Privacy Policy (Canada)

Personal information means information about an identifiable individual (collectively, “personal information”), and does not include information that cannot be attributed to an identifiable individual, such as information of an aggregate or anonymous nature (collectively, “non-personal information”). We will only collect, use, and disclose the personal information that we need in order to provide you with the Services.

This Privacy Policy addresses the personal information that we collect and process in connection with your OrbitRadar account and your use of the Services. It also explains, in section 9, how we handle the public posts of other people that the Services retrieve and show to you (“Public Post Data”). It does not extend to what you do with those posts outside the Services: as between you and us, you remain solely responsible for any message you send to a person and for your own compliance with applicable law, in accordance with our Terms of Use.

We will obtain your express consent prior to or when collecting, using, or disclosing your personal information for any purpose not described in this Privacy Policy, or for a purpose that was not identified to you nor reasonably expected at the time of collection, unless we are required or permitted by law not to obtain your consent. When you create an account you confirm that you have read this Privacy Policy, and you choose separately, by an unticked box, whether to receive product updates by email; we record both choices and the date.

We may rely on your implied consent in certain circumstances, after taking into account factors such as the sensitivity of the personal information and your reasonable expectations. We will limit the collection, use, and disclosure of your personal information to only that which is necessary for the purposes identified, unless you have otherwise consented, or when such collection, use, and/or disclosure is permitted or required by law.

You can always refuse to provide your personal information, except that it may prevent you from using our Services or receiving responses to your inquiries or other information of interest.

We may collect various types of personal information from you or, if applicable, the entity you represent, depending upon how you or the entity you represent interacts with us or uses the Services. This personal information may include your:

• Contact/Location Information. Email address and any name or other contact information you give us when you write to us.
• Account Information. If you sign up and create an account, your email address, a password stored as a salted one-way hash by our hosting platform’s account service (we never hold it in readable form), when the account was created and confirmed, the version of the Terms of Use you accepted, and your choice about product updates. If you believe that someone has created an unauthorized account using your personal information, you can request its removal.
• Product and Workspace Information. The product name, website address and description you give us, or that we read from your website at your request; the phrases and keywords you track; your digest settings, including any Slack, Discord or other webhook address you enter; and anything you type into a note or a reply. Where a product description or website describes an individual (for example, a sole trader), that is personal information too.
• Purchase/Billing Information. Which plan you are on, when it started and changed, and a record of checkout attempts. Full credit card and payment card details are collected and processed directly by our third-party payment processor (Stripe, through our hosting platform) and are not received or stored by us.
• General Location Data. Information generated from your IP address that permits us to determine your general location.
• Device Information. IP address, operating system and platform, browser type and version, device type, referring website, the pages you open and when, and other information about how you use the Services.
• Usage Information. Counts of what the Services do for you (searches run, posts read, replies written, insights written) and the steps you take through the Services (account created, confirmed, product set up, first post shown, checkout started, subscribed, cancelled), which we use to enforce plan allowances, watch our own costs and understand how the Services are used.
• Inferences. Inferences drawn from or created based on any of the information identified in this list, including the market insights the Services write for your workspace.

By providing us with this personal information, you agree and acknowledge having obtained the express consent of the entity you represent (as applicable) for us to collect, use, and disclose such personal information in accordance with this Privacy Policy.

We strive to uphold data minimization principles and only seek to collect personal information from you for the purposes described in this Privacy Policy. When we combine non-personal information with personal information, we treat the combined information as personal information. You can always refuse to provide the personal information, but please note that some personal information is necessary to provide the Services.

We need to collect personal information from you or, if applicable, the entity you represent in order to provide you or the entity you represent with our Services, as well as to improve the experience of using our Services. You, or if applicable, the entity you represent, may provide us with personal information in several ways, including, for example when you or the entity you represent:

• use our Services;
• create an account, or describe your product, or ask us to read your website;
• correspond with us, including through surveys;
• sign up to receive our newsletter or promotional information;
• ask for customer service, support or other assistance; or
• interact with us in any other way, online or offline, including through our Services.

We may also collect personal information from other sources (such as from our hosting platform’s account and payment services) to, among other things, enable us to complete, verify, or update personal information contained in our records.

Web Beacons & Cookies

Like many websites and apps, we use “cookies”, which are small text files that are stored on your computer or equipment when you visit certain online pages. We use strictly necessary cookies to keep you signed in and to manage your session; disabling them means the Services will not work. On our public website pages and on the three pages that confirm a sign-up, a confirmed address and a new subscription, we also use one advertising pixel, the Meta Pixel, so that we can measure whether our own advertising on Meta’s platforms brings people who go on to use the Services. The pixel is not loaded on any page inside the signed-in application, so nothing about your workspace, phrases, matches or replies reaches Meta. The pixel is not loaded until you accept it on the notice shown on your first visit; declining, or a browser’s Global Privacy Control or Do Not Track signal, keeps it off, and you can change your mind by clearing the site’s data in your browser. Data the pixel collects is subject to Meta’s privacy policy.

Online Analytics

We use the traffic analytics provided by our hosting platform, OrbitOrca, which counts visits, page views, referrers, countries and devices in aggregate so that we can understand how the Services are used. That measurement is done by a small script on each page and does not use identifying cookies. It is subject to OrbitOrca’s privacy policy.

Social Media Platforms

The Services show you links to posts on X, Bluesky and Hacker News. When you follow such a link, or use a “reply” link that opens a platform’s own composer, your browser connects directly to that platform, which may collect information from you under its own policies. We do not embed social plug-ins in the Services. We encourage you to review those platforms’ usage and disclosure policies and practices, including their data security practices, before using them.

Surveys

From time to time, and subject to your consent where required by applicable local law, we may provide you with the opportunity to participate in surveys. Participation in these surveys is completely voluntary. If you choose to participate, we will request certain personal information from you. Any surveys offered by us may be governed by specific rules, terms and conditions that are separate from and in addition to this Privacy Policy.

Unless otherwise consented by you in advance, or as may be permitted or required by law, we will only use and disclose your personal information to fulfill the purposes for which it was collected (and in accordance with this Privacy Policy). We may use personal information to do any or all of the following:

• provide the Services: finding and reading public posts for your phrases, judging them against your product description, writing suggested replies and market insights, delivering your digest, and enforcing your plan’s allowances;
• administer our relationship with you, including creating and managing your account and your subscription;
• facilitate your interactions and transactions with us, such as requests for support or a change of plan;
• respond to your requests, communications, suggestions, comments, and inquiries, including your feedback about the Services;
• send you notices necessary to operate your account (confirmation, password reset, billing, changes to these documents);
• send you product updates and tips by email, only if you opted in, and until you opt out;
• analyze and measure performance, maintenance, and operations, including how many posts and matches each workspace generates and what that costs us;
• develop new products and services and build products and features;
• conduct surveys and research to better understand the preferences of our customers like you;
• ensure our systems are secure, and prevent fraud or the recurrence of fraud;
• respond to legally binding demands from law enforcement, regulatory authorities or other third parties;
• defend, protect, or enforce our rights or applicable terms of service;
• assist in the event of an emergency; and
• comply with applicable law.

We do not use your product description, phrases or posts to serve, train or improve anything for any other customer; each workspace is judged on its own. In many cases, we de-identify your personal information as soon as we collect it, for example in aggregate usage counts. In these cases, such information is non-personal information. We may use non-personal information for any legitimate business purpose.

Except as set forth in this Privacy Policy, or as required or permitted by law, we do not disclose your personal information to any parties other than our service providers and our affiliates, and their respective directors, officers, employees, agents, consultants, advisors or other representatives that have a need to use your personal information to provide or improve our Services, to legal or regulatory authorities, or for other purposes for which you have provided your consent. In no event will we sell or rent your personal information.

We may disclose personal information:

• to our third-party service providers (within or outside of Canada) to help us with the uses described in the How We Use Personal Information section above. Today these are: OrbitOrca, which hosts the application and its database, runs user accounts and traffic analytics, and handles checkout; Stripe, which processes payments; Anthropic, whose Claude models receive your product description and the text of public posts in order to score them and write replies and insights, and which does not use that data to train its models; X, Bluesky and Hacker News, whose official interfaces receive your phrases and keywords as search queries (never your identity); an email tool (such as Loops or Resend), which receives your email address, and the steps you took in the Services, only if you opted in to product updates; Meta, whose pixel on our public and sign-up pages receives the page address and a browser identifier, only if you accepted it; and any webhook destination you configure, which receives your digest. Personal information in the custody and control of a third-party service provider is subject to the laws of the jurisdiction applicable to that provider. We will act in a reasonable manner, including by contractual or other means, to ensure that the provider agrees to be bound by this Privacy Policy or a privacy policy that provides substantially similar measures to those employed by us to protect the privacy and security of your personal information and to comply with applicable privacy legislation, but we cannot guarantee such compliance by the third party;
• to comply with your directions or any additional consent you have provided us;
• to other parties where we are under a duty to disclose your personal information in order to comply with any applicable legal obligation including a regulatory process, or an order of a government institution, investigative body, regulatory body or judicial authority of competent jurisdiction;
• where we transfer or are considering transferring control of any or all of our assets, operations or services to a third-party acquirer of all or substantially all of our assets, including our rights and obligations relating to our Services. The third party may continue to retain and use the personal information that you provided to us. We will act in a reasonable manner, including by contractual or other means, to ensure that the third party agrees to be bound by this Privacy Policy or a privacy policy that provides substantially similar measures, but we cannot guarantee such compliance by the third-party acquirer; and
• where we merge, consolidate, or amalgamate with a third party, the merged, consolidated, or amalgamated entity may continue to use and disclose your personal information. We will use our best efforts to ensure that it agrees to be bound by this Privacy Policy or a privacy policy that provides substantially similar measures, but we cannot guarantee such compliance.

We disclose non-personal information to third parties as reasonably necessary to meet our business needs. We do not disclose your personal information to third parties for their own direct marketing purposes without your consent.

We are concerned about ensuring the security of your personal information, and we have taken appropriate measures to ensure its security and confidentiality. Data is encrypted in transit between your browser and our servers and between our application and every provider it calls. Authentication credentials are stored as salted, one-way hashes by our hosting platform’s account service, and secrets and infrastructure credentials are encrypted and never written to logs. Access to the production database is limited to what running the Services requires.

We will only retain your personal information for the period of time reasonably required to fulfill the purposes for which it was collected: account and workspace data for as long as your account exists and for thirty (30) days after closure; records of consent and of payments for as long as the law requires, typically six years; traffic analytics for 180 days; logs for up to 90 days; and stored excerpts of public posts for 30 days after posting on X and 90 days on Bluesky and Hacker News, unless the customer acted on the post (marked it contacted or done), in which case the excerpt is kept with that customer’s record. We may retain non-personal information for as long as we have a business need to do so.

Our Services utilize third-party systems, programs, websites, solutions and applications, including without limitation those of OrbitOrca, Stripe, Anthropic, X, Bluesky and Hacker News. An organization must protect personal information that is in its custody or under its control by making reasonable security arrangements against such risks as unauthorized access, collection, use, disclosure, copying, modification, disposal or destruction. All of our service providers and contractors are contractually obligated to employ appropriate data security measures with respect to your personal information and to collect/use/disclose/retain it only within the scope required for the provision of our Services. However, we are not responsible for the actions and privacy policies of these third parties. Check the privacy policies of these third parties for information on their privacy practices.

We try our best to safeguard personal information once we receive it, but please understand that no transmission of data over the Internet or any other public network can be guaranteed to be 100% secure. If you suspect an unauthorized use or security breach of your information, please contact us as soon as possible.

We offer you certain choices in connection with our Services.

Access to your personal information

On your reasonable written request, we will provide you, not later than 30 days from our receipt of your request, or such additional time as required by law, with access to or information about your personal information (if any) under our custody or control, and the names of persons to whom, and any circumstances in which, your personal information has been and is being disclosed by us. You must provide sufficient information in your request to allow us to verify your identity and identify the information you are seeking. If you request a copy of your personal information and the personal information can reasonably be reproduced, we will provide you with a copy, or, if applicable, we will give you reasons for any delay in providing it. All requests may be subject to minimal costs, in accordance with applicable privacy legislation.

We reserve all rights not to disclose personal information, in whole or in part, in certain circumstances permitted or required by law, including but not limited to where:

• the personal information is protected by any legal privilege;
• the disclosure of the personal information would reveal confidential commercial information;
• the disclosure could reasonably be expected to threaten the life or security of another individual;
• the personal information was generated in the course of a formal dispute resolution process; or
• the personal information was collected by us without your knowledge and consent for reasonable purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province.

If access to your personal information is refused, in whole or in part, we will provide you with the reasons for the refusal, the provision of applicable privacy legislation on which the refusal is based, and the contact information of the Privacy Officer who can answer your questions about the refusal, and will inform you that you may ask for a review of the refusal in accordance with applicable privacy legislation. To submit a request to access your personal information or designate an authorized agent to make a request on your behalf, please contact us. Our security procedures mean that we may request proof of identity before we disclose your personal information to you.

Updating your personal information

The accuracy of the personal information we have about you is very important. You can change your product description, phrases, keywords and settings at any time in the Services. For anything else, please contact us. On your request, we will make every reasonable effort to correct outdated personal information, or errors or omissions in your personal information where that personal information is in our custody or control. Such request must be in writing and include sufficient detail to enable us to identify the personal information in question. We will, as soon as reasonably practical and not later than 30 days from our receipt of your request, or within such additional time as permitted or required by law, either correct the personal information and, if applicable and reasonable to do so, send correction notifications to any third party to whom we disclosed the incorrect personal information, or decide not to correct the personal information, but annotate it to indicate that a correction was requested but not made. We will inform you of the action taken, the contact information of the Privacy Officer, and that you may ask for a review of the action taken in accordance with applicable privacy legislation.

Email communications

If you opted in to product updates, you can opt out at any time by following the unsubscribe link at the bottom of our emails or by switching the option off in your settings; we record the change and pass it to the email tool. Please note that certain emails are necessary for the operation of our Services, such as account confirmation, password reset, billing and notices of changes to these documents. You will continue to receive these emails, if appropriate, even if you unsubscribe from our optional communications.

Closing your account

You can close your account at any time from your settings or by writing to us. Your workspace data is deleted within 30 days of closure, except for records we must keep as described in section 7.

The Services retrieve posts that people published publicly on X, Bluesky and Hacker News, through those platforms’ official interfaces and never by scraping. For each post that matches a customer’s phrase we store an excerpt, the author’s public username, the link to the post, and the date, together with the automated model’s reading of whether the post is asking for something like that customer’s product. We show the post only to the customer whose phrases matched it; we do not build profiles of authors, combine their posts across customers, contact them ourselves, or use their posts for any purpose other than showing them to the matching customer. Stored excerpts are deleted on the schedule in section 7, and sooner on request.

Our customers are told in our Terms of Use that any reply is sent by them, from their own account, under the platform’s rules and applicable law, and they are responsible for it. If you wrote a post that appears in the Services and you want it removed from them, write to support@orbitorca.com with the link and we will remove it and stop showing it.

The Services contain links to other websites or apps operated by third parties, including the X, Bluesky and Hacker News posts shown to you, our hosting platform and our payment processor. Please be advised that the practices described in this Privacy Policy do not apply to information gathered through these third-party websites and apps. We have no control over, and are not responsible for, the actions and privacy policies of third parties and other websites and apps.

If you have questions, concerns, or would like to access/update/change your personal information, you can contact us in the following ways:

For your protection, we may need to verify your identity before assisting with your request, such as verifying that the information used to contact us matches the information that we have on file.