Google Drive (importing designs and files)

If you connect your own Canva account, ōrbita integrates with the Canva Connect API via OAuth so you can bring your designs into your posts and create new designs without leaving ōrbita. By connecting you agree to be bound by the Canva Terms of Use, and Canva's processing of the data it provides to us is additionally governed by the Canva Privacy Policy.

ōrbita accesses only the data needed for those features, with minimum permissions (typically profile:read, design:meta:read, design:content:read and design:content:write): your public name, to show you which account is connected; your designs' metadata (title, thumbnail, page count, date), so we can list and search them; the content of the designs you choose, which we export to attach as images to your post; and the creation of a blank design sized for the chosen network when you use "Create with Canva". We store access tokens encrypted; imported designs become files belonging to your own post. ōrbita does not modify your existing designs, does not access designs you do not select, and exported files are processed in our backend without being exposed to the browser.

You can revoke ōrbita's access at any time from the Connections section of the application. On disconnection we revoke the token with Canva and delete it; tokens and identifiers are erased in accordance with section 8.5 and our Data deletion instructions.

Google Drive. If you connect your own Google account, ōrbita integrates with the Google Drive API via OAuth so you can bring images and videos stored in your Drive into your posts. We request only the drive.file scope, together with your basic identity (openid and email) to show you which account is connected. That scope does not grant access to the contents of your Drive: ōrbita can only read the files you pick one by one in Google's file picker, a component built by Google itself that is displayed in your browser and in which browsing and selection happen inside Google, not on our servers. For each file you pick we download its content from our backend and store it as one more file of your post, exactly as if you had uploaded it from your computer; the original file is neither modified nor deleted. We store access tokens encrypted. ōrbita does not list, browse or keep an index of your Drive, does not access files you do not select and does not share files with third parties. ōrbita's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements; Google's processing is additionally governed by the Google Privacy Policy.

You can revoke ōrbita's access to your Google Drive at any time from the Connections section of the application or from your Google account security page (https://myaccount.google.com/connections?filters=3,4). On disconnection we revoke the grant with Google and delete the tokens immediately; account identifiers are erased in accordance with section 8.5 and our Data deletion instructions. Files already imported remain part of your posts and are governed by the general rules of this policy.

8.9 LinkedIn: publishing, interactions and metrics

This section sets out, for the LinkedIn API integration, what ōrbita does on your behalf, what data it reads, what it stores and for how long. The specific permissions requested when you connect are listed in section 8.3.

What we do on your behalf. Every action ōrbita performs on LinkedIn is initiated by a person in your workspace from inside ōrbita; none of them runs automatically. Specifically: publishing to your personal profile and/or to the company page you choose (scheduled posts are reviewed and approved by you before they go out), publishing a first comment of your own under that post, replying to the comments on your posts, adding or removing a reaction to those comments, and mentioning companies or page followers in the text.

What we read and when. From ōrbita's Interactions inbox we read the comments on the posts made from ōrbita, not those on your whole account. Reading happens on demand, when you open the inbox or press refresh, against the LinkedIn API. There is also a per-post panel showing the name and professional headline of each commenter.

What we store and for how long. For the inbox to work we keep a cache with the comment text, its date, the public name of the commenter and, if you reply, the text of your reply, for a maximum of 24 hours; a daily purge deletes it and, if you open the inbox again, the comments are read afresh from LinkedIn. The per-post panel data (name and professional headline) is likewise cached for a maximum of 24 hours. We neither obtain nor store the commenter's profile picture. In no case do we keep third-party profiles for more than 24 hours, nor the text of their comments for more than 48 hours, in line with LinkedIn's Data Storage Requirements; in practice everything expires after 24 hours.

What is kept with no time limit. Only technical identifiers (the LinkedIn URNs of the post, of the comment and of its author) and the internal management state of each comment within ōrbita (read, archived, assigned to a team member, reply date and the date on which ōrbita first saw the comment; the comment's publication date as given by LinkedIn is not kept for more than 48 hours). This is what allows your team's work not to be lost when the cache is reloaded. The identity of your own authenticated account (name, handle and picture) is kept for as long as the connection is active; the identity of your page (name, handle and logo) is additionally revalidated against LinkedIn at least every 45 days.

What we measure. In ōrbita's Metrics section we read, for your company page, the follower count, page views and the impressions, clicks, reactions, comments and reshares of its posts (Community Management API: Follower, Page and Share Statistics); and, for your personal profile, the impressions, reach, reactions, comments and reshares only of the posts made from ōrbita (Member Post Analytics), because LinkedIn does not let any application list a profile's other posts or read its follower count. These are aggregate figures: they contain no data about the people who view, react or comment. They are read once a day and when you press refresh, and we keep a daily snapshot of those totals while the connection is active so we can show you how they evolve, for a maximum of 12 months (a nightly purge deletes data older than one year, in line with LinkedIn's Data Storage Requirements); on disconnection they are deleted within the period set out in section 8.5.

Follower suggestions when mentioning. When you type a mention, your page's followers are looked up live against LinkedIn and we do not store that list.

Who can see it and what it is used for. LinkedIn data is only shown to people with access to that company's workspace in ōrbita. It is never exported, never combined with other sources and never used for sales, lead generation or advertising: it is used exclusively to manage the profile or page you have connected.

On disconnection or account deletion. What section 8.5 describes applies: we delete the access tokens and that account's identity data on the spot, we revoke the grant with LinkedIn, and residual copies are deleted within a maximum of 7 days. The comment cache and the internal management state of that connection are deleted within that same maximum period of 7 days.

8.10 TikTok: publishing, metrics and comments

What we do on your behalf. Publish to your TikTok account the videos or photos you create and schedule in ōrbita (Content Posting API, video.publish permission). Every post goes out only after your explicit action; privacy level, commercial content disclosure and the comment, duet and stitch settings are chosen by you for each post and are never pre-selected.

What we measure. In the Metrics section of ōrbita, with the user.info.stats and video.list permissions (Display API), we read your account's follower count, total likes and number of videos and, for each of your public videos, its identifier, date, title, thumbnail, link and its views, likes, comments and shares. These are aggregate figures of your own account: they contain no data about the people who watch, react or comment. They are read once a day and when you tap refresh; we keep a daily snapshot of the account totals and the latest figure for each video while the connection is active, so we can show you their evolution.

Comments (Interactions inbox). Only if you grant the second consent described in section 8.3 (TikTok for Business Accounts API, permissions comment.list, comment.list.manage and video.list). We read, on demand (when you open the inbox or tap refresh), the comments on your ten most recent videos; for each comment, its text, date, identifier and the public name, handle and public profile picture of its author, and whether you have already replied. From the inbox you can reply, like and hide or unhide a comment; every action is started by a person in your workspace and none runs automatically. We keep those comments in a cache for a maximum of 30 days, deleted by a daily purge; without time limit we keep only technical identifiers (video, comment and author) and the internal management state of each comment in ōrbita (read, archived, assigned, reply date), so your team does not lose its work when the cache is reloaded. We do not read comments on videos that are not yours.

Who can see it and what it is used for. TikTok data is shown only to the people with access to that company's workspace in ōrbita. It is never exported, never combined with other sources and never used for sales, prospecting or advertising: it serves only so you can see how the account you connected is performing.

On disconnecting or deleting your account. Section 8.5 applies: we immediately delete the access tokens and the identity data of that account, and the stored statistics of that connection, the comments cache and its internal management state are deleted within a maximum of 7 days. You can withdraw the comments permission alone, without disconnecting publishing, from the Connections screen.

9. Automated decisions and artificial intelligence

ōrbita uses artificial intelligence models (providers: OpenAI and Anthropic, among others) to generate content, suggestions and marketing plans. This generation always takes place at the user's request or with the user's authorisation: you decide what is drafted, what is published and when.

Individual automated decisions that could produce significant legal effects are subject to human oversight (review and approval by the user before publishing, in the application or, action by action, from the chat of your own AI assistant through the connector, in which case ōrbita records that approval as sent by your assistant; section 9.2). If we ever implemented processing falling within the scope of art. 22 GDPR, we would inform you beforehand and request your explicit consent.

Important: the data you send to these models may be processed by providers outside the EEA (mainly the USA). We apply the safeguards described in section 7 and, wherever possible, configure the services so that your data is not used to train models ("no training" modes or equivalent).

Processing of your company's URL. When you enter your company's web address during onboarding, you authorise ōrbita to access the public content of that URL and process it (including sending it to AI providers under the conditions described above) for the sole purpose of pre-loading your marketing plan, product catalogue, customer FAQs and brand elements into your account. This content is not used for other customers, is not published, and is not kept beyond what is necessary to build those elements. Our access to your website identifies itself with the User-Agent Orbita-Bot/1.0 so you can recognise it in your logs.

9.1 Compliance with Regulation (EU) 2024/1689 (AI Act)

ōrbita acts as a deployer of general-purpose AI systems under Regulation (EU) 2024/1689 (AI Act). We are not a provider of foundation models; we integrate models from recognised providers.

• Risk classification: the uses we make of AI in ōrbita (generating marketing plans and content under human supervision) are classified as limited risk. We do not use AI for high-risk systems (Annex III) or for prohibited practices (art. 5 AI Act): subliminal manipulation, social scoring, emotion recognition in the workplace, and so on.
• Transparency (art. 50 AI Act): within the product interface, all AI-generated or AI-assisted content is clearly identified as such before the user reviews it.
• Marking of generated content: where the model provider supports it, outputs are delivered with technical markers (metadata or watermarks) that allow their artificial origin to be identified, in accordance with art. 50.2 AI Act.
• Human oversight: the user reviews and approves all content before it is published, in the application or, if they have connected their own AI assistant, action by action from that assistant's chat (section 9.2). ōrbita does not publish in a fully automated way without human intervention.
• No deepfakes or biometrics: ōrbita does not generate synthetic audio, video or images realistically depicting real people (deepfakes, art. 50.4 AI Act). The images used are those the user provides or selects from lawful catalogues.
• No training on your data: we contract these services in modes that prevent the user's inputs and outputs from being used to train models, where the provider allows it.

Art. 50 of Regulation (EU) 2024/1689 has applied since 2 August 2026. For content generation, ōrbita uses models from several providers, including Anthropic and OpenAI (see section 6); in the case of Anthropic, the contracted terms prevent the customer's conversations and data from being used to train models. For AI systems already placed on the market before 2 August 2026, the technical marking obligation under art. 50.2 has an adaptation period until 2 December 2026.

The user is informed at all times which parts of the product use AI and retains the right not to use them. The user's own obligations regarding transparency towards their audience (when publishing AI-assisted content) are set out in the Terms and Conditions.

9.2 Connecting your own AI assistant (MCP connector)

If you connect your own AI assistant to ōrbita (MCP connector), that assistant accesses, with your identity and the permissions you choose, the data of your companies that you ask it to read or change. The provider of your assistant (for example, Anthropic or OpenAI) processes that data as a controller or as your processor, depending on your contract with it; it does not act on behalf of ōrbita and is not one of the AI providers described at the start of this section.

ōrbita keeps which assistant you have authorised and with which permissions, and a technical log of operations (operation, company and date) for 90 days. When your assistant schedules or publishes a post or replies to a comment, a mention or a review because you asked for it and confirmed it in its chat, that log also keeps the executed instruction: the text sent, the network and the date you confirmed, and the fact that your assistant declared your confirmation. ōrbita receives that confirmation as sent by your assistant and neither receives nor stores your conversation with it. ōrbita neither receives nor stores the password or keys of your account with that provider. You can withdraw access at any time from Connections > Connected AIs; an authorisation left unused for 35 days expires on its own. The steps and limits of the connector are explained in the help guide.

10. Your rights

As a data subject you may exercise the following rights at any time:

• Access: to know what data of yours we process.
• Rectification: to correct inaccurate or incomplete data.
• Erasure ("right to be forgotten"): to delete your data when it is no longer necessary.
• Objection: to object to certain processing based on legitimate interest or marketing.
• Restriction: to restrict processing while a claim is verified.
• Portability: to receive your data in a structured, machine-readable format.
• Withdrawal of consent: at any time, without affecting the lawfulness of prior processing.
• Not to be subject to automated individual decisions with significant legal effects.

To exercise any of these rights, write to us at orbita@orbitasolutions.org stating the right you wish to exercise. We will only request proof of identity if there are reasonable doubts about who is making the request, in accordance with art. 12.6 GDPR.

If you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (AEPD): C/ Jorge Juan, 6, 28001 Madrid · www.aepd.es.

11. Security measures

We apply technical and organisational measures appropriate to the risk: encryption in transit (HTTPS/TLS) and at rest, role-based access control, backups, activity logging, two-factor authentication for staff with access to data, and periodic security reviews. All our suppliers meet equivalent standards (ISO 27001, SOC 2 or similar).

12. Minors

ōrbita is not directed at children under 16. We do not knowingly collect data from children under that age. If we detect that data from a minor has been collected without parental consent, we delete it as soon as possible. If you believe a minor has provided us with data, write to us at orbita@orbitasolutions.org.

13. Changes to this policy

We may update this policy to reflect legal, technical or product changes. Where changes are substantial, we will notify you by email or through a prominent notice on the website at least 15 days in advance. The date of the last update appears at the top of this document.