Privacy Notice

This notice explains how Instatus, Inc. handles personal data when you visit orbitid.com, use the OrbitID dashboard and API, or sign in through OrbitID to an application that uses it.

Who we are

OrbitID is a product of Instatus, Inc., a Delaware corporation with its mailing address at 9450 SW Gemini Dr PMB 30900, Beaverton, Oregon, USA. You can reach us about privacy at [email protected].

Our two roles

We are the controller

For data about our own customers: the people who create OrbitID teams, the teammates they invite, and visitors to orbitid.com. We decide how that data is used, and this notice describes it.

We are a processor

For data about our customers' users: the people who sign in to our customers' applications through OrbitID, and the users and groups synced from their directories. Our customer decides how it is used, and we process it only on their instructions. If you signed in to an application through OrbitID, contact that application's company first; we will help them answer you.

Data we collect and why

When you create an account, we fill in a name and profile picture you have not given us from public sources: your Google profile if you use Continue with Google, otherwise the public Gravatar profile for a hashed copy of your email address. For a work email, we also look up a company name for your team from the email's domain with Clearbit, and a logo with Logo.dev. If nothing is found, the fields stay empty, and a team owner can upload or remove the logo at any time.

Your card or bank details go straight to Paddle at checkout. They never reach our servers.

Data we process for our customers

To provide single sign-on and directory sync, OrbitID processes:

• Sign-in data: the identity assertions and claims an identity provider sends, such as email address, name, user ID, groups and any other attributes the customer's identity provider is set up to send.
• Directory data: users and groups synced over SCIM or from Google Workspace, with the attributes the directory sends.
• Logs: sign-in traces and webhook deliveries, so our customers can troubleshoot their connections.

We use this data only to provide OrbitID to the customer who sent it. Our data processing agreement sets out the details.

Who receives personal data

We never sell personal data or share it for advertising. We share it only with:

• Paddle, our Merchant of Record and reseller, which processes payments, invoices and taxes, and handles refunds. Paddle uses checkout data as described in Paddle's privacy notice.
• Service providers that run parts of OrbitID for us under data processing agreements: Amazon Web Services (hosting, database and backups), Mailgun (sign-in and invitation emails), Help Scout (our support inbox and the dashboard's support chat) and Google (only if you choose Continue with Google). When you sign up, we also query Gravatar with a hash of your email address and Clearbit and Logo.dev with your work email's domain, as described above. The full list of subprocessors is available from [email protected].
• Professional advisers, such as lawyers and accountants, when they need it to advise us.
• Authorities, when a valid legal order requires it. We tell you about such requests unless the law forbids it.
• A buyer, if Instatus is ever sold or merged. We will tell you before your data moves and becomes subject to a different privacy notice.

International transfers

OrbitID is hosted in the United States. When we transfer personal data from the EEA, the UK or Switzerland, we rely on the European Commission's standard contractual clauses and the UK addendum to them, or on an adequacy decision where one applies.

How long we keep it

Your rights

Depending on where you live, you can ask us to:

• give you a copy of your personal data (access),
• correct it (rectification),
• delete it (erasure),
• limit how we use it (restriction),
• send it to you or another company in a portable format (portability),
• stop using it for our legitimate interests (objection),
• withdraw any consent you gave, without affecting what we did before.

Email [email protected] and we will reply within one month. You can also complain to your local data protection authority. California residents have the right to know, delete and correct their data and not to be discriminated against for using these rights. We do not sell or share personal data as those terms are defined in California law.

How we protect it

Data is encrypted in transit with TLS 1.2 or later and at rest with AES-256, including backups. Signing keys live in a managed key service, access to production is limited and logged, and OrbitID is audited for SOC 2 Type II. Read more on our security page.

Cookies

orbitid.com sets no cookies and uses no analytics or advertising trackers. Your theme choice is saved in your browser's local storage.

The dashboard at app.orbitid.com uses only strictly necessary cookies: a session cookie that keeps you signed in and a security cookie that protects forms against cross-site request forgery. Paddle's checkout sets its own cookies to process payments and prevent fraud. If you open the support chat in the dashboard, Help Scout's widget loads at that moment and keeps your conversation in your browser's storage.

Children

OrbitID is a business service and is not meant for anyone under 16. We do not knowingly collect their data.

Changes to this notice

When we change this notice, we update the date at the top. If a change affects how we use data you have already given us, we email team owners before it applies.

Contact

Privacy questions or requests: [email protected]. Postal mail: Instatus, Inc., 9450 SW Gemini Dr PMB 30900, Beaverton, Oregon, USA.