Privacy Policy
Last updated 4 October 2026
This Privacy Policy explains how OrbitSub, a sole proprietorship owned and operated by Karan in New Delhi, India, and registered as a micro enterprise under the Udyam (MSME) scheme of the Government of India ("OrbitSub", "we", "us" or "our") collects, uses, shares, stores and protects personal data when you use the website at orbitsub.com, the OrbitSub web application and related services (the "Service"), and the rights you have.
We are the Data Fiduciary for your personal data within the meaning of the Digital Personal Data Protection Act, 2023 (the "DPDP Act"), and the controller of it for the purposes of the EU and UK General Data Protection Regulations. This Policy is published in accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the "SPDI Rules"), the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the DPDP Act and the Digital Personal Data Protection Rules, 2025 as they come into force.
1. The short version
- We collect what we need to run the Service: your account details, what you write and upload, how you use the Service, and technical data that keeps it secure.
- We do not sell your personal data. We do not show advertising. We use no advertising or analytics trackers.
- We do not use your Content to train artificial intelligence models, and we do not permit our AI providers to do so.
- When you use Orbit AI, the text and files needed to answer you are sent to our AI providers for that purpose only.
- You can see, correct and delete your data, and delete your Account at any time from your settings.
- The Service is only for people aged 18 or over.
2. Who this Policy applies to
This Policy applies to everyone who visits or uses the Service. It does not cover third-party websites or services that the Service links to or integrates with, such as PayPal, Google, Zotero, Mendeley or embedded videos, which have their own privacy policies.
3. Personal data we collect
3.1 Information you give us
- Account information: your email address, username, name if you provide one, and password. We store your password only as a one-way cryptographic hash, never in readable form.
- Profile information: your avatar or profile photo, bio, the research interests you choose, and your privacy settings.
- Security information: if you enable two-factor authentication, the secret key and backup codes that make it work, stored securely.
- Content: the research you write, including drafts; images you add; comments and suggestions; votes and likes; direct messages you send; communities you create and their rules; feedback, reports and support requests you send us.
- Library and sources: sources you add to your library, including files you upload such as PDFs, the text extracted from them, and bibliographic data you import in formats such as BibTeX and RIS.
- Orbit AI inputs: the questions, instructions and files you give Orbit AI, the parts of your draft needed to respond, and your saved prompts.
- Subscription information: the plan you choose and your billing interval. Payments are handled by PayPal: we never receive or store your card or bank account numbers.
- Communications: the content of emails and messages you send us.
3.2 Information collected automatically
- Session and device information: when you sign in, we record your IP address and your browser's user-agent string with your session, so that we can keep you signed in and detect suspicious sign-ins.
- Usage information: the research you view and roughly how long you spend reading it, likes, follows, saves, and your use of features that count towards plan limits.
- Interest profile: from your activity and the interests you choose, we calculate interest scores for research categories, which we use to rank your feed.
- Security signals: information used to protect the Service from abuse, such as rate-limiting data and bot-detection signals processed by Cloudflare Turnstile.
- Diagnostic information: technical details about errors that occur in the Service, which may include identifiers linked to your Account.
3.3 Information from third parties
- Google: if you sign in with Google, we receive your name, email address, profile photo and Google account identifier, as permitted by your Google settings.
- Zotero and Mendeley: if you connect these services, we receive the access credentials needed to import your library, and the reference items you import.
- PayPal: confirmation of your payments and the status of your subscription.
- Other users: information that other users include in their Content, for example when they mention you.
3.4 Sensitive personal data
Of the categories of sensitive personal data defined in the SPDI Rules, we process only passwords, which we store as hashes, and we do not collect financial information such as card or bank details. We do not ask for, and you should not submit, information about your health, sexual orientation, biometrics, government identifiers or other special categories of data. If you choose to include such information in your Content, you do so voluntarily.
4. How we use personal data, and why
| Purpose | What we use | Grounds under Indian law | Grounds in the EEA and UK |
|---|---|---|---|
| Create and run your Account, authenticate you and keep you signed in | Account, session and security information | Your consent, and uses necessary to provide the Service you requested | Performance of our contract with you |
| Provide the features you use: writing, publishing, live collaboration, communities, messages, library and export | Account information and Content | Your consent | Performance of our contract with you |
| Provide Orbit AI | Orbit AI inputs, relevant Content and library sources | Your consent | Performance of our contract with you |
| Personalise your feed | Usage information and interest profile | Your consent | Our legitimate interest in showing relevant research |
| Keep the Service and its users safe, prevent fraud and abuse, and moderate Content | All categories as needed | Legitimate uses permitted by law, including compliance with the IT Rules | Our legitimate interests and legal obligations |
| Process subscriptions | Subscription information | Your consent, and uses necessary to provide the Service you paid for | Performance of our contract with you |
| Send service messages: verification, sign-in and security alerts, billing notices, policy changes | Email address | Uses necessary to provide the Service | Performance of our contract; legal obligation |
| Send notifications you have turned on | Email address, relevant activity | Your consent | Your consent |
| Fix errors and improve the Service | Diagnostic and usage information | Your consent | Our legitimate interest in a reliable Service |
| Comply with law, respond to lawful requests and enforce our Terms | All categories as needed | Compliance with law and legitimate uses under the DPDP Act | Legal obligation and legitimate interests |
We do not sell personal data, rent it, or share it for advertising. We do not use your Content or Orbit AI inputs to train artificial intelligence models.
5. Orbit AI and your data
5.1 What is sent. When you use Orbit AI, we send the input needed to respond (your question or instruction, the relevant parts of your draft, and any files or sources you attach or ask about) to one of the AI model providers described in section 6. Providers return a response that we pass back to you.
5.2 How providers may use it. Our AI providers process these inputs on our behalf to generate responses. We use them only on terms that do not permit them to train their models on your inputs or outputs. Some providers may retain inputs and outputs for a limited period, typically up to 30 days, solely to detect and prevent abuse of their services, under their own terms.
5.3 Searching. To find sources, Orbit AI sends search queries, derived from your question or topic, to our web search provider and to scholarly databases. These queries are not linked to your identity.
5.4 History. Your Orbit AI conversations, reviews and saved prompts are stored in your Account so that you can return to them, until you delete them or your Account.
6. Who we share personal data with
6.1 Service providers
We share personal data with the service providers who help us run the Service. They act on our instructions and may use personal data only to provide their services to us.
| Provider | What they do for us | Personal data involved |
|---|---|---|
| Vercel Inc. | Hosts and delivers the website | IP address, browser information, page requests |
| Hetzner Online GmbH | Hosts the servers our application runs on | All data processed by the Service |
| Neon | Hosts our database | All data stored by the Service |
| Cloudinary | Stores and delivers images and uploaded files | Images and files you upload |
| Resend | Sends our emails | Email address, email content |
| Cloudflare, Inc. | Bot protection (Turnstile) | IP address, browser and device signals |
| Google LLC | Sign in with Google | Google account information |
| AI model providers | Established cloud AI services that generate Orbit AI's responses | Orbit AI inputs and outputs |
| Tavily | Web search for Orbit AI | Search queries |
| KLIPY | GIF search in messages, and the GIFs shown in them | The words you search for GIFs, sent from our servers without your account details; your IP address and browser information when your browser loads a GIF |
| Semantic Scholar, OpenAlex, Crossref, Unpaywall and the DOI system | Searches of scholarly literature and metadata | Search terms and identifiers of works, not personal data |
| Functional Software, Inc. (Sentry) | Error monitoring | Technical error data, which may include identifiers |
| PayPal | Payment processing | Subscription and payment details |
| Zotero and Mendeley | Importing your reference library, only if you connect them | Access credentials and imported items |
We use more than one AI model provider and may change providers to keep Orbit AI reliable and current. Each is bound by terms that limit it to processing your data to provide its service to us. If you would like to know which providers have processed your personal data, ask us at team@orbitsub.com and we will tell you.
6.2 Other users and the public
Some information is visible to other people by design: your username, name, avatar and bio; your published research and the public history of how it was made; your contributions and suggestions in Live Rooms and communities; your likes and follows where shown; and your direct messages, to the people you send them to. Public Content may be indexed by search engines.
6.3 Legal requirements
We may disclose personal data where we believe in good faith that the law requires it: to comply with an order of a court, a lawful direction of an authorised government agency, or a request under the Information Technology Act, 2000 and the rules made under it, within the time limits they set; to investigate, prevent or respond to cyber security incidents, as required by the Indian Computer Emergency Response Team (CERT-In); to protect the rights, property or safety of OrbitSub, our users or the public; and to enforce our Terms.
6.4 Business changes
If the OrbitSub business is transferred to a company or other entity, including on incorporation, merger or sale, personal data may be transferred to that successor, which will be bound by this Policy or give you notice of any change.
6.5 With your consent
We share personal data in other ways only with your consent.
7. International transfers
Our service providers process personal data in India, the European Union, the United States and other countries where they operate. Transfers from India are made in accordance with the DPDP Act, and we will not transfer personal data to any country to which the Government of India restricts transfers. For users in the EEA and UK, transfers to countries without an adequacy decision are protected by the standard contractual clauses or equivalent safeguards offered by our providers.
8. How long we keep personal data
We keep personal data only for as long as it is needed for the purposes described in this Policy, unless the law requires us to keep it longer. In summary:
| Data | How long we keep it |
|---|---|
| Account, profile and Content | While your Account exists. Deleted from our live systems when you delete your Account or the Content |
| Registration information after Account deletion | 180 days after deletion, as required by Rule 3(1)(h) of the IT Rules, in restricted storage, then deleted |
| Content removed for breaching our rules, and related records | At least 180 days after removal, or longer if a court or authority requires, as required by Rule 3(1)(g) of the IT Rules |
| Security and processing logs | As long as the law requires, including at least one year under the Digital Personal Data Protection Rules, 2025 once in force |
| Backups | Overwritten on a rolling basis, ordinarily within 30 days |
| Subscription and payment records | As long as tax and accounting laws require |
Our Data Retention Policy and Data Deletion Policy give full details.
9. How we protect personal data
We use reasonable security practices and procedures appropriate to the data we hold, as required by the SPDI Rules and the DPDP Act. These include encryption of data in transit, one-way hashing of passwords, optional two-factor authentication, access controls that limit who can reach personal data, rate limiting and bot protection, monitoring for errors and abuse, and backups. Our Security Policy describes these measures. No system is completely secure, so we cannot guarantee absolute security.
Breaches. If a personal data breach occurs, we will inform affected users without undue delay, describing what happened, its likely consequences, what we are doing about it, and what you can do. We will report the breach to the Data Protection Board of India within the time the law requires, including a detailed report within 72 hours, and report cyber security incidents to CERT-In within six hours of becoming aware of them, as required by law.
10. Your rights
10.1 Rights of every user
Subject to the law, you have the right to:
- Access: obtain a summary of the personal data we process about you, the processing activities, and the identities of those we have shared it with.
- Correction and completion: correct inaccurate or misleading personal data, complete incomplete data and update it. You can change most profile information directly in your settings.
- Erasure: have your personal data erased when it is no longer needed for the purpose for which it was collected, or when you withdraw consent, unless the law requires us to keep it. You can delete your Account at any time from your settings.
- Withdraw consent: withdraw your consent at any time, as easily as you gave it. Withdrawal does not affect processing that happened before it. If you withdraw consent that is needed to provide the Service, we may be unable to continue providing it.
- Grievance redressal: have your complaint about our processing of your personal data addressed by us.
- Nomination: nominate another person to exercise your rights if you die or become incapable of exercising them.
10.2 Additional rights in the EEA and UK
If you are in the EEA or the UK, you also have the right to object to processing based on our legitimate interests, to ask us to restrict processing, and to receive the personal data you provided to us in a structured, commonly used and machine-readable format.
10.3 Residents of the United States
We do not sell personal information or share it for cross-context behavioural advertising. Where state privacy laws give you rights to know about, correct or delete your personal information, you may exercise them as described below, and we will not discriminate against you for doing so.
10.4 How to exercise your rights
Write to us at team@orbitsub.com from the email address linked to your Account. We may need to verify your identity before acting on a request. We respond within 30 days, or within any shorter period the law requires, and we do not charge for requests unless they are manifestly unfounded or excessive.
10.5 Complaints to regulators
If you are not satisfied with our response to a grievance about your personal data, you may complain to the Data Protection Board of India in accordance with the DPDP Act, after first using our grievance process as the Act requires. If you are in the EEA or the UK, you may complain to your local data protection supervisory authority.
10.6 Your duties
The DPDP Act also asks you, when exercising your rights, not to impersonate anyone, not to suppress material information when providing personal data, and not to register false or frivolous grievances.
11. Children
The Service is only for people aged 18 or over. We do not knowingly collect personal data from anyone under 18, and we do not track, behaviourally monitor or target advertising at children. If we learn that we have collected personal data from a child, we will delete it. If you believe a child has provided us with personal data, please contact us at team@orbitsub.com.
12. Automated processing
We rank your feed using the interest profile described in section 3.2. We also use automated tools, such as rules that flag possible spam or prohibited content, to help us moderate the Service. Automated flags may temporarily hold Content for review. You can appeal any moderation decision, and appeals are reviewed by a person, as described in our Content Moderation Policy.
13. Cookies and similar technologies
We use one cookie, which keeps you securely signed in, and a small amount of storage in your browser for your preferences. We use no advertising or analytics cookies. Our Cookie Policy explains the details.
14. Emails
We send service emails, such as email verification, sign-in and security alerts, billing notices and important changes to our terms. These are part of the Service and you cannot opt out of them while you have an Account. Other notification emails can be turned off in your settings.
15. Changes to this Policy
We may update this Policy from time to time. We will post the updated Policy on this page with a new date and, if the changes are material, notify you by email or through the Service before they take effect. We will also remind you of this Policy at least once a year, as the IT Rules require.
16. Contact and Grievance Officer
For any question, request or complaint about this Policy or your personal data, contact our Grievance Officer, who is also the person responsible for answering questions about our processing of personal data:
Karan, Grievance Officer, OrbitSub New Delhi, India Email: team@orbitsub.com
Grievances are acknowledged within 24 hours and resolved within the time limits set out in our Grievance Redressal Policy.
This Policy is effective from 1 October 2026 and was last updated on 4 October 2026 (GIF search in messages, section 6.1).