OrbitSubBack to OrbitSub

Privacy Policy

Last updated July 31, 2026

Plain-language summary. We collect only what we need to run OrbitSub — your account details, the research you create, and basic usage logs. Your AI prompts go only to the AI provider you choose, and only when you use an AI feature. We never sell your personal data. You can access, correct, export, or delete your data at any time. The full policy below explains exactly what we collect, why, who processes it, and your rights under India’s DPDP Act. This document should be reviewed by a qualified lawyer before we rely on it commercially.

This Privacy Policy explains how KARAN, a sole proprietor based in India (“OrbitSub,” “we,” “us”), collects, uses, shares, retains, and protects your personal data when you use the website at orbitsub.com and related services (the “Service”). For the purposes of India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”), we are the Data Fiduciary and you are the Data Principal.

Please read this Policy together with our Terms of Service and Cookie Policy. By using the Service, you acknowledge this Policy; where the law requires consent, we rely on the consent you give and on the other lawful bases described below.

1. The personal data we collect

1.1 Data you give us

  • Account data: your email address, username, and a securely hashed password (we can never read your actual password). If you sign in with Google, we receive your name, email address, and profile picture from Google instead of a password.
  • Profile data: your display name, bio, and profile picture or chosen avatar, and your account privacy setting — all optional and editable in Settings.
  • Content: the research, drafts, titles, text, uploaded files and images, citations and sources, comments, suggestions, and messages you create or upload through the Service.
  • AI interactions: the prompts you send to AI features and the responses generated, kept so you can see your history within a research room.
  • Support and communications: the content of messages you send us, including support requests, feedback, and grievances, and the email address you use.

1.2 Data we collect automatically

  • Log and device data: your IP address, browser type and user-agent, and records of sign-ins and certain actions — used for security, session management, and abuse prevention. For example, we record the IP and user-agent associated with a login session and with support submissions.
  • Cookies: a small set of cookies described in our Cookie Policy, including an essential sign-in cookie, preference cookies (such as your theme), and Cloudflare’s bot-protection cookie.

1.3 Data from third parties

  • Google, if you choose Google sign-in (name, email, profile picture).
  • PayPal, which tells us your subscription status. We store only your plan and a subscription identifier — we never see or store your card, bank, or full payment details.
  • Reference services (Crossref, Zotero, Mendeley) return citation and source metadata when you import sources; if you connect Zotero or Mendeley, we access your library to import references and do not store your credentials for those services.

1.4 Sensitive data

We do not ask for sensitive personal data (such as financial account numbers, health, or biometric data). Please do not put sensitive personal data about yourself or others into your Content unless it is necessary for your research and you have the right to do so. You are responsible for personal data about other people that you include in your Content.

2. Why we use your data, and our legal basis

Under the DPDP Act we process personal data for lawful purposes, relying on your consent or on other legitimate uses permitted by law. Specifically, we use your data to:

  • Provide the Service — create and manage your account, host and display your research, run rooms, feeds, notifications, search, citations, and publishing. (Basis: performance of the service you request / your consent.)
  • Provide AI features you choose to use, as described in Section 3. (Basis: your consent, given by invoking the feature.)
  • Secure the Service — authenticate sign-ins, detect bots, prevent abuse and fraud, enforce rate limits, and protect users. (Basis: our legitimate interest in security and legal obligations.)
  • Communicate with you — send verification emails, security alerts, grievance responses, and important service notices. (Basis: performance of the service / legitimate interest.)
  • Handle payments — manage subscriptions and billing status through our payment processor. (Basis: performance of a contract with you.)
  • Comply with law — respond to lawful requests and meet legal, tax, and regulatory obligations. (Basis: legal obligation.)

We do not sell your personal data.

3. AI features — where your text goes

When you use the assistant, AI editing, AI review, or AI citation features, the necessary parts of your prompt, draft, attachments, and selected sources are transmitted to the provider of the model you selected — currently Microsoft (Azure OpenAI Service) — solely to generate the response you asked for.

  • This happens only when you invoke an AI feature. We do not send your Content to AI providers in the background.
  • Each provider processes that data under its own API terms and privacy policy, which we encourage you to read.
  • If you do not want a particular provider to process your text, simply do not select its model.
  • Some AI reviews may use web search to find real sources; in that case a search query derived from your request is sent to the provider’s search tool.

4. Who we share data with (processors and disclosures)

Like almost every internet service, we rely on trusted third-party providers (“Data Processors”) to operate the Service. They may process your data only on our instructions and for the purposes below:

  • Vercel — hosts the website/frontend.
  • Render — hosts our backend servers.
  • Neon — hosts our primary database.
  • Cloudinary — stores uploaded images and files.
  • Resend — delivers our transactional emails.
  • Upstash — provides caching and rate-limiting infrastructure.
  • Cloudflare (Turnstile) — verifies that sign-ups and sign-ins are human.
  • PayPal — processes payments and manages subscriptions.
  • Google — optional sign-in.
  • Microsoft (Azure OpenAI Service) — AI responses, only when you invoke them.
  • Crossref, Zotero, Mendeley — citation and source metadata when you use those features.

We may also disclose personal data:

  • where required by law, court order, or a valid request from a public authority;
  • to enforce our Terms or protect the rights, property, or safety of OrbitSub, our users, or the public;
  • in connection with a merger, acquisition, or sale of assets, in which case we will notify you and this Policy will continue to apply to your data.

5. Cross-border transfer — where your data lives

Several of our providers store and process data on servers located outside India, including in the United States and Europe. This means your personal data may be transferred to, stored in, and processed in those countries. By using the Service, you acknowledge this transfer. We use providers with recognised security practices and appropriate contractual protections, and we transfer data only to countries not restricted for such transfer under applicable Indian law.

6. How long we keep your data (retention)

  • While your account is active: we keep your account, profile, and Content for as long as your account exists, so the Service works as expected.
  • After you delete your account: we delete or irreversibly anonymise your personal data within 30 days, except where we must retain specific data for legal, tax, billing, security, or fraud-prevention reasons, in which case we keep only what is necessary and for no longer than required.
  • Backups: residual copies in encrypted backups cycle out within a limited period (ordinarily up to 30 days) after deletion.
  • Shared contributions: Content you contributed to shared spaces (for example, comments on others’ research, or suggestions folded into someone else’s work) may remain on the Service, shown as from a deleted account.
  • Published Research: once published and shared, others may retain copies or links outside our control even after you delete yours.

More detail is available in our Data Retention Policy and Data Deletion Policy where published.

7. Your rights as a Data Principal

Under the DPDP Act, you have the right to:

  • Access — obtain a summary of the personal data we hold about you and how we process it;
  • Correction and completion — correct inaccurate or misleading data and complete incomplete data (you can edit most of this directly in Settings);
  • Erasure — have your personal data erased by deleting your account, subject to the retention exceptions above;
  • Withdraw consent — withdraw consent at any time, noting that some processing is necessary to provide the Service, so withdrawing it may mean you can no longer use parts of the Service;
  • Nominate — nominate another individual to exercise your rights in the event of your death or incapacity;
  • Grievance redressal — raise a complaint about how we handle your data (see Section 10).

To exercise any right you cannot complete from Settings, email us at team@orbitsub.com. We may need to verify your identity before acting. We respond within the timelines the DPDP Act prescribes.

8. How we protect your data (security)

We take reasonable technical and organisational measures to protect your personal data, including:

  • passwords hashed with bcrypt (never stored in readable form);
  • encryption of traffic in transit using TLS;
  • short-lived access tokens with rotating, hashed refresh tokens;
  • optional two-factor authentication, with 2FA secrets encrypted at rest;
  • bot protection, rate limiting, and access controls on sensitive operations.

No internet service can guarantee perfect security. If a personal-data breach likely to affect you occurs, we will notify you and the Data Protection Board of India as required by the DPDP Act.

9. Children

The Service is intended only for users aged 18 and above. We do not knowingly collect or process the personal data of anyone under 18. If you believe a minor has provided us personal data, contact us at team@orbitsub.com and we will delete it.

10. Grievance redressal

If you have a concern about how we handle your personal data, please contact us first at team@orbitsub.com. Our Grievance Officer’s details and the complaint process are on our Grievance Redressal page. If you are not satisfied with our response, you may approach the Data Protection Board of India.

11. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will notify you by email or an in-product notice before they take effect, and we will update the “Last updated” date above. Your continued use of the Service after the changes take effect means you acknowledge the updated Policy.

12. Contact us

For any question about this Policy or your personal data, contact us at team@orbitsub.com.