Skip to content

Privacy Policy

Last updated: October 11, 2026

This policy describes how Orby collects, uses, shares and protects personal data in the context of its collaboration platform (chat, feed, projects, CRM, documents, calendar, statistics, people and HR and mobile app). It applies to all users and organizations accessing the service through orbyintranet.com, platform.orbyintranet.com, admin.orbyintranet.com and associated mobile apps.

1. Who is the data controller

For Content uploaded by users in an Organization's workspace, the Organization is the data controller and Orby acts as a processor. For account data and Platform usage data, Orby is the data controller.

2. Data we collect

  • Account data: name, email, mobile (optional), profile picture, role/title, department, country, organization you belong to.
  • Credentials: password (stored with hash + salt), session tokens, devices registered for 2FA.
  • User content: chat messages (text, audio, video, attachments, polls), feed posts and comments, files and folders, tasks and projects, CRM records (leads, deals, contacts, interactions), calendar events, recognitions and birthdays.
  • People and HR data (entered by the Organization): employee file (contract, schedule, emergency contact, history), leave and absences, HR requests, employee documents, training and certificates, reviews and check-ins, offboarding. Depending on the plan, also attendance records (clock-in and clock-out date and time, record source and corrections made by HR, with no GPS location or IP address attached) and payslips (file uploaded by HR, period, date the employee opened it).
  • AI assistant (when the Organization enables it): requests you type or paste, generated answers, conversation history and a usage record (task, credits and date, without the content).
  • Technical data: IP address, browser type, operating system, mobile device identifiers, push notification tokens.
  • Usage data: actions relevant for auditing (logins, permission changes, access to sensitive documents), aggregated metrics for internal statistics and Customer dashboards.
  • Billing data: tax name, tax ID, address, contracted plan, payment history. We do not store full card data — these are processed by our payment partners.

3. How we use the data

  • Provide the contracted service and its features (real-time messaging, notifications, sync across devices).
  • Ensure Platform security, prevent fraud and investigate incidents (audit logs).
  • Bill and manage payments.
  • Communicate with you about your account, service changes, new features and support.
  • Improve the product through aggregated and anonymized metrics.
  • Comply with legal obligations and respond to authorities when legally required.

4. Legal bases

We process data based on: contract performance (to provide the service), legal obligations (billing, accounting retention), legitimate interest (security, fraud prevention, product improvement) and consent (marketing notifications, when applicable — always revocable).

5. Sharing with third parties

We do not sell personal data. We share only with vendors essential to the operation, under confidentiality and data protection agreements:

  • Cloud providers for hosting the application, database and file storage.
  • Transactional email providers (notifications, invitations, password recovery).
  • Push notification providers for mobile apps (Android/iOS).
  • Payment platforms (only for billing of paid plans).
  • Monitoring and logging tools (for technical diagnostics).
  • Google Analytics 4 (Google Ireland Ltd.), only on the public website orbyintranet.com, for aggregated visit statistics (see section 11).
  • Artificial intelligence providers — Anthropic (Claude models) and Voyage AI (semantic search) — only for Organizations that enable the AI assistant (see section 6).

When required by law, we may share data with competent authorities. We do not allow these vendors to use your data for their own purposes.

6. AI assistant

The AI assistant is optional: it only works when it is included in the plan and the Organization has enabled it. The administrator can turn off individual tasks, set a credit limit per person and choose how long the history is kept.

What is sent to Anthropic (Claude API). Only when someone uses the assistant, or when an automation that person set up runs: the request and the context the task needs, limited to what that person can already see in Orby. Depending on the task, this includes:

  • the text you type or paste and, in a conversation, up to three previous exchanges of that conversation;
  • excerpts of documents you have access to (questions about documents);
  • unread messages and posts (summary of what you have not read);
  • your tasks, calendar events and notifications (“My day”, meeting preparation);
  • lead and deal data and interactions (sales follow-up);
  • survey answers, without the names of respondents and only above a minimum number of responses (survey synthesis, reserved for managers).

What is sent to Voyage AI. In Organizations that use questions about documents, the text of Drive documents (in excerpts) and the text of the questions, to generate numerical representations (“embeddings”) used for search by meaning. The results are stored in our database. Documents of Organizations without this feature are not sent.

What stays on our servers. Text extraction from documents and text recognition in scans (OCR) run on our servers, without third parties. Search always respects Drive permissions: the assistant never uses documents the person cannot access.

No model training. We contract these providers under terms that exclude the use of the data we send to train their models. They may keep requests for a limited period, for security and abuse prevention, under their respective agreements. The assistant's answers are drafts for the person to review; they are not used to make automated decisions with legal effects on anyone.

Retention. Conversation history is kept for the period set by the Organization (between 1 and 730 days; 90 by default) and deleted automatically afterwards. The text of each answer is also kept for 30 days so that a repeated request (for example, after a network failure) is not charged twice. The usage record does not contain the content of requests and is kept for billing and for the usage report that the Organization's administrators can consult.

7. International transfers

Some vendors may be located outside Angola (e.g. cloud regions in Europe or the US; the AI providers listed in section 6 are based in the US). Whenever international transfers occur, we ensure appropriate safeguards (standard contractual clauses, security certifications).

8. Retention

  • Organization content: kept while the account is active. After termination, the Organization has 30 days to export; after that, data may be deleted.
  • People and HR data: kept while the account is active, for the period the Organization (the controller) sets to meet its employment, tax and social security obligations. Payslips and attendance records are visible only to the employee and to whoever manages people in the Organization; a direct manager sees their team's attendance read-only. When an employee leaves, the data stays with the Organization until it deletes it or the account ends.
  • Audit and security logs: up to 12 months, except for legal needs.
  • Billing data: per applicable legal periods (typically 5 to 10 years).
  • AI assistant: as described in section 6.
  • Backups: typical rotation up to 30 days.

9. Security

  • Encryption in transit (HTTPS/TLS) across the Platform.
  • Passwords stored with strong hash and salt (non-reversible).
  • Two-factor authentication (2FA) available for all users.
  • Per-organization isolation (multi-tenant): no Organization sees another's data.
  • Access control by role and by department, with granular permissions.
  • Audit log of sensitive events.
  • Automated backups and recovery plan.
  • Continuous monitoring and regular security updates.

10. Your rights

You have the right to:

  • Access your personal data.
  • Rectify inaccurate data.
  • Request portability (export) of your data.
  • Request erasure (“right to be forgotten”), except for legally required retention.
  • Object to processing based on legitimate interest.
  • Withdraw previously given consents.

To exercise these rights, contact us through the means indicated in section 13. When data is managed by an Organization, we may ask you to exercise your rights directly with your company's administrator.

11. Cookies and local storage

On the platform (platform.orbyintranet.com, back office and apps) we only use cookies and local storage that are strictly necessary for authentication, session maintenance and interface preferences (e.g. light/dark theme stored in orby-theme).

On the public website orbyintranet.com we also use Google Analytics 4 to understand, in aggregate, how many people visit us, where they come from (for example search or social media), which pages and sections they see and which buttons they use (such as "Get started", the presentation video or contact). This is how it works:

  • Analytics cookies (_ga, _ga_*) are only stored if you accept them in the cookie notice. Your choice is kept in orby-consent and you can change it at any time under "Cookie preferences" in the footer.
  • Without consent, Google Analytics only receives anonymous signals, with no cookies or identifiers, used to estimate the number of visits.
  • Advertising signals and Google Signals are turned off: the data is not used for ads or linked to Google accounts.
  • Google Analytics 4 does not store IP addresses. Data is kept for at most 14 months.

We do not use advertising cookies. The legal basis for these statistics is your consent (cookies) and our legitimate interest in measuring the website's reach in an aggregated, anonymous way.

12. Minors

Orby is not directed to people under the age of 18 and does not knowingly collect data from minors. If you are aware that a minor created an account without authorization, contact us for immediate removal.

13. Contact and complaints

For privacy questions or to exercise your rights, write to contacto@orbyintranet.com. You also have the right to file a complaint with the competent data protection authority.

14. Changes to this policy

We may update this policy to reflect changes in the service or in legislation. Material changes will be communicated by email and/or notice on the Platform. The version in effect is always the one published on this page.

Informational document. For specific data processing agreements (DPA) with your Organization, contact us.