Privacy Policy

Last updated: September 11, 2026

The short version

We collect what you give us (like your email and business details when you try orbt or book a demo), what your browser sends automatically (like analytics and log data), and public information about brands we are asked to research. If you connect your own accounts to Orbt Atlas, we read them read-only and keep counts by country rather than records about people (section 6). We use all of it to run and improve our services, and we process some of it with AI systems that a human reviews. We do not sell your personal information, and we do not share it for cross-context behavioral advertising. You can reach us any time at contact@tryorbt.com. The rest of this page is the detail.

1. Who we are

The data controller for the services described here is ORBT KOREA, Inc.(주식회사 오르빗코리아), a corporation registered in the Republic of Korea (business registration no. 772-86-03334, corporate registration no. 110111-0928328), with its registered office at Startup Studio No. 8, 13 Gaeunsa 1-gil, Seongbuk-gu, Seoul, Republic of Korea (“orbt”, “we”, “us”).

Our privacy officer under Korean law is our CEO, Joshua (Minsoo) Kim. For any privacy question or request, email contact@tryorbt.com with “Privacy” in the subject line.

2. What this policy covers

This policy covers tryorbt.com and its subdomains, the orbt trial application, Orbt Atlas at run.tryorbt.com, our research and strategy services, and our communications with you. Paid client engagements are additionally governed by the signed agreement for that engagement; if that agreement says something different about data, the agreement wins for that engagement.

The Orbt Market Index is a special case, in your favour. The Orbt Market Index is a free public reference work. Reading it needs no account, no email address and no sign-in, and we do not ask for any. The records in it are mostly aggregate statistics about markets and regulations: median comment windows, recall shares, public holidays. They contain no personal data about anyone, and they name no party to an enforcement action. Several of the feeds behind the Index do name parties, so a check runs over every published field before each release and refuses it if a personal name or a party to an action has reached one.

A small number of entries do name a company, and they say so on their face. Nine of the current 1,775 entries name one, all of them from a single measurement of public storefronts, and in every case the company named is the thing being measured: which review platform, help desk or payment method a set of shops was found to be running. Naming the software is the finding. None of those entries is about a person, and none reports wrongdoing by the company named. If you believe an entry names your company inaccurately, the corrections page logs every change we make, and hello@tryorbt.com reaches a human.

Beyond the site-wide analytics described in section 11, reading the Index tells us nothing about you.

3. Information we collect

Information you give us

• Contact and booking details. When you email us or book a demo (through Cal.com), we receive your name, email address, and anything you choose to include, such as your company name and what you want to discuss.
• Trial and account information. When you use the orbt trial, we collect your email address (we use passwordless magic-link sign-in), and, as the product develops, your name and business information you provide: your brand name, website, category, markets, goals, and other context you choose to share so we can research your brand. Providing this is your choice, but without it we cannot generate your report.
• Correspondence. Emails, feedback, and messages you send us, including through Slack channels we share with your team during an engagement.
• Job applications. If you apply to work with us, the information in your application.

Information collected automatically

• Usage and device data. IP address, browser type, device information, pages visited, referring page, and timestamps, collected through server logs and the analytics services described in section 11.
• Approximate location. Derived from your IP address (country or city level, never precise location).

Information from other sources

• Public information about brands. Our core service is market research. When you ask us to research a brand, we collect publicly available information about it: websites, social media content, marketplaces, filings, news, and reviews. This can include personal information that appears in public sources, such as the names of founders or executives. We use it only to produce the research.

We do not knowingly collect special categories of personal data (such as health or biometric data) and ask that you not submit them.

4. How we use your information, and our legal bases

Where the GDPR or similar laws apply, we rely on the legal bases below. Where Korean law (the Personal Information Protection Act) applies, we process personal information within the scope you have consented to or as permitted by law.

5. How we use AI

orbt is an AI research product. Information you provide about your brand, together with public market data, is processed by large language models from providers such as OpenAI, Anthropic, and Google to produce research and recommendations. Three commitments on this:

• Our AI providers process this data under business terms that do not permit them to use it to train their models.
• A human strategist reviews client-facing recommendations before delivery. We do not make decisions about you that have legal or similarly significant effects by automated means alone.
• AI output can be wrong. Our outputs cite their sources so you can verify them, and we mark what we could not verify.

You are dealing with an AI system, and we would rather say it than let you work it out. The trial report, the Atlas board and the analysis inside them are generated by an AI system that orbt operates. Where a sentence in a deliverable was written by a model, it was written by a model. A named human at orbt reviews and takes editorial responsibility for client-facing work before it reaches you, and that review is a real step rather than a formality: it is the point at which we decide whether a finding is fit to send. This paragraph is also how we meet the transparency duties in Article 50 of the EU AI Act and the disclosure expectations of Korea’s Framework Act on AI, and our staff work under an internal AI literacy policy as Article 4 of that Act requires.

6. Accounts you connect to Atlas

Orbt Atlas maps where a brand is sold and where it is wanted. Most of what it reads is public. You can also connect your own accounts, so the map can carry the inside view of the same question: which countries your visitors, followers, subscribers and customers are actually in. Connecting anything is optional, and Atlas works without it.

What we ask for, and what we do with it

• Read-only, always. Every permission Atlas requests is a read permission. Nothing it asks for can post, change, delete or spend anything in your account. Where a platform offers a narrower scope, we ask for the narrower one.
• Counts by country, not people. What Atlas keeps from a connected account is an aggregate: how many visits, followers, subscribers, orders or installs came from each country in a period, and the totals they came from. Where an interface returns individual records on the way to that number, the records are counted in memory and discarded. We do not build a copy of your customer list, and there is no feature that would use one.
• Your data is yours alone. We do not pool data from connected accounts across customers, and we do not use one brand’s connected data to inform another brand’s results, to build benchmarks, or to train models.
• Published boards carry the finding, never the figure. If you share or publish an Atlas board, what a reader sees from a connected account is the conclusion it supported, such as  “already selling here”. The underlying number stays with your account and is not part of anything you publish.

How the credentials are held

Access tokens and API keys are encrypted before they are written down, using authenticated encryption with a key held only by the server. They are never sent to your browser and never appear in a log or an export. A host that has no key to encrypt them with refuses to accept a connection at all, rather than storing anything in the clear.

You can disconnect any account at any time from the Connect panel in Atlas. Disconnecting revokes our access at the platform wherever the platform offers a way to do that, and deletes our copy of the credential either way. You can also revoke access from the platform’s own settings, and Atlas will show the connection as revoked the next time it checks. When you close your account, connected credentials and the readings taken from them are deleted with it.

Google user data

Where you connect a Google account, Atlas reads YouTube channel and video statistics, Google Analytics audience figures by country, Search Console impressions and clicks by country, and, if you grant it, the business locations you have published to Google. It uses them for one purpose: to produce the market analysis you asked for, in your own workspace.

Meta, and other platforms

Where you connect a Facebook Page, an Instagram account or a Threads account, Atlas reads follower and reach figures, including the country breakdown those platforms provide, and uses them only to produce your analysis. We handle that data under Meta’s Platform Terms, including the parts that continue to apply after data has been aggregated. Meta’s deauthorisation and deletion callbacks are implemented, so removing the app from your Meta account removes your connection here too. The same principles apply to every other platform Atlas connects to, and the Connect panel names what each one reads before you agree to it.

7. Who receives your information

We share personal information only with:

• Service providers that process it on our instructions: hosting, databases and content delivery (Vercel, Railway, Cloudflare), scheduling (Cal.com), analytics (Vercel Analytics), email and productivity tools, communication tools we use with you (such as Slack), AI providers (OpenAI, Anthropic, Google, OpenRouter), and payment processors if you purchase from us. The current list, with what each one does and where it operates, is on our subprocessors page.
• Professional advisers (lawyers, accountants, auditors) where needed.
• Authorities where the law requires it.
• A successor if we go through a merger, acquisition, or asset sale; this policy would continue to apply to your information.

We do not sell personal information, and we do not share it with third parties for their own advertising.

8. International transfers

We are based in the Republic of Korea and use service providers in the United States and elsewhere, so your information may be processed outside your country.

Into Korea, from the EEA and the UK. The European Commission has recognized the Republic of Korea as providing an adequate level of data protection, so no further transfer mechanism is needed to move your information here. For transfers onward to the United States and other countries, we rely on the EU-U.S. Data Privacy Framework where the recipient is certified, or on Standard Contractual Clauses or another lawful transfer mechanism.

Out of Korea, under the Personal Information Protection Act. Korean law asks us to tell you the specifics of any transfer abroad rather than describe it in general terms, so here they are.

• What is transferred: your email address and account identifiers; the brand, market and business context you give us; the content of your correspondence; and server and usage data such as IP address and pages visited.
• Where, and to whom: the United States, to the companies named on our subprocessors page, which lists each one, what it does and what it can hold. That page is the canonical list and it changes before a new subprocessor starts work.
• When and how: over an encrypted connection, at the moment you use the service, for as long as you keep using it.
• Why: to host the product, to produce the research you asked for, and to correspond with you. Each recipient keeps it only for as long as that job takes, and under terms that do not permit it to be used to train anyone’s models.
• How to refuse: email contact@tryorbt.com and we will stop. Because the product is built on these providers, refusing means we can no longer run the trial or Atlas for you, and we will say so plainly rather than degrade the service without telling you.

9. How long we keep it

• Trial and account data: while your account is active, then deleted or anonymized within 12 months of your last activity, unless you ask us to delete it sooner.
• Correspondence: up to 3 years after our last exchange.
• Contract, billing, and tax records: up to 5 years, as required by Korean commercial and tax law.
• Server logs: up to 12 months.
• Analytics data: up to 26 months.

When a retention period ends, we delete or irreversibly anonymize the data.

10. Your rights

Depending on where you live, you also have the right to:

• access the personal information we hold about you, and receive a copy in a portable format;
• correct inaccurate information;
• delete your information;
• restrict certain processing;
• withdraw consent at any time, without affecting processing that happened before you withdrew it;
• complain to a supervisory authority: your local data protection authority in the EEA, the Information Commissioner’s Office in the UK, or the Personal Information Protection Commission in Korea.

For US state residents (including California): you have rights to know, access, correct, and delete personal information, and the right not to be discriminated against for exercising them. We do not sell personal information or share it for cross-context behavioral advertising, so there is nothing to opt out of on that front.

To exercise any right, email contact@tryorbt.com. We may need to verify your identity, and we respond within 30 days or the shorter period your local law requires. We will not charge you for a reasonable request.

11. Cookies and analytics

This site sets no cookies. Not for analytics, not for advertising, not for anything. We measure how the site is used with Vercel Analytics, which counts page views without cookies and without a device identifier that could follow you to another site. There is no advertising pixel and no ad-network tag on any page.

That is why you have not been asked to accept anything. A consent banner exists to license non-essential cookies, and there are none here to license. If we ever add a technology that needs consent under the law of the EEA, the UK or anywhere else, we will ask first, in a banner you can refuse, and this section will change before it appears. You can also block whatever you like through your browser settings, and nothing here will break if you do.

12. Security

We protect your information with encryption in transit (TLS), passwordless magic-link sign-in for the trial (no passwords to leak), tenant isolation so one client’s data is never visible to another, rate limiting, and access controls inside the team. Credentials for accounts you connect are additionally encrypted at rest and never leave the server (section 6). No system is perfectly secure; if a breach ever affects your personal information, we will notify you and the relevant authorities as the law requires.

13. Children

Our services are for businesses and are not directed to anyone under 16. We do not knowingly collect personal information from children; if you believe a child has provided us information, email us and we will delete it.

14. Changes to this policy

When we change this policy, we will post the new version here and update the date at the top. If a change meaningfully affects your rights, we will tell you more directly, such as by email or a notice on the site.

15. Contact

ORBT KOREA, Inc. (주식회사 오르빗코리아)
Startup Studio No. 8, 13 Gaeunsa 1-gil, Seongbuk-gu, Seoul, Republic of Korea
contact@tryorbt.com

See also our Terms and Conditions and Disclaimer.