Legal
Privacy Policy
This policy explains what personal data we process when you visit our website or use Orbox, why we do it and what rights you have. It is provided under Articles 13 and 14 of the General Data Protection Regulation (GDPR).
1.Controller
The controller of your personal data is Orbox Labs s.r.o., company ID 29910340, registered office Pernerova 676/51, Karlín, 186 00 Prague 8, Czech Republic. For anything related to personal data, write to support@orbox.dev.
Where you put personal data of other people into Orbox (for example colleagues or customers mentioned in a process), your company is the controller of that data and we act as its processor under the Data Processing Agreement.
2.What we process and why
| Purpose | Data | Legal basis | How long |
|---|---|---|---|
| Creating and running your account | Name, email, company, profile data from Google or Microsoft if you sign in with them, workspace role | Performance of the contract (Art. 6(1)(b)) | While the account exists, then 30 days |
| Providing the service, including AI | Process descriptions, attachments, chat messages and outputs; if you turn on monitoring, the records Orbox reads from the tools you connect to check that a step took place | Performance of the contract (Art. 6(1)(b)) | While the account exists, then 30 days for export; afterwards deleted, and removed from backups as they rotate |
| Managing your plan and credits, accounting | Plan, credits, payment status and amounts we receive from Stripe (not card numbers) | Performance of the contract and legal obligation (Art. 6(1)(b) and (c)), accounting law | While the account exists; accounting and tax records for the periods required by law, at most 10 years |
| Attributing customers to Partners (Partner links) | Partner code from the link you clicked (cookie), date of the click, workspace created, plan paid for | Legitimate interest in running the Partner Program and paying commission (Art. 6(1)(f)) | Cookie 90 days from the last click; attribution while the workspace pays |
| Running the Partner Program | Partner applications, contact persons, payout and billing details, commission statements and settlement documents | Performance of the contract and legal obligation (Art. 6(1)(b) and (c)) | While the Partner takes part; settlement documents for the periods required by law, at most 10 years |
| Answering enquiries (Partner introductions, security documents) | Name, email, company, company size, message | Steps before a contract, legitimate interest (Art. 6(1)(b) and (f)) | 2 years from the last contact |
| Security and abuse prevention | IP address, browser data, access logs | Legitimate interest (Art. 6(1)(f)) | As long as needed to run and secure the service, longer while we investigate an incident |
| Website statistics | Aggregated, anonymised visits; no cookies | Legitimate interest (Art. 6(1)(f)) | Aggregated data only |
| Measuring our ads (Google Ads) | Cookie identifiers, ad click ID, pages visited, sign-ups that came from an ad | Consent (Art. 6(1)(a)); without it Google receives only cookieless signals | Until you withdraw consent, cookies at most 90 days |
| Improving and developing the service, including its AI features | How you use the service, process descriptions, chat messages and outputs | Legitimate interest (Art. 6(1)(f)) | While the account exists, then 30 days |
| Service emails | Email address | Performance of the contract (Art. 6(1)(b)) | While the account exists |
Where we rely on legitimate interest, our interest is to run a secure service, respond to people who contact us and understand how the website is used. You can object to such processing at any time.
Providing data needed for the account is a condition of the contract; without it we cannot create the account. Everything else is voluntary.
3.Artificial intelligence
To write up your processes, the content of your conversation is sent through OpenRouter to AI models running on servers in the European Union. Prompts and responses do not leave the EU, and the providers process them only to generate the answer for you and do not retain them afterwards.
We do not make any decisions about you based solely on automated processing that would have legal or similarly significant effects (Art. 22 GDPR).
4.Who receives your data
We share personal data only with providers who help us run Orbox (hosting, database, AI models, email, payments) and who are bound by a processing agreement. The current list, including where each one processes data, is on the Subprocessors page.
If you send a request for a Partner, we share your contact details and the description of your request with at most 3 Partners we choose from those who opted in to receive requests, after they confirm they have capacity. Each Partner then acts as an independent controller and gets access to your workspace only if you invite them. If you sign up through a Partner’s link, we tell that Partner your company name and which plan you pay for, so we can pay their commission; we never share the content of your processes.
Paid plans and extra credits are sold through Link, a service of Stripe, which is the seller and merchant of record. When you pay, you give your payment and billing details directly to Stripe, which processes them as an independent controller under its own privacy policy (stripe.com/privacy) and tells us the payment status, plan and amount. You can ask Link to delete this data; Link then also cancels any subscriptions sold to you through it.
If you sign in with Google or Microsoft, that provider shares your basic profile with us under its own privacy policy. We may also disclose data to public authorities where the law requires it.
5.Transfers outside the EU
We store and process your data in the European Union. Where a provider is based outside the European Economic Area or may access data from there, the transfer is protected by an adequacy decision (such as the EU–US Data Privacy Framework) or by the European Commission’s Standard Contractual Clauses.
6.Your rights
Under the GDPR you have the right to:
- access your personal data and get a copy of it;
- have inaccurate data corrected;
- have your data erased;
- restrict processing;
- data portability, meaning to receive your data in a machine-readable format;
- object to processing based on legitimate interest;
- withdraw consent at any time, where processing is based on consent.
To exercise your rights, write to support@orbox.dev. We respond within one month. You also have the right to lodge a complaint with the supervisory authority, which in the Czech Republic is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, www.uoou.gov.cz), or with the authority in the EU country where you live or work.
7.Security
We protect data with encryption in transit and at rest, access control based on the principle of least privilege, and regular backups. More detail is on the Security page.
9.Children
Orbox is a service for businesses and is not intended for people under 18. We do not knowingly collect data about children.
10.Changes
We will update this policy when the way we process data changes, and we will tell you about significant changes by email or in the application. This version is effective from 18 August 2026.