Privacy notice

Who we are

Orbelos is run by SIG Optimal Ltd, a company registered in the United Kingdom with company number 17276011. Our registered office is 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

We are the controller of the personal data described here. For anything about your data, write to hello@orbelos.com.

This notice covers two groups of people: the people who use Orbelos, and the people whose public social media posts Orbelos reads.

People who use Orbelos

When your organisation subscribes, or you are invited to use Orbelos, we hold:

• your name, work email address and role in your organisation’s Orbelos client;
• a hash of your password (never the password itself) and the sessions you are signed in with;
• when you were last active, and a record of the changes you make, such as inviting a colleague or deleting a list;
• what you create in Orbelos: lists, reports, schedules, questions you ask and the logo you upload;
• for the person who signs up: the organisation’s name and the date the terms were accepted.

Payment is taken by Stripe. We never see or store card details; we keep only the references Stripe gives us to your customer record and subscription, and whether payments are up to date.

We use this data to provide the service you or your organisation signed up for (the contract), to keep the service secure and to keep accounts and billing records (our legitimate interests and our legal obligations).

Sign-in uses two cookies, both strictly necessary: one keeps you signed in for 15 minutes at a time and the other renews it, for up to 7 days without use and 30 days at most. The app also remembers your last chosen client and list in your browser. Orbelos uses no analytics, advertising or tracking cookies and loads no third-party scripts or fonts.

People whose public posts are read

Orbelos tracks people who post publicly about professional subjects on X and LinkedIn, because a client of ours has added them to a list. For each such person we collect what they have made public:

• profile details: name, handle, profile address, follower count, bio, location, job title and employer;
• public posts, with their text, links, hashtags, mentions and engagement figures (likes, reposts, replies, quotes and views), and the post a reply or quote refers to.

From these we derive topics, the organisations and products mentioned, who interacts with whom, a short summary of a person’s public activity, and a judgement of the stance taken on a subject across a group of posts. Model judgements are marked Indicative; they are never a verdict on a single post.

We do this in our legitimate interests and those of our clients: understanding who shapes professional conversations, using only what people have chosen to publish. We do not collect private messages, contact details, or anything behind a login, and we do not use this data for advertising.

We keep a post, and everything we derive from it, for at most 2 years after it was published, then delete it: year-on-year is the longest comparison Orbelos makes. Profile details are kept while a client of ours tracks the person. You can ask us to erase what we hold about you at any time, by writing to hello@orbelos.com with a link to your profile. Once erased, your accounts are blocked from being collected again, and reports that named you say that a person was removed.

Because this data does not come from you, we publish this notice instead of writing to each person, as UK data protection law allows where contacting everyone would take disproportionate effort.

Where data is held and who processes it

Orbelos runs on Amazon Web Services in London (eu-west-2). Our database, files and backups are held there. Other providers process data on our behalf:

• Amazon Web Services: hosting, storage and sending email;
• Stripe: taking payments and managing subscriptions;
• OpenAI: the language and embedding models that read posts and write summaries. Posts are sent to OpenAI’s API, which does not use them to train its models;
• Data collection providers: collecting public posts and profiles from X and LinkedIn.

Some of these providers may process data outside the United Kingdom. Where they do, we rely on the safeguards UK law requires, such as adequacy regulations or the UK International Data Transfer Agreement or Addendum.

How long we keep data

• Accounts of people who use Orbelos: for as long as they are members of a client, and then as long as we need to keep billing and security records.
• Exported reports: 30 days, after which the file is deleted.
• Sign-in links and invitations: 24 hours for a password link or a demo invitation, 7 days for an invitation from a colleague.
• Emails we send: their content is kept for 6 months.
• Server logs: 14 days. Database backups: 7 days.
• Public posts of tracked people, and what we derive from them: at most 2 years from when the post was published.
• Profile details of tracked people: while a client tracks the person.

Your rights

Under UK data protection law you can ask us for a copy of your data, to correct it, to erase it, to restrict how we use it, to object to our using it, and to receive data you gave us in a reusable form.

Write to hello@orbelos.com. We answer within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.