Privacy Policy

This Privacy Policy explains how OrbitSub, a sole proprietorship owned and operated by Karan in New Delhi, India, and registered as a micro enterprise under the Udyam (MSME) scheme of the Government of India ("OrbitSub", "we", "us", or "our") collects, uses, processes, stores, shares, and protects your personal data when you visit orbitsub.com or use our web application, real-time research rooms, Orbit AI tools, export pipelines, and related services (collectively, the "Service"), and how you can exercise your statutory privacy rights.

We have drafted this Policy in clear, plain language to satisfy our transparency obligations under:

• India: the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules made thereunder, the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 ("IT Rules, 2021"), and the CERT-In Cyber Security Directions of 28 April 2022;
• European Economic Area (EEA), United Kingdom & Switzerland: the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the UK GDPR and Data Protection Act 2018, and the Swiss Federal Act on Data Protection ("FADP"); and
• United States & Global: the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA / CPRA") and comparable state and international data protection statutes.

---

1. Data Fiduciary / Data Controller & Grievance Officer

For the purposes of the DPDP Act (where we act as a Data Fiduciary) and the GDPR / UK GDPR (where we act as a Data Controller), the entity responsible for your personal data is:

• Operator: OrbitSub, a sole proprietorship owned and operated by Karan in New Delhi, India, and registered as a micro enterprise under the Udyam (MSME) scheme of the Government of India
• Principal Place of Business: New Delhi, India
• Data Protection & Grievance Officer: Karan
• Email: team@orbitsub.com
• Dedicated Redressal Policy: Grievance Officer Policy

2. Our Core Privacy Commitments

1. No sale of personal data. We do not sell, rent, or trade your personal data to data brokers, advertisers, or any third party.
2. No third-party behavioural advertising. We do not run third-party advertising networks, cross-site tracking pixels, or retargeting cookies on the Service.
3. No AI model training on your work. Neither OrbitSub nor our third-party AI model providers use your prompts, private research drafts, uploaded Library PDFs, or AI outputs to train or fine-tune foundation models.
4. Strict data minimisation & self-serve control. You can control account visibility, message requests, read receipts, and first-party product telemetry, request a statutory data portability archive in Settings → Privacy, or delete your Account in Settings → Account at any time.

3. Categories of Personal Data We Collect

3.1 Information you provide directly

1. Account and authentication data: Your email address, permanent username (@username), display name, password (stored strictly as a salted bcrypt cost-12 cryptographic hash — never in plain text), email verification status, and optional two-factor authentication (TOTP) secret and hashed recovery backup codes.
2. Academic profile and researcher identity: Optional profile details you choose to add in Settings → Profile, including your avatar image or avatar style, biography (bio), academic position (e.g., PhD Candidate, Assistant Professor, Principal Investigator), institutional affiliation, verified-format ORCID iD (e.g., 0000-0002-1825-0097), personal or laboratory website URL, selected research interest categories, Founding 500 member number (#1–#500), and Verified badge status.
3. Research, Live Room collaboration, and Library content:
   • Research drafts, published papers, section outlines, abstracts, formatted bibliographies, citation tokens, real-time collaborative editor state (yjsState), and sentence-by-sentence Citation Report verification records;
   • Co-authorship invitations, reader suggestions, and immutable contribution provenance records (ResearchContribution);
   • Prompts, queries, and instructions you submit to Orbit AI (including Deep Research, Fast Draft, Outline Review, Ask, Review, Paraphrase, Cite, Edit, Autocomplete, and Chat with PDF);
   • Scholarly sources, DOIs, BibTeX/RIS records, and PDF documents you upload or import into your personal Library.
4. Community and social interactions: Communities (o/<slug>) you create, join, or moderate; comments and threaded replies; upvotes, downvotes, likes, and saved research bookmarks; follow relationships and follow requests; and user blocks or abuse reports you submit.
5. Direct Messages: Messages, images, voice notes, and GIFs (selected via the KLIPY integration) you send to other users, along with message request status and read-receipt timestamps (which you can disable in Settings → Privacy). If a message is reported for abuse, a point-in-time snapshot (messageSnapshot) of the reported message is preserved for moderation review.
6. Support, feedback, and statutory requests: Messages submitted via our Contact page (SupportTicket), product ideas and votes posted on the public Feedback board (Feedback and FeedbackVote), formal privacy rights requests (DataPrivacyRequest), Grievance Officer filings (GrievanceRecord), and optional responses to subscription-cancellation, account-deletion, or satisfaction surveys (FeedbackSurveyResponse).

3.2 Information collected automatically when you use the Service

1. Authentication sessions and security audit logs: When you sign in, we issue a short-lived in-memory access token and an httpOnly refresh-token cookie (refreshToken), and record session metadata (IP address, browser/OS summary from the User-Agent header, creation time, and token rotation family) plus a security audit trail (SecurityEventLog) for sign-ins, password resets, and 2FA changes.
2. Metered plan usage: Monthly counters tracking your usage of metered plan features (research, deep_research, fast_draft, ai_prompts, citations, ai_autocompletes, ai_pdf_chats, and library_sources) to enforce plan entitlements and display your usage bars in Settings → Billing.
3. First-party operational and error logs (SystemLog): Every API request is assigned a unique correlation Reference ID (ORB-YYYYMMDD-XXXXXX) returned in the x-request-id header. When a server error (5xx), client-side crash, unhandled rejection, failed action, or slow request (>= 2500ms) occurs, our first-party logger records the Reference ID, timestamp, route/page path, HTTP status, latency, error code/stack, user ID (if signed in), IP address, country header (cf-ipcountry), and browser/OS summary. An automated scrubber (scrubSensitiveMetadata) strips passwords, tokens, cookies, API keys, and payment secrets before any log is stored.
4. First-party product interaction telemetry (BehaviourSession & BehaviourEvent — Opt-Out): To help our engineers identify broken UI controls, rage clicks, dead clicks, and confusing workflows without using any third-party analytics scripts, the Service records batched first-party interaction events (such as PAGE_VIEW, FEATURE_USE, CLICK, RAGE_CLICK, DEAD_CLICK, SCROLL_DEPTH, FORM_ABANDON, ERROR_SHOWN, SEARCH, and EXPORT) keyed to a temporary tab-scoped session ID (orbit_b_sid in sessionStorage).
   • What is never recorded: This telemetry never captures keystrokes, private research draft bodies, Direct Message contents, passwords, or payment details.
   • How to opt out: You can opt out at any time by toggling off "Share first-party product usage diagnostics" in Settings → Privacy (behaviourTrackingOptOut), and our administrators can also pause collection platform-wide. When opted out, both the browser client and the backend API immediately skip telemetry collection.

3.3 Information received from third parties

1. Google Sign-In (OAuth 2.0): If you choose "Continue with Google", Google provides your verified email address, display name, profile picture URL, and Google account identifier (googleId).
2. Zotero & Mendeley (OAuth): If you connect your Zotero or Mendeley account in your Library to import references, we receive an OAuth access token (stored encrypted at rest) and the bibliographic metadata of the collections you choose to import. You can disconnect Zotero or Mendeley at any time.
3. PayPal (Billing & Payment Ledger): When you subscribe to a paid plan via PayPal, PayPal sends us your PayPal subscription ID (paypalSubscriptionId), subscriber email, plan ID, billing cycle dates, sale/refund transaction IDs, and webhook verification headers, which we record in our payment audit ledger (PaymentEventLog). PayPal never shares your raw credit card, debit card, or bank account numbers with us.

4. Purposes and Legal Bases for Processing

We process your personal data only where we have a valid legal basis under the DPDP Act (consent or legitimate uses under Section 7) and the GDPR / UK GDPR (Article 6(1)):

5. How We Share and Disclose Personal Data

We share personal data only in the limited circumstances below:

5.1 Other users and the public (according to your settings)

• Public profile & academic identity: Your username, display name, avatar, bio, academic position, institutional affiliation, ORCID iD, website URL, research interests, Founding 500 badge, Verified badge, public published research, and credited Contributions are visible on your profile. If you enable Private account in Settings → Privacy, only approved followers can view your research list, contributions, and follower/following lists on your profile.
• Public vs. Private Research Rooms: Research published from a public room or opened as a public Live Room is visible to everyone (and included in search and sitemaps). Drafts and Private Rooms are visible only to you, invited co-authors, and users with whom you share the private room code.
• Exported papers & Overleaf: When you export a paper to PDF, Word, LaTeX, or Markdown, your display name, position, affiliation, and ORCID iD are formatted onto the title page. If you click Open in Overleaf, your browser submits the generated LaTeX and BibTeX archive directly to Overleaf (overleaf.com) so you can edit it there.

5.2 Categories of third-party service providers (Sub-processors)

We engage vetted third-party service providers ("Data Processors" under the DPDP Act and GDPR) under binding confidentiality and data-protection obligations solely to process data on our instructions:

In accordance with our security and vendor-governance policy, we identify our AI infrastructure by category ("AI model providers") in public documentation; registered users or regulators may request the current list of specific sub-processor entities at any time by writing to team@orbitsub.com.

5.3 Legal, regulatory, and safety disclosures

We may preserve or disclose personal data if we believe in good faith that doing so is strictly necessary to:

1. Comply with a valid statute, subpoena, court order, or lawful order from an authorised government agency under Section 69 or Section 79(3)(b) of the Indian Information Technology Act, 2000, the IT Rules, 2021, or the CERT-In Cyber Security Directions, 2022;
2. Enforce our Terms of Service, investigate fraud or security incidents, or protect the rights, property, or physical safety of OrbitSub, our users, or the public; or
3. Complete a corporate restructuring, merger, acquisition, or transfer of business assets (in which case the successor entity will remain bound by this Privacy Policy and we will notify you in advance).

6. International Data Transfers

OrbitSub is headquartered in New Delhi, India, and our cloud infrastructure and vetted service providers operate in India, the United States, the European Union, and other jurisdictions. When your personal data is transferred across borders:

• Under the Indian DPDP Act, 2023 (Section 16): We transfer personal data only to countries and territories permitted by the Central Government of India and under contractual safeguards with our Data Processors.
• Under the EU/UK GDPR and Swiss FADP: Where personal data of EEA, UK, or Swiss residents is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (SCCs) (along with the UK International Data Transfer Addendum or Swiss addendum, as applicable) and technical supplementary measures including TLS 1.2/1.3 encryption in transit and AES-256 encryption at rest.

7. Data Retention & Deletion

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, comply with statutory retention mandates, and resolve disputes:

• Active Account data & research: Retained while your Account remains active (or until you delete specific items).
• First-party operational logs (SystemLog) & behaviour telemetry (BehaviourSession / BehaviourEvent): Automatically purged after ninety (90) days.
• Security audit logs (SecurityEventLog), deleted-account statutory records (DeletedAccount), and moderated content logs (ModeratedContentLog): Retained in restricted, access-controlled storage for one hundred and eighty (180) days as required by Indian law (IT Rules, 2021 and CERT-In Directions, 2022), then permanently and automatically purged by our daily cleanup daemon.
• Payment and tax audit ledger (PaymentEventLog): Retained for eight (8) years from the end of the relevant financial year as required by the Indian Income-tax Act, 1961 and Goods and Services Tax (GST) laws.
• Encrypted backups: Rolling database backups are overwritten within fourteen (14) days.

For the complete retention schedule across all 18 data categories and step-by-step deletion instructions, see our Data Retention Policy and User Data Deletion Policy.

8. Your Statutory Privacy Rights

Depending on where you live — and as a baseline commitment we extend to all OrbitSub users worldwide — you have the following rights over your personal data:

1. Right to Access and Summary of Data (DPDP Act s. 11 / GDPR Art. 15 / CCPA): Obtain confirmation of whether we process your personal data, a summary of the personal data we hold, the processing activities undertaken, and the categories of recipients with whom it has been shared.
2. Right to Data Portability (GDPR Art. 20 / CCPA): Receive a copy of your personal data in a structured, commonly used, machine-readable format (JSON / ZIP), in addition to exporting your research papers at any time in PDF, Word (.docx), LaTeX, Overleaf, or Markdown.
3. Right to Correction, Completion, and Updating (DPDP Act s. 12 / GDPR Art. 16): Correct inaccurate or incomplete personal data. You can update most profile and academic identity fields directly in Settings → Profile and Settings → Account.
4. Right to Erasure / Deletion (DPDP Act s. 12 / GDPR Art. 17 / CCPA): Delete your Account immediately via Settings → Account → Delete account (after cancelling any active PayPal subscription in Settings → Billing), or submit a formal erasure request.
5. Right to Withdraw Consent & Opt Out of Diagnostics (DPDP Act s. 6(4) / GDPR Art. 7(3) & Art. 21): Withdraw consent at any time (for example, disconnecting Google/Zotero/Mendeley or toggling off "Share first-party product usage diagnostics" in Settings → Privacy).
6. Right of Grievance Redressal (DPDP Act s. 13 / IT Rules 2021 r. 3(2)): Have any privacy complaint or grievance resolved by our Grievance Officer within statutory timelines, with the right to escalate to the Data Protection Board of India, the Grievance Appellate Committee (GAC), or your local supervisory authority.
7. Right to Nominate (DPDP Act s. 14): Under Section 14 of the Indian DPDP Act, 2023, you have the right to nominate another individual who may, in the event of your death or incapacity, exercise your Data Principal rights with respect to your Account and personal data by writing to team@orbitsub.com.
8. Non-Discrimination (CCPA / CPRA): We will never discriminate against you or deny service quality for exercising any privacy right.

How to exercise your rights & our SLA

• Self-serve in-app: Open Settings → Privacy → Statutory data rights and click Request export, update your profile in Settings → Profile, toggle off diagnostics in Settings → Privacy, or delete your Account in Settings → Account.
• By email: Write to our Data Protection & Grievance Officer (Karan) at team@orbitsub.com from the email address registered to your Account.
• Response timeline: We acknowledge every privacy request within twenty-four (24) hours and complete verification and fulfilment within seven (7) business days (and in all cases well within the statutory window under the DPDP Act, GDPR, UK GDPR, and CCPA).

9. Children's Privacy (18+ Only)

The Service is strictly for adults aged eighteen (18) years and older. We do not knowingly collect or process personal data from anyone under 18 (a "Child" under Section 9 of the DPDP Act, 2023, or a minor under GDPR / COPPA). If you believe a person under 18 has created an Account, please notify us immediately at team@orbitsub.com and we will terminate the Account and purge all associated personal data without delay.

10. Security Practices

We implement technical and organisational security measures meeting the standards of Rule 8 of the Indian SPDI Rules, 2011, Section 8(5) of the DPDP Act, 2023, and Article 32 of the GDPR — including TLS 1.2/1.3 encryption with HSTS preloading, AES-256 encryption at rest, bcrypt cost-12 password hashing, TOTP two-factor authentication with hashed single-use backup codes, rotating httpOnly refresh tokens with reuse detection, DOMPurify HTML sanitisation, isolated PDF compilation sandboxes, automated PII scrubbing in operational logs, and 6-hour CERT-In / 72-hour user and regulator breach notification procedures. See our full Security Policy.

11. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect new platform capabilities or regulatory changes. When we make material changes, we will notify you at least fourteen (14) days in advance via email or an in-app announcement banner and update the "Last updated" date at the top of this page (effective date: 1 October 2026; last updated: 25 October 2026).

12. Contact & Supervisory Authorities

If you have any questions, requests, or complaints regarding this Privacy Policy or our data practices, please contact our Grievance Officer:

• Name: Karan (Founder & Grievance Officer)
• Entity: OrbitSub, a sole proprietorship owned and operated by Karan in New Delhi, India, and registered as a micro enterprise under the Udyam (MSME) scheme of the Government of India
• Location: New Delhi, India
• Email: team@orbitsub.com
• Web Form: orbitsub.com/contact (select category Legal or Account)

If you are not satisfied with our response, you have the right to lodge a complaint with the Data Protection Board of India (under the DPDP Act, 2023), the Grievance Appellate Committee (https://gac.gov.in), the Information Commissioner's Office (ICO) in the United Kingdom, or the competent Data Protection Authority (DPA) in your EU/EEA Member State.