Privacy Policy

Who we are

AltOrbit is an independent project, currently pre-incorporation. A legal entity (planned in the EU) will be established before public launch. When this policy says "we", it means AltOrbit. When it says "you", it means anyone whose data we handle — usually a user of an AltOrbit workspace, or a visitor to altorbit.app.

Two roles, depending on the data. For what's inside a workspace — time, pay, leave, chat, files — your organisation is the controller and we process it on its behalf under our DPA; questions about that data are best sent to your employer first. For your account, billing, this website, the early-access list and support, we are the controller.

What we collect

The things you give us, the things your workspace generates, and the things we measure to keep the service working.

Why we use it

Each purpose and the legal basis we rely on under GDPR:

• To run the product — sign-in, sync, notifications, billing. Basis: our contract with you or your organisation (Art. 6(1)(b)).
• To keep it secure — block brute-force attempts, detect compromised accounts, audit admin actions. Basis: our legitimate interest in keeping the service and its users safe (Art. 6(1)(f)).
• To improve the website and the apps — pseudonymous analytics via PostHog: which pages and screens are used and where onboarding stalls. On the website and in the web app this can also include clicks and scroll positions (heatmaps), page-speed measurements, short surveys, and recordings of how you move through the pages (session replay); what you type into form fields is masked in your browser and never recorded, and in the web app all text and images are masked as well, so a recording shows layout and clicks, never your content. Only if you accept analytics — in the cookie banner on the website, or when the web or mobile app asks (consent, Art. 6(1)(a)). If you accept on both the website and the web app, your earlier website visits are linked to your account. Plus anonymous page-speed numbers via Vercel Speed Insights, which uses no cookies (legitimate interest, Art. 6(1)(f)).
• To understand how the product is used — our servers record key actions in your account, such as signing up, creating a project, closing a ticket or changing a plan, and send them to PostHog (EU) with your account id and workspace id — never your name, email or anything you write, and without your IP address. This uses no cookies and does not depend on the analytics choice above. Basis: our legitimate interest in learning which parts of the product work (Art. 6(1)(f)). You can object at any time — write to privacy@altorbit.app and we stop.
• To talk to you — receipts, security alerts and account emails (contract); the early-access launch email and any product news only if you asked for them (consent).
• To answer you — support requests by email, form or chat. Basis: our contract with you, or our legitimate interest in helping visitors (Art. 6(1)(b)/(f)).
• To meet legal duties — billing and tax records. Basis: legal obligation (Art. 6(1)(c)).

Data from connected services

Integrations are off until someone turns them on. When you connect a calendar or a backup destination, AltOrbit reads or writes only what that feature needs:

• Calendars (Google Calendar, Microsoft Outlook, CalDAV) — we read the list of your calendars (name, colour and which one is primary) so you can pick the ones to connect. From the calendars you pick we read each event's title, start and end time with its time zone, recurrence, your RSVP, attendee count, whether it is private or shown as free, its link in your calendar and its video-call link. To find the video-call link we also scan the event's location and description; we don't store them. You mark each meeting as work or personal; work meetings can become time records in a project. We create a separate “AltOrbit” calendar and write your time blocks, approved leave and company holidays only into it. We never change or delete your own events. When you open a meeting's guest list, we fetch it from your calendar at that moment to show it to you, matching guests to your workspace's members; we don't store the list.
• Backup (Google Drive, OneDrive, Dropbox) — an Owner can send a copy of the workspace to their own storage. With Google Drive we only touch the files and folders AltOrbit creates; we can't see anything else in your Drive.
• Disconnecting stops all reads and writes, deletes the stored tokens and every meeting imported from that account, removes the “AltOrbit” calendar we created, and revokes our access at the provider. Deleting your account or the workspace does the same. Time records you already made from work meetings stay, as your own records. You can also revoke our access at any time in your Google Account under Third-party apps & services.
• Data from these services is used only to provide the features you connected, as you see them in AltOrbit. We don't sell it, use it for advertising, or pass it to anyone except the sub-processors that run those features, and people at AltOrbit don't read it unless you ask us to for support, or it's needed for security or the law.
• AI and machine learning — we do not use data obtained through Google Workspace APIs, or from any other connected service, to develop, improve or train generalised or non-personalised AI or machine-learning models, and we don't let anyone else do so. The only AI feature that can see such data is the stand-up draft, and only when you ask for one: it sends your own time records from the last two days to our AI model provider, Anthropic, and those can include the titles of meetings you tracked as work. The provider processes them only to write your draft, under terms that exclude training on them. If you connect an AI app yourself, it can read such a time record like any other content you can see — see AI apps you connect.

AltOrbit's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

AI apps you connect

You can connect an AI app of your choice — Claude, ChatGPT, Cursor or another client that supports the Model Context Protocol — to your AltOrbit account so it can work with your workspace for you (how it works). Nothing is connected until you approve it.

• What the app receives — only what you could see in AltOrbit yourself, in the one workspace you connected it to and within the permissions you approved, and only when the app calls one of our tools for you. That can include tickets and comments, project details, the names of people you work with, your time records with their notes (a time record made from a calendar meeting carries its title), files attached to tickets (a file the app opens comes as a link that expires after 15 minutes), your notifications and project reports. We send nothing to it on our own.
• You choose the provider — the app and the AI model behind it are yours to choose. What it receives is then handled by that provider under its own terms and privacy policy, not ours, and it is not one of our sub-processors. Check whether your provider may use your conversations to train its models, and set that the way you want. A connected app is not one of AltOrbit's own AI features: our commitments on AI above cover the provider we use, not the one you pick.
• What we store — for each connection: the name and website the app gives for itself, the address its sign-in returns to, the workspace and permissions you approved, and when it was created, last used, and lapses or was revoked. Tokens are stored only as keyed hashes; for a personal access token we also keep its last four characters so you can recognise it. What an app does is recorded in the audit log, as your own actions are, marked as coming from that connection, and ticket versions note changes made through MCP.
• How long, and how to stop it — a connection works until you disconnect it in Settings › AI agents, which takes effect at once, until an owner or company admin of the workspace revokes it, or until it lapses: an app after 30 days without use (365 days at most), a personal access token after 90 days without use (365 days at most). Resetting your password or signing out of all other sessions disconnects them too. While your organisation has AI connections turned off, your connections are paused rather than ended. The record of a connection stays with your account and is deleted with it; audit records are kept as described under How long we keep it.
• Your organisation's controls — whether AI apps may work with workspace data is your organisation's decision, as the controller of that data. Its owners and company admins can turn AI connections off for the whole workspace (they are on by default): connected apps and tokens are then paused and refused, and no new ones can be connected, until they are turned back on. They can see every app and token connected to the workspace and revoke any of them, in which case its holder is notified, and they are notified when a member connects an AI app or creates a token.
• Legal basis — our contract with you or your organisation (Art. 6(1)(b)): the app works with your data because you asked it to. Your workspace's audit log shows what connected apps changed.

How we protect your data

These safeguards cover everything we hold, including what you bring in from connected services such as Google:

• Encryption in transit — every connection to AltOrbit's website, apps and API uses HTTPS (TLS), with HSTS so browsers never fall back to plain HTTP. We talk to Google, Microsoft and other providers over HTTPS only.
• Encryption at rest — OAuth access and refresh tokens are encrypted with AES-256-GCM, each with its own random nonce and bound to its own connection. The key is kept apart from the database, in the server's configuration, and can be rotated. Tokens are decrypted only on our servers, at the moment a feature needs them, and never reach your browser or device.
• Isolated storage — the database runs on a dedicated server in Frankfurt and accepts no connections from the internet. Each workspace's rows are separated by row-level security in the database itself, so no workspace can read another's data.
• Who can see it — meetings imported from your calendar are visible only to you, not to your workspace's owners or admins. Only a meeting you mark as work becomes a time record, with the meeting's title as its note, and that record is visible to the people who can already see your time. Guest lists are fetched when you open them and never stored.
• Least privilege — we ask Google for read-only access to your calendars, write only into the separate “AltOrbit” calendar we create, and in Google Drive see only the files AltOrbit creates. Imported meetings cover 30 days back and 180 days ahead, the range the feature shows.
• Staff access — access to production systems is limited to authorised personnel who need it, and is used only to run the service, to help you when you ask, or when security or the law requires it. There is no internal tool for browsing users' data.
• Logs and error reports — tokens, passwords and other secrets are redacted before anything is logged or sent to error tracking.
• Backups — database backups are kept in the EU with restricted access and deleted within 90 days.
• Connected AI apps — approving one needs you to confirm it is you; its tokens are stored only as keyed hashes, an access token lasts one hour, and every call re-checks your access, so disconnecting it, an owner or admin turning AI connections off, or losing access in AltOrbit stops it at once.
• If something goes wrong — if a breach puts your data at risk, we notify the supervisory authority within 72 hours and you without undue delay, as GDPR requires.

Who we share it with

A short, public list of sub-processors. We use them because building our own would be worse for your data, not better.

• OVHcloud — application servers, database and backups (Frankfurt, Germany).
• Cloudflare — DNS, CDN, DDoS protection, bot checks on our forms (Turnstile) and file storage (Western Europe).
• Vercel — hosting of the website and the web app, and anonymous page-speed measurement (Speed Insights).
• Stripe — payment processing. Card data never touches our servers.
• Resend — transactional email (receipts, password reset, invites).
• Sentry — error tracking. Configured with PII scrubbing.
• Anthropic — the AI model behind AI features and the support chat assistant (USA).
• Expo — push notifications to the Android app, delivered through Google Firebase Cloud Messaging, and app updates (USA).
• PostHog — product analytics for the website and the apps, including heatmaps and session recordings on the website (form fields masked) and in the web app (all text, inputs and images masked), and usage statistics from our servers (EU; IP addresses are discarded).
• GIPHY — GIF search in chat (USA). Searches go through our servers without anything that identifies you; the Android app loads the GIF images from GIPHY directly.

The full list with current addresses and DPAs is at altorbit.app/subprocessors and is updated whenever it changes — we email Owners 30 days before adding any new processor.

Where your data lives

Your workspace data, files and backups are stored in the EU — the database in Frankfurt, files in Western Europe. Some processing happens outside the EU: the web app's servers run on Vercel in the USA and see requests in transit, Cloudflare's network is global, AI features call a US-based model provider, push notifications to the Android app go through Expo (US), and payments run through Stripe. These transfers are covered by the EU Standard Contractual Clauses or the EU-US Data Privacy Framework. A US region is on our roadmap, with no committed date yet.

Your rights

If you live under GDPR (EU/UK), CCPA (California), or a similar regime, you have the right to:

• Access — get a copy of your data. Self-serve in settings, or email us; very large histories are split into several files.
• Correct — fix anything wrong. Most of it is editable from your profile.
• Delete — delete your account: your personal data is erased right away and leaves backups within 90 days. Content you created in a workspace stays with that workspace.
• Port — download your personal data as JSON or CSV.
• Object — opt out of any non-essential use: marketing emails, analytics, and the usage statistics our servers record (write to us, see below).
• Restrict — ask us to pause using your data while a request or a dispute is being checked.
• Withdraw consent — for analytics or launch emails, at any time: use Cookie settings in the footer of the website, the analytics switch in the app's settings, or unsubscribe from the email. Processing before you withdraw stays lawful.

We don't make decisions about you based solely on automated processing. Workspaces can turn on overtime alerts that notify leads when someone logs approved overtime on most recent days; the alert informs a person, it decides nothing.

Reach us at privacy@altorbit.app. We reply within 2 business days and complete requests within one month, as GDPR requires.

How long we keep it

• Active workspaces — for as long as the workspace exists. Owners can choose to delete older chat and time records automatically after 12, 24 or 36 months.
• Inactive Free workspaces — a Free workspace nobody uses for 12 months may be deleted. Every Owner gets a warning email 30 days before, and any activity cancels the deletion.
• Deleted workspaces — access stops immediately and an Owner can restore the workspace for 30 days; then it's purged from primary storage and leaves backups within 90 days.
• Imported calendar meetings — deleted 31 days after they end, or straight away when you disconnect the calendar.
• Connected AI apps and tokens — until you or your workspace's owners or admins disconnect them, or they lapse (30 days unused for an app, 90 for a token, a year at most); the record of a connection is deleted with your account.
• Audit logs — 30 days on Free, 365 days on Pro, then deleted.
• Billing records — 7 years, because tax law says so.
• Early-access list — until we send the launch email. Ask us and we'll remove you sooner.
• Support requests and chats — as long as we need them to answer you and handle follow-ups.

Cookies

We use the smallest set of cookies that lets the product work — a session cookie, a CSRF token, short-lived sign-in cookies (two-factor, Google), and language and theme preferences. The support chat keeps a conversation id in your browser's local storage once a chat starts. On the website and in the web app we additionally use PostHog analytics (on the website this can include heatmaps and session recordings with form fields masked), which loads only after you opt in; you can change your choice any time via Cookie settings in the footer or in the app's settings. Vercel Speed Insights measures page-load speed without cookies. We don't use advertising or retargeting cookies.

Children

AltOrbit is not for children under 16. If you believe a child has signed up, email us and we'll delete the account immediately.

Changes to this policy

We change this document when our practices change, not for fun. Material changes get a 30-day notice email to all Owners. Cosmetic changes (typos, clearer wording) are made without a separate notice.

Contact

Privacy contact: Andrii Zhelezko, founder · privacy@altorbit.app. A Data Protection Officer will be appointed once AltOrbit is incorporated.
Registered address: published once AltOrbit is incorporated (planned in the EU)
UK representative: to be appointed at incorporation

You can complain to a data protection authority at any time — in the EU, usually the one where you live or work. We'd appreciate the chance to fix things first at the address above.