Privacy Policy
Effective date October 18, 2026
This policy explains what personal information Orbital - a product of Constructr, Inc. - handles, why, who we give it to, how long we keep it, and what you can ask us to do about it.
Orbital is an agent platform. Our customers configure AI agents that plan work, call tools, connect to the customer's own systems and - within limits the customer sets - take actions in them. That shapes this policy in two ways worth stating up front:
- Most of the information that flows through Orbital is not ours and is not about our own users. It belongs to a customer organisation and may describe that organisation's employees, customers or records. We handle it on the customer's instructions. Section 2 explains the split.
- Agents hold access we are given, not access we take. When a customer connects a system, they decide what the agent may read and do. Sections 3 and 6 explain what that means for personal information.
Notice at collection
This section is the notice at collection required by California law. It is complete on its own - you do not need to read the rest of this policy to get the required information. It describes the personal information we collect as a business, through our website and in our product. It does not describe customer workspace content, which we process on a customer's instructions (see Section 2).
We collect these categories of personal information:
| Category (statutory term) | Purposes we collect and use it for | How long we keep it |
|---|---|---|
| Identifiers | Create and run your account; sign you in; send service and security notices; support; billing; security and abuse prevention | While your account is active. Following account deletion, we delete this information from active systems within 30 days and from backups within 90 days, unless a longer period is required for legal, security, or compliance purposes. |
| Personal information under Civ. Code §1798.80(e) (customer records) | Billing, invoicing, refunds, tax and accounting records | Generally for seven years after the end of the financial year in which the transaction occurred, or longer where required by applicable law. |
| Commercial information | Manage your subscription, plan entitlements, usage and spend limits; billing | While your account is active and for up to 30 days after account deletion. Billing, payment, and transaction records may be retained for up to seven years for accounting, tax, and legal purposes. |
| Internet or other electronic network activity information | Operate, secure, debug and improve the website and the product; measure which features are used | Routine operational logs for up to 90 days; security and audit logs for up to 12 months; identifiable product analytics for up to 14 months. Aggregated or de-identified information may be retained longer. |
| Geolocation data (coarse, from IP address) | Security, fraud and abuse prevention; aggregate usage reporting | With the related log record |
| Audio, electronic, visual or similar information | Only where you send it to us - screenshots, screen recordings or attachments in a support request | For up to 12 months after the related support request is resolved, unless a longer period is necessary for an ongoing investigation, dispute, or legal obligation. |
| Professional or employment-related information | Respond to demo, enterprise and contact requests; business-to-business marketing | Until you opt out, or the record is no longer reliable |
| Sensitive personal information | See the next paragraph | See Section 8 |
Sensitive personal information. We collect two categories of sensitive personal information, in each case only where a customer connects a system that contains it:
- Account log-in credentials and access tokens that a customer gives us so an agent can reach a connected system - enumerated at Civ. Code §1798.140(ae)(1)(B). We collect these to connect to the systems you ask us to connect to, and for no other purpose.
- The contents of mail, email or messages, where a customer connects a mailbox or messaging system and an agent reads it on their instruction - enumerated at §1798.140(ae)(1)(E) where we are not the intended recipient.
We use and disclose sensitive personal information only for the purposes permitted by 11 CCR §7027(m) - to provide the service you asked for, to secure it, to prevent fraud and abuse, and to comply with law - and not to infer characteristics about anyone.
Sale or Sharing of Personal Information
We do not sell personal information or share personal information for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act (CCPA).
We may disclose personal information to service providers and contractors that process information on our behalf to operate, secure, maintain, and improve our services, subject to contractual restrictions.
We do not sell or share customer workspace content.
Where the rest of the detail is. Categories and sources in full: Section 3. Purposes: Section 5. Recipients: Section 7. Retention: Section 8. Your rights and how to use them: Sections 12 and 13. This notice is part of this Privacy Policy.
1. Who we are
Orbital is a product of Constructr, Inc. ("Orbital", "we", "us"). Constructr, Inc. is the company that contracts with our customers and is responsible for the personal information described in this policy.
- Registered address: Constructr, Inc., 1484 Pollard Rd, #3006, Los Gatos, CA 95032, USA
- Privacy contact: privacy@withorbital.ai
- Security contact: security@withorbital.ai
It covers our website at withorbital.ai, the Orbital web app, the Orbital desktop app, and the agent platform behind them (together, the "Services").
Constructr Studio, our earlier product, is a legacy product that is no longer offered to new customers. Personal information in existing Studio accounts is handled under this policy.
2. Our two roles
Which of your rights apply, and who you exercise them against, depends on which of these two buckets your information sits in.
Service Data - we decide, so we are the controller. Information about our own visitors, account holders and prospective customers: your account record, billing details, product telemetry, support conversations, website analytics and business contact information we use for marketing. This policy governs it, and you can bring us a request about it directly under Section 13.
Customer Workspace Content - the customer decides, so we are the processor. Everything a customer organisation puts into or connects to Orbital: goals, projects and tasks; prompts and instructions; agent outputs and artifacts; files; and the data an agent reads from or writes to the customer's connected systems. We handle it on the customer's instructions, under the agreement we have with them and our Data Processing Addendum.
If you are an employee, customer or contact of an organisation that uses Orbital, and your information reached us as Customer Workspace Content, please contact that organisation first - they control it and they decide what happens to it. If you contact us instead, we will tell you so, and where we are permitted to we will pass your request to them.
Analytics is the one place these overlap. We use product analytics inside the web app to understand how the product is used. We act as a business in our own right for that analytics data.
Data Processing Addendum. Our Data Processing Addendum is published at /dpa. It governs the Customer Workspace Content we process on a customer's behalf.
3. What we collect, and where it comes from
3.1 Service Data
| What | Examples | Where it comes from |
|---|---|---|
| Account and organisation data | Name, work email, organisation, role, team membership, authentication identifiers | You; your organisation's administrator; your identity provider if your organisation uses single sign-on |
| Billing data | Billing contact, invoice and plan records, tax identifiers | You. Card details go directly to our payment processor - see Section 7 |
| Product telemetry and logs | Feature and page usage, performance metrics, API and request logs, error traces, browser and device information, IP address | Automatically, as you use the Services |
| Agent run metadata | Which agent ran, when, which tools and connectors it called, which actions were approved or denied, token and cost usage | Automatically, as the platform runs. |
| Support data | Tickets, chat conversations, and any screenshots, recordings or files you attach | You |
| Connector configuration | Which systems are connected, the scopes granted, and the credentials or tokens needed to reach them | You or your administrator. See Section 4 |
| Business contact data | Work contact details of people at prospective customer organisations | Public sources, such as company websites and professional networking profiles |
| Cookies and similar identifiers | Cookie and local-storage identifiers | Automatically. See our Cookie Policy at /cookies |
3.2 Customer Workspace Content
We do not control what a customer puts into Orbital or connects it to, so we cannot list the categories exhaustively. It may contain personal information about the customer's own employees, customers or contacts, and - depending on what the customer connects - may include sensitive categories.
We ask customers not to connect Orbital to systems holding data they are not permitted to process with a third-party service, and not to submit protected health information. We do not offer a Business Associate Agreement and Orbital is not built for HIPAA-regulated use.
4. Credentials and connected systems
This is the part of Orbital that most deserves its own section.
When you connect a system, you grant the platform access so an agent can do the work you asked for. We handle those grants as follows:
- Scope. Access is limited to the permissions you grant when you connect the system, and the connected system enforces those permissions independently of us.
- Storage. Credentials and tokens are held encrypted at rest in our connector gateway, separately from your workspace content, and are never placed in an agent's working environment.
- Use. We use them only to perform the work the customer's configuration calls for, to keep the connection working, and to secure it.
- Revocation. You can disconnect a system at any time. We then delete the stored credential, and agents can no longer reach that system.
- Per-session grants. Where a connector supports it, an agent is given access to a connected system only for the duration of a session, through our gateway, and that access ends when the session ends.
Where we can, we pass requests through to your system rather than copying data into ours. Where the service requires us to hold a copy, we hold the minimum needed.
5. Why we use information
- To provide the Services: run agents, execute tasks, call tools, maintain connections, and store the results
- To authenticate you and keep accounts and workspaces separate
- To bill, collect payment and keep accounting records
- To secure the Services: detect, investigate and prevent abuse, fraud and security incidents
- To support you when you ask, and to debug failures
- To measure and improve reliability, performance and usability
- To tell you about service changes, incidents, security matters and billing
- To market to business contacts, subject to the opt-out in Section 15
- To comply with law and to establish, exercise or defend legal claims
6. AI models, agent processing and human review
6.1 Model providers, and how we constrain them
Running an agent means sending prompts, context and - where you have configured it - data from your connected systems to one or more AI model providers, and in some configurations to third-party agent runtimes.
What we commit to is the mechanism, not just the outcome. We use third-party model providers under paid API terms that contractually prohibit training on customer data. Where a provider offers a setting that shares data for model improvement, we disable it. We have not yet enabled zero data retention on our own provider accounts, so each provider retains content for a limited period under its standard terms, typically for abuse monitoring; our sub-processors page gives the window for each.
Where you configure your own provider account or API key, that provider processes your content under your agreement with it rather than under ours, and the commitments in this section do not extend to that traffic.
Each provider is listed at /subprocessors with what it receives, where it processes it, and how it is configured.
6.2 Model training: our position, in three tiers
We state three tiers rather than one sentence, because two of them are real and a single sentence would hide them. "We never train on your data" would be easier to read and it would not be true.
Two definitions do the work here:
- Customer Workspace Content is as defined in Section 2 - your prompts and instructions, agent outputs and artifacts, files, and anything an agent reads from or writes to a system you connect.
- A shared model is any model that serves customers other than you. A customer-specific improvement is one that only ever affects your own workspace.
Tier 1 - Your content is never used to train shared models
We do not use Customer Workspace Content to train, fine-tune or otherwise improve any shared model, unless you have given us explicit, separately documented opt-in.
"Separately documented" means a distinct, recorded act by someone with authority at your organisation - a specific agreement or setting we can point to in our records. It is not acceptance of our terms, not a default, and not a checkbox folded into sign-up. Where there is no such opt-in on record for you, this commitment is absolute and has no exceptions.
Tier 2 - We use anonymized operational telemetry to run the platform better
Operational telemetry is data about how the platform ran, not about what you asked it to do. It covers things like how long a step took, how many tokens a model call used, which model or tool was selected, whether a call succeeded or failed, error types and codes, retry and queue behaviour, and cost.
We use it to improve orchestration, model routing, token efficiency, reliability and cost.
To be precise about the boundary:
- Operational telemetry excludes Customer Workspace Content. It does not include your prompts, your instructions, your agent outputs, your artifacts, your files, or data an agent read from a connected system.
- We do not use operational telemetry to train models on your material. This tier improves how we route, schedule and operate - it does not teach a model from your content.
- It is anonymized. Telemetry used for this purpose is aggregated and stripped of identifiers so that it is not linked back to you, your workspace or an individual user.
In practice, telemetry is aggregated across customers and stripped of workspace, account and user identifiers before it is analysed, and any field that could carry content, such as a tool parameter or an error string, is excluded or reduced to a type before the telemetry is stored.
Tier 3 - We use your data to improve your own agents, and it stays with you
We may use your Customer Workspace Content to improve your own agents, evaluations and configurations - for example tuning how your agents carry out your workflows, or building evaluations from your own runs. This applies to your workspace unless a workspace administrator turns it off in your workspace settings.
We do not share customer-specific learning across tenants. Anything learned from your data under this tier stays with your workspace. It is not transferred to, surfaced in, or used to benefit another customer's agents, models or configurations. That is a commitment we make to you, not a description of how the system happens to be built today.
One answer, used everywhere
This position replaces the statements made in earlier versions of this policy and of our Terms of Service. Its contractual form is in our AI & Agent Terms, and the same definitions and tiers appear in our Terms of Service, our Data Processing Addendum and on our Security page.
6.3 Human review
Authorised staff may look at Customer Workspace Content in a small number of situations: when you ask us for support, when we are investigating a security problem or suspected abuse, and when we are debugging a failure. Such access is restricted to authorised staff, requires a recorded reason and is logged.
6.4 Automated decisions about people
Agents produce output that people act on, and in some configurations they take actions directly.
We do not ourselves use personal information to make, or substantially assist in making, decisions about you that have legal or similarly significant effects, such as decisions about employment, credit, housing, education, healthcare or insurance.
Customers who configure agents to support such decisions about people must keep a qualified person in the decision, as our AI & Agent Terms and Acceptable Use Policy require. In those cases the customer, not Orbital, is the business making the decision, and the customer is responsible for any notice, opt-out or appeal rights that apply.
7. Who we disclose information to
| Who | What they get, and why |
|---|---|
| Service providers and sub-processors | Hosting, storage, AI model inference, agent runtimes, connector authentication, product analytics, email delivery, payments and support. Each is contractually limited to processing on our instructions. Named at /subprocessors |
| Payment processor | Billing and card processing by Stripe. Card details go directly to Stripe; we do not store full card numbers. |
| Your organisation | If you use Orbital through an organisation's account, its administrators can see your account record, your activity in the workspace and the agent runs you start |
| Systems you connect | At your instruction, an agent sends data to and receives data from the systems you connect. Those systems are governed by their own terms, not ours |
| Professional advisers | Lawyers, accountants and auditors, under confidentiality obligations |
| Authorities | Where the law requires it, or to protect the rights and safety of people or the Services. Where the law allows, we tell the affected customer before we disclose their data in response to a government request, and we disclose only what the request requires. |
| An acquirer | In connection with a merger, acquisition, financing or sale of assets, subject to this policy continuing to apply |
We do not sell personal information and we do not share it for cross-context behavioural advertising. We do not allow advertising networks to track you through the Services.
Changes to our sub-processors. We publish our current list at /subprocessors. We will give customers at least 30 days' notice before a new sub-processor starts processing customer personal information, and a customer may object on reasonable data-protection grounds. If we cannot resolve an objection, you may terminate the affected service without penalty and we will refund any prepaid fees for the unused period.
8. How long we keep information
Two kinds of statement appear below and they are not the same thing. A commitment is a period we hold ourselves to. A reservation is an outer limit beyond which we do not keep data for that purpose.
| Information | Period | Commitment or reservation? |
|---|---|---|
| Account and organisation data | While your account is active. Following account deletion, we delete this information from active systems within 30 days and from backups within 90 days, unless a longer period is required for legal, security, or compliance purposes | Commitment |
| Subscription, plan and usage records | While your account is active and for up to 30 days after account deletion. Billing, payment, and transaction records may be retained for up to seven years for accounting, tax, and legal purposes | Reservation |
| Customer Workspace Content | As configured by the customer while the workspace is active. When a workspace is deleted or a subscription ends, removed from active systems within 30 days and from backups within 90 days | Commitment |
| Prompts, agent outputs and artifacts | Part of your Customer Workspace Content; the row above applies | As above |
| Agent run logs and tool-call records | Transcripts follow your Customer Workspace Content. Policy, approval and credential-event records are kept as an audit record for up to 12 months | Reservation. Audit records are kept for that period even if a deletion request is made during it, as our AI & Agent Terms explain, so that the governance record customers rely on is not erased |
| Operational logs | Routine operational logs for up to 90 days; security and audit logs for up to 12 months | Reservation |
| Product analytics | Identifiable product analytics for up to 14 months. Aggregated or de-identified information may be retained longer | Reservation |
| Support conversations and attachments | For up to 12 months after the related support request is resolved, unless a longer period is necessary for an ongoing investigation, dispute, or legal obligation | Reservation |
| Billing and tax records | Generally for seven years after the end of the financial year in which the transaction occurred, or longer where required by applicable law | Reservation |
| Backups | Age out within 90 days | Reservation |
Where we cannot commit to a fixed period, we decide how long to keep information using these criteria: how sensitive it is, whether we still need it for the purpose we collected it for, whether a law requires us to keep it, and whether we need it to resolve a dispute or enforce an agreement. We may keep information longer where any of those apply.
Deletion and export on exit. While your account is active you can ask us for an export of your Customer Workspace Content at any time. When a subscription ends, you may request an export within 30 days of the termination date, and we will provide your Customer Workspace Content in a machine-readable format before we delete it.
9. Security
We use administrative, technical and physical safeguards appropriate to the information we hold. It lists only controls we can demonstrate.
- Encryption in transit using TLS 1.2 or higher, and AES-256 encryption at rest for data in Orbital-managed storage
- Logical isolation of each customer's workspace in our application and data layers, with each agent session running in its own isolated environment
- Access controls on a least-privilege basis, and multi-factor authentication on internal systems
- Logging of administrative actions and of each access by our staff to Customer Workspace Content
- Encrypted backups, with periodic restore testing
- Automated vulnerability and dependency scanning, with patching prioritised by severity
- Single sign-on (SAML) and SCIM provisioning on enterprise plans
Independent audit. We have scoped a SOC 2 Type II examination and engaged an auditor. The observation window has not yet begun, and no attestation or report exists today. We cannot provide a SOC 2 report, and we will not imply otherwise. We will update this section when that position changes.
We do not hold ISO 27001 certification and we do not claim HIPAA compliance.
If something goes wrong. If we learn that personal information has been accessed without authorisation, we will notify affected customers within 72 hours of confirming the incident, by email to your account owners, with what we know, what we are doing and what we suggest you do.
To report a vulnerability or a security concern, contact security@withorbital.ai.
10. Where data is processed
We operate the Services from the United States. If you use Orbital from outside the United States, your information will be transferred to and processed there, where the law may differ from your own.
Deployment changes this answer, and the legal position should match what /enterprise already tells buyers:
- Orbital Cloud: the control plane is hosted by us in the United States. Enterprise plans can choose a United States or European Union processing region.
- Self-hosted: the control plane runs in the customer's VPC or data centre. Placing it there does not by itself mean no data leaves the customer's network - model requests, connector traffic, logs and updates all need to be looked at individually. We provide a data-flow map for your deployment on request so you can review each of these before you decide.
- Air-gapped: available on request. The network boundary and the supported components are agreed with you as part of the deployment.
11. Children
Orbital is a business product and is not intended for children. You must be at least 16 to create an account, and we do not knowingly collect personal information from anyone under 16. We have no actual knowledge that we sell or share the personal information of consumers under 16 years of age.
If you believe a child has given us personal information, contact us and we will delete it.
12. Your choices
- Your account. You can view and correct much of your account information in the product.
- Marketing email. Every marketing email has an unsubscribe link. You can also email us to opt out of business-to-business marketing entirely.
- Cookies and analytics. See our Cookie Policy at /cookies.
- Connected systems. You can disconnect any connected system at any time.
- Formal privacy requests. See Section 13.
13. California and US state privacy rights
This section applies if you are a California resident, and the rights and process described in it are what we offer residents of other US states with comparable privacy laws. If your information reached us as Customer Workspace Content, please read Section 2 first - the customer organisation controls that information.
13.1 What we collect, disclose, sell and share
The categories we collect, the sources, the purposes and the retention periods are set out in the Notice at collection at the top of this page and in Sections 3, 5 and 8.
- Categories collected in the last 12 months: as listed in the notice at collection.
- Categories disclosed for a business purpose in the last 12 months: identifiers; customer records; commercial information; internet or other electronic network activity information; geolocation data; audio, electronic, visual or similar information; professional or employment-related information; and the sensitive personal information described in Section 4 - in each case to the categories of service providers listed in Section 7
- Categories of recipients: the service providers and other recipients listed in Section 7, named individually at /subprocessors.
- Categories sold or shared in the last 12 months: none. We do not sell personal information and we do not share it for cross-context behavioural advertising.
- Sensitive personal information: we do not use or disclose it for purposes other than those permitted by 11 CCR §7027(m).
- Under-16: we have no actual knowledge that we sell or share the personal information of consumers under 16.
13.2 Your rights
Subject to the exceptions in the law, you may ask us to:
- Know what personal information we have collected about you - the categories, the sources, the purposes, the categories of recipients, and the specific pieces of information
- Delete personal information we collected from you
- Correct inaccurate personal information we hold about you
- Opt out of sale or sharing - we do not sell or share, so there is nothing to opt out of; if that ever changes, we will publish an opt-out mechanism before it does
- Limit the use and disclosure of sensitive personal information - on our current practices this right is not engaged, because we use sensitive personal information only for the purposes permitted by §7027(m) and never to infer characteristics about anyone
- Not be discriminated against for exercising any of these rights
Non-discrimination. We will not deny you the Services, charge you a different price, give you a lower quality of service, or suggest that we might, because you exercised a privacy right.
13.3 How to make a request
- Email: privacy@withorbital.ai
Tell us what you are asking for and enough about yourself that we can find your records.
How we verify you. We will ask you to confirm information we already hold - typically control of the email address on the account, and for a request about specific pieces of information, additional details matching our records. We ask for the least we can. If we cannot verify you to the level the request requires, we will tell you why, and for a request to know we will treat it as a request for category-level information instead. We do not require you to create an account to make a request.
How long we take. We will confirm receipt within 10 business days and respond within 45 days. If we need longer we will tell you within that first 45 days, and we may extend once by a further 45 days.
If we say no. We will tell you why, and you can appeal by replying to our response and putting "Appeal" in the subject line. We will respond to an appeal within 45 days. You can also complain to the California Privacy Protection Agency or the California Attorney General.
Authorised agents. You can use an authorised agent to make a request for you. We will ask the agent for written proof that you authorised them, and we may contact you directly to confirm. If the agent holds a power of attorney for you, we will not ask you separately. We may deny a request from an agent who cannot show authority.
No charge. Requests are free. We may decline a request that is manifestly unfounded or excessive, and if we do we will tell you why.
13.4 Other states, and other countries
Residents of other US states with comparable privacy laws have broadly these rights and should use the same channel. We will apply the right that applies to you.
14. Changes to this policy
We will post any updated version on this page and change the effective date at the top. For changes that materially affect how we handle personal information, we will email account owners before the change takes effect. We keep dated copies of previous versions.
15. Contact us
- Privacy questions and requests: privacy@withorbital.ai
- Security reports: security@withorbital.ai
- Post: Constructr, Inc., 1484 Pollard Rd, #3006, Los Gatos, CA 95032, USA
To stop receiving business-to-business marketing, use the unsubscribe link in any marketing email or write to the privacy address above.