Legal
Privacy Policy
This policy explains what personal data we process when you visit our website or use Orbox, why we do it and what rights you have. It is provided under Articles 13 and 14 of the General Data Protection Regulation (GDPR).
The Czech version of this document is binding.
1.Controller
The controller of your personal data is Orbox Labs s.r.o., company ID 29910340, registered office Pernerova 676/51, Karlín, 186 00 Prague 8, Czech Republic. For anything related to personal data, write to support@orbox.dev.
Where you put personal data of other people into Orbox (for example colleagues or customers mentioned in a process), your company is the controller of that data and we act as its processor under the Data Processing Agreement.
2.What we process and why
| Purpose | Data | Legal basis | How long | |
|---|---|---|---|---|
| Creating and running your account | Name, email, company, profile data from Google or Microsoft if you sign in with them, workspace role | Performance of the contract (Art. 6(1)(b)) | While the account exists, then 30 days | |
| Providing the service, including AI | Process descriptions, attachments, chat messages and outputs | If you turn on monitoring: the records Orbox reads from the tools you connect to check that a step took place | Performance of the contract (Art. 6(1)(b)) | While the account exists, then 30 days for export; afterwards deleted, and removed from backups as they rotate |
| Billing and accounting | Billing details, invoices, payment status (not card numbers) | Legal obligation (Art. 6(1)(c)), accounting and VAT law | 10 years from the end of the tax year | |
| Answering enquiries (Partner introductions, security documents) | Name, email, company, company size, message | Steps before a contract, legitimate interest (Art. 6(1)(b) and (f)) | 2 years from the last contact | |
| Security and abuse prevention | IP address, browser data, access logs | Legitimate interest (Art. 6(1)(f)) | As long as needed to run and secure the service, longer while we investigate an incident | |
| Website statistics | Aggregated, anonymised visits; no cookies | Legitimate interest (Art. 6(1)(f)) | Aggregated data only | |
| Service emails | Email address | Performance of the contract (Art. 6(1)(b)) | While the account exists |
Where we rely on legitimate interest, our interest is to run a secure service, respond to people who contact us and understand how the website is used. You can object to such processing at any time.
Providing data needed for the account is a condition of the contract; without it we cannot create the account. Everything else is voluntary.
3.Artificial intelligence
To write up your processes, the content of your conversation is sent through OpenRouter to AI models running on servers in the European Union. Prompts and responses do not leave the EU, and the providers process them only to generate the answer for you and do not retain them afterwards. Neither we nor they use your content to train AI models.
We do not make any decisions about you based solely on automated processing that would have legal or similarly significant effects (Art. 22 GDPR).
4.Who receives your data
We share personal data only with providers who help us run Orbox (hosting, database, AI models, email, payments) and who are bound by a processing agreement. The current list, including where each one processes data, is on the Subprocessors page.
If you send a request for a Partner, we share your contact details and the description of your request with at most 3 Partners we choose from those who opted in to receive requests, after they confirm they have capacity. Each Partner then acts as an independent controller and gets access to your workspace only if you invite them. If you sign up through a Partner’s link, we tell that Partner your company name and which plan you pay for, so we can pay their commission; we never share the content of your processes.
If you sign in with Google or Microsoft, that provider shares your basic profile with us under its own privacy policy. We may also disclose data to public authorities where the law requires it.
5.Transfers outside the EU
We store and process your data in the European Union. Where a provider is based outside the European Economic Area or may access data from there, the transfer is protected by an adequacy decision (such as the EU–US Data Privacy Framework) or by the European Commission’s Standard Contractual Clauses.
6.Your rights
Under the GDPR you have the right to:
- access your personal data and get a copy of it;
- have inaccurate data corrected;
- have your data erased;
- restrict processing;
- data portability, meaning to receive your data in a machine-readable format;
- object to processing based on legitimate interest;
- withdraw consent at any time, where processing is based on consent.
To exercise your rights, write to support@orbox.dev. We respond within one month. You also have the right to lodge a complaint with the supervisory authority, which in the Czech Republic is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, www.uoou.gov.cz), or with the authority in the EU country where you live or work.
7.Security
We protect data with encryption in transit and at rest, access control based on the principle of least privilege, and regular backups. More detail is on the Security page.
9.Children
Orbox is a service for businesses and is not intended for people under 18. We do not knowingly collect data about children.
10.Changes
We will update this policy when the way we process data changes, and we will tell you about significant changes by email or in the application. This version is effective from 18 August 2026.