Your privacy, in plain language.

Account authentication identifiers, one creator workspace, one Instagram connection, and the inbound DMs and comments delivered after that connection.

The inbound record can include sender handles, message or comment content, timestamps, connection references, and provider event identifiers needed to keep records separated and deduplicated.

Orbit8 does not ask for a Google or Instagram password. Those credentials remain with their authentication providers.

Orbit8 does not send Instagram replies or publish content from a source import or private reply preview.

If a workspace administrator enables and starts a website import, Orbit8 sends only the supplied public website URL and bounded public page content to Firecrawl. Imports stay on the same domain and exclude authenticated pages, downloads, legal pages, shopping flows, and private network addresses.

Normalized page text is held only for analysis and purged within 24 hours. Orbit8 retains the source URL, page title, content hash, and the short evidence excerpts attached to suggestions. Instagram DMs, cookies, passwords, and published Setup Revisions are never sent to Firecrawl.

Evidence extraction and private reply previews run through a third-party AI model provider. A private preview receives the active published Setup Revision and the creator-entered test message, then returns a review-only result. It cannot create or deliver a reply.

The specific model provider and its processing region will be named in the approved notice before launch.

Orbit8 keeps operational metadata such as model and prompt versions, hashes, token use, latency, and failure codes. Raw prompts and model responses are not stored in AI run telemetry or sent to Sentry.

The final product surface is planned to make export, message retention, connection removal, and account deletion visible from Settings.

This page must be updated with approved retention periods, provider disclosures, legal bases, contact details, and request procedures before launch.