Data Processing Agreement
When you use Orbit, you decide why your readers’ data is used, and Orbit processes it for you. Under the EU and UK GDPR, that makes you the controller and Orbit your processor. This agreement sets out what Orbit promises in that role. It is part of Orbit’s Terms and applies to every account automatically. If you need a signed copy, ask through the support form.
Who is who
- You (the controller): the writer whose Orbit account it is.
- Orbit (the processor): Orbit, run by Rebecca Spitzer, 377 Valley Rd, Unit #3050, Clifton, NJ 07013, USA.
- The people the data is about: your subscribers, the people who comment on, like, or restack your writing, the people you talk to on Substack, and the writers you follow.
What Orbit processes, and why
The data listed in “What we collect” in the privacy policy: public comments and notes, public profile details, your subscriber list (never subscriber email addresses), stats for your own writing, the writers you follow, and your direct messages only if you turn them on. Orbit processes it only to provide Orbit to you: to show you your relationships, remind you who to reconnect with, summarize what is resonating, and answer the AI apps you choose to connect. It keeps doing so for as long as your account is active.
What Orbit promises
- Only on your instructions. Orbit uses the data only to provide Orbit to you, as described above and as you direct through your settings. It does not sell it, use it for advertising, or use it to train AI models. If Orbit believes an instruction breaks the law, it will tell you.
- Confidentiality.Only Rebecca has access to Orbit’s systems. She opens your account’s content only to fix something or help you, never if you have switched off Let Rebecca help with my account in Settings, and each time she does, it is recorded.
- Security. Data is stored in a database scoped to your account, sent only over encrypted connections, and Orbit never receives your Substack password or login cookie. Access tokens are stored hashed.
- Service providers (sub-processors).Orbit uses Supabase (database, United States), Vercel (hosting), Anthropic and OpenAI (AI summaries, through Vercel’s AI Gateway, not used for training), PostHog (product analytics), and Resend (email). Each is bound by its own data processing terms. Orbit will update this list, and the date above, before adding a new one, so you can object by closing your account.
- Transfers outside the EU and UK.Orbit and its providers are in the United States. Transfers rely on each provider’s data processing terms, including the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework where the provider uses it.
- Helping you answer your readers. If someone asks you to see, correct, or delete their data, Orbit will help you do it. Reach us through the support form.
- If something goes wrong. If Orbit learns that your data was exposed, it will tell you without undue delay, and within 72 hours, with what it knows, so you can meet your own duties.
- Deletion. When you close your account or ask us to delete your data, Orbit deletes your captured data and account from its database.
- Showing it. Orbit will give you the information you reasonably need to show that these promises are kept, and answer your questions about them.
AI apps you connect
When you connect Claude, ChatGPT, Gemini, or another AI app to Orbit, you are choosing to send your data to that app. That app is not one of Orbit’s providers: what it does with your data is set by its own terms and your plan with it.