Orbit ("Orbit," "we," "us," or "our") is a customer-relationship and content management application operated by Obsiluna LLC, with a mailing address at PO Box 5001, PMB #102, Rancho Santa Fe, CA 92067, United States. Orbit helps businesses (each, a "Clinic" or "Customer") manage their Instagram direct messages, comments, and audience, organize their own consented media, and view analytics about their own Instagram content.
This Privacy Policy explains what information Orbit collects, how we use it, how we share it, and the choices and rights available to you. It applies to the Orbit web application at https://orbit.obsiluna.com and related services (the "Service").
If you use Orbit as an end customer of a Clinic (for example, you send an Instagram message to a Clinic that uses Orbit), the Clinic is the controller of your information and its own privacy policy also applies; Orbit processes that information on the Clinic's behalf.
When a Clinic creates an Orbit account, we collect names, email addresses, hashed passwords, role assignments, and the Clinic's business name and logo.
With the Clinic's authorization, and only using the permissions the Clinic grants, Orbit accesses data through the Instagram API with Instagram Login, which may include:
Orbit stores conversation and engagement metadata and message content necessary to operate the CRM (for example, to show a Clinic its inbox, worklist, and lead timeline). Orbit does not collect Instagram passwords.
Clinics may upload photos and videos to Orbit's media library. Clinics are solely responsible for having obtained all necessary consents for any media they upload (see our Terms of Service and consent-release requirements).
Subscription billing is handled by our payment processor, Stripe. Orbit does not store full card numbers; we retain only billing status and identifiers returned by Stripe (for example customer and subscription IDs).
We collect standard log data such as IP address, browser type, pages accessed, and timestamps, and we use a signed session cookie to keep you logged in.
We use the information above to:
We do not sell personal information. We do not use Instagram data for advertising, and we use Meta Platform data only as permitted by the Meta Platform Terms and Developer Policies and to provide the Service to the Clinic that authorized it.
Orbit is designed as a non-clinical system and instructs Clinics not to store protected health information (PHI) or clinical records in it. However, media a Clinic uploads (for example, consented before-and-after photos) may be sensitive. Media is stored in encrypted object storage provided by DigitalOcean Spaces under a data processing agreement (and a Business Associate Agreement where required), and private media is served only to authenticated, authorized users of the owning Clinic.
Clinics are responsible for obtaining written consent from any individual depicted in uploaded media, including consent to store and process that media (and, where applicable, to use automated/AI processing for content organization). See our consent-release language.
We share information only as follows:
We do not share Instagram/Meta Platform data with any third party except the subprocessors above as needed to provide the Service, consistent with Meta's Platform Terms.
When a Clinic connects its Google account, Orbit accesses only that Clinic’s own Google data, with the Clinic’s explicit OAuth consent, to provide features the Clinic turns on:
calendar.events, calendar.freebusy) — to create, update, and cancel the Clinic’s appointments and read availability so Orbit can offer open time slots and avoid double-booking.business.manage) — to read and reply to the Clinic’s Google reviews, turn reviews into branded graphics, and publish posts to the Clinic’s own Business Profile.adwords) — to read the Clinic’s own advertising performance metrics for reporting.Orbit’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Orbit uses Google user data only to provide and improve the features the Clinic explicitly connects; does not transfer Google user data except as necessary to provide those features, to comply with applicable law, or in connection with a merger or acquisition; does not use Google user data for advertising; and does not allow humans to read Google user data except with the Clinic’s affirmative consent, for security or abuse-prevention purposes, to comply with applicable law, or where the data has been aggregated and anonymized. A Clinic may disconnect Google at any time in Orbit’s settings, which revokes Orbit’s access.
We retain information for as long as a Clinic's account is active and as needed to provide the Service, then delete or de-identify it within a reasonable period, unless a longer retention is required by law.
Instagram data deletion. Consistent with Meta's requirements, Orbit provides a data-deletion mechanism:
Clinics may request export or deletion of their account data by contacting us at support@obsiluna.com.
We use industry-standard measures including encryption in transit (HTTPS/TLS), encrypted object storage, hashed passwords, per-tenant data isolation, deny-by-default access controls, rate limiting, and security headers. No method of transmission or storage is perfectly secure, but we work to protect your information and to notify affected parties and authorities of incidents as required by law.
Depending on your location, you may have rights to access, correct, delete, or port your personal information, or to object to or restrict certain processing.
We will respond consistent with applicable law (for example, GDPR/UK GDPR where relevant, and the CCPA/CPRA for California residents). We do not knowingly sell or "share" personal information for cross-context behavioral advertising.
Orbit is operated from the United States and stores data in the United States (DigitalOcean U.S. data centers). If you access the Service from outside the U.S., you consent to processing in the U.S. and other locations with different data-protection laws than your own.
Orbit is a business tool not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a minor's information has been provided to us, contact support@obsiluna.com and we will delete it.
We may update this Policy from time to time. Material changes will be posted here with a new "Last updated" date and, where appropriate, communicated to Clinics.
Questions or requests: support@obsiluna.com, or by mail at Obsiluna LLC, PO Box 5001, PMB #102, Rancho Santa Fe, CA 92067.
Orbit is a product of Obsiluna LLC · Terms of Service · Data deletion