Who is responsible for your data#
The controller of your personal data is Orbitally, based in Dhaka, Bangladesh ("we", "us"). You can reach us about privacy at hello@orbitally.tech.
This policy covers the Company Enrichment API, its product pages and its playground at https://orbitally.tech/products/company-enrichment-api (the "Service"). The rest of orbitally.tech, which describes our web development work, uses the same hosting and analytics described below.
What we collect, why, and on what basis#
Scroll horizontally to view the full table.
| What | Examples | Why | Legal basis |
|---|---|---|---|
| API usage data | Time of the request, the domain you looked up, request ID, result status, response time, your plan, an identifier for your API account or key, and your IP address | To provide the API, apply limits, keep it secure, fix problems and help you with support | Contract; our legitimate interests in security and preventing abuse |
| Account and billing details | Limited details about your subscription, such as plan, usage and billing status, from our payment partners. When you pay directly, your name, email address, country and the amount paid | To manage your subscription, bill you and meet our legal duties | Contract; legal obligation |
| Playground data | The domain you enter, the time, a hashed (not raw) form of your IP address, and the result of a bot-protection check run by Cloudflare | To run the playground and protect it from abuse | Our legitimate interests in running and protecting the playground |
| Website analytics | Pages viewed, referring page, device and browser type, approximate location at country level, and events such as button clicks, collected by Vercel Web Analytics | To understand how the site is used and improve it | Our legitimate interests in improving the Service |
| Messages | Emails you send us and our replies | To answer you and keep a record of support requests | Contract; our legitimate interests in running our business |
We do not use your data for advertising, and we do not sell personal data.
Information about people in API results#
The API returns information that companies have published on their own websites. This can include names and business contact details of people, such as business email addresses and phone numbers, and links to company social profiles. We do not intentionally collect sensitive categories of personal data.
We collect this information from public web pages and use it only to provide results to our customers. We keep cached results for up to 7 days. Our legal basis is our legitimate interest in providing a business-information service that is limited to business details that companies chose to publish.
We do not contact these people directly, so we explain here how their information is handled. If you appear in a result and want your details removed or corrected, email hello@orbitally.tech with the domain and the details concerned. We will check the request and respond within one month.
Cookies and similar technologies#
We do not use advertising or marketing cookies. Vercel Web Analytics measures page views and events without building advertising profiles. Cloudflare Turnstile checks whether a visitor is a person or a bot and may use limited browser storage to do so. We use it only for security.
If we add other tools that use cookies or similar technologies, we will update this policy and ask for consent where the law requires it.
Who we share data with#
We share personal data only with providers that help us run the Service, and only as needed:
- Vercel Inc.: hosting and website analytics, in the United States and other countries.
- Cloudflare, Inc.: bot protection for the playground.
- Google Cloud Platform (GCP): hosting for the API.
- Google Gmail SMTP: email for support and administration.
- RapidAPI: the marketplace through which you may subscribe. RapidAPI handles your account and payment for those subscriptions under its own privacy policy.
- Professional advisers such as lawyers and accountants, and public authorities where the law requires it.
- A buyer or successor, if our business is sold or transferred.
International transfers#
We are based in Bangladesh and our providers operate in other countries, including the United States. Your data may therefore be processed outside the country where you live.
Where the law requires safeguards for such transfers, we rely on measures such as the European Commission's standard contractual clauses, the UK's international data transfer addendum, or an adequacy decision or data privacy framework certification held by the provider.
How long we keep data#
- API usage logs: 90 days.
- Playground logs: 30 days.
- Cached results: up to 7 days.
- Support emails: 2 years after our last contact with you.
- Payment and order records: held by our payment partners under their policies. We keep our own records for 12 years.
- Website analytics: kept by Vercel in aggregated form under its retention settings.
We delete or anonymise data when the period ends, unless the law requires us to keep it longer.
Your rights#
Depending on where you live, you may have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased;
- restrict how we use your data;
- receive your data in a portable format;
- object to processing based on our legitimate interests;
- withdraw consent where we rely on it;
- complain to a data protection authority, such as the one in the country where you live or work.
To use any of these rights, email hello@orbitally.tech. We may need to confirm your identity first. We respond within one month. We would like the chance to help before you complain to an authority, but you do not have to contact us first.
Security#
We protect data with encrypted connections (HTTPS), restricted access, secrets stored only on the server, minimal logging and hashing of IP addresses in the playground. No system is completely secure. If a breach affects your personal data, we will tell you and the authorities where the law requires.
Children#
The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect personal data from children.
Automated processing#
The API uses automated analysis to turn public website information into a company profile, including a confidence score. We do not use it to make decisions about individuals that have legal or similarly significant effects.
Changes to this policy#
We may update this policy. The "Last updated" date at the top shows the current version. For material changes, we will notify customers by email where we have their address, or by a notice on this page.
Contact#
Orbitally Dhaka, Bangladesh Privacy email: hello@orbitally.tech