Privacy Policy
Last updated: February 2026
This Privacy Policy describes how Orbit Metrics ("we," "us," or "our") collects, uses, stores, and protects information when you use the Orbit Velocity platform ("Service"), accessible at app.orbitvelocity.com. Orbit Velocity is an AI-powered sales follow-up assistant that integrates with your CRM to help you manage prospect communications more efficiently.
By creating an account or using the Service, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.
1. Information We Collect
1.1 Account Information
When you sign up for Orbit Velocity, we collect:
- Email address and name (provided during signup or via Google Sign-In)
- Company/organization name (provided during onboarding)
- Authentication credentials managed by Firebase Authentication (Google Firebase). If you use email/password signup, your password is handled by Firebase and is never stored or accessible by Orbit Velocity directly.
1.2 CRM Data from GoHighLevel
When you connect your GoHighLevel (GHL) sub-account, Orbit Velocity syncs the following data from your GHL location:
- Contact records (names, email addresses, phone numbers, tags, custom fields)
- Conversation history (email and SMS message threads between you and your contacts)
- Opportunity and pipeline stage information
- Contact notes and meeting records
This data is stored in our database (Google Cloud SQL, PostgreSQL) and is scoped to your organization. Your GHL API Key and Location ID are stored encrypted in the database and are used solely to sync data and send messages on your behalf.
1.3 AI-Generated Content
When you use Orbit Velocity's AI features, the Service generates:
- Follow-up message drafts based on your conversation history and configured playbooks
- Sales deliverables such as personalized microsites, strategy packets, and sample newsletters
- Contact enrichment analysis and talking points
AI-generated content is stored in our database and associated with your organization.
1.4 Knowledge and Configuration Data
You may provide the Service with:
- Voice calibration data (writing samples and tone preferences so the AI can match your communication style)
- Toolkit prompts and templates (sales playbooks, messaging strategies, approved examples)
- Business knowledge (your offer details, pricing, case studies, testimonials, calendar links)
This data is stored in our database and/or Google Cloud Firestore and is used exclusively to improve AI output quality for your organization.
1.5 Billing Information
We use Stripe for payment processing. When you subscribe to a paid plan:
- You are redirected to Stripe's hosted checkout page to enter payment details. Orbit Velocity never sees, processes, or stores your credit card number or payment card details.
- Stripe stores your billing email, payment method, and subscription status under their own privacy policy.
- We store your Stripe Customer ID, Subscription ID, current plan, and billing status in our database to manage your account.
1.6 Optional Integration Data
If you enable optional integrations, we may also collect:
- Fireflies.ai meeting transcripts: When you provide a Fireflies API key, Orbit Velocity retrieves meeting transcripts associated with your contacts. Transcript content is used in AI context for enrichment and is not permanently stored separately from the enrichment output.
- HeyReach LinkedIn data: When you provide a HeyReach API key, Orbit Velocity retrieves LinkedIn profile information (headline, location, about section, experience) for contacts. This data is stored in the contact enrichment record.
Integration API keys are stored encrypted in your organization's settings and are used solely to call their respective services on your behalf.
1.7 Usage and Log Data
- AI usage metrics: Token counts, model used, and estimated costs per API call are logged in our database for billing enforcement and credit tracking.
- Application logs: Standard server logs generated by Google Cloud Run, including request timestamps, IP addresses, and error reports. These are retained according to Google Cloud's log retention policies.
1.8 Cookies
Orbit Velocity uses only strictly functional cookies required for authentication and session management (via Firebase Auth). We do not use any advertising, analytics, or tracking cookies. There are no third-party tracking pixels, no Google Analytics, no Hotjar, and no similar tracking tools on the application.
2. How We Use Your Information
We use the information we collect for the following purposes:
- To provide the Service: Syncing your CRM contacts, generating AI-powered follow-up drafts, creating deliverables, and sending messages through your GHL integration.
- To improve AI output quality: Using your voice calibration, knowledge library, and toolkit configurations to generate drafts that match your communication style.
- To process billing: Managing your subscription, tracking AI credit usage, and processing payments through Stripe.
- To send transactional communications: Sending you service-related emails such as welcome messages, trial reminders, billing alerts, and account notifications via our email provider (Resend). Only your email address and first name are shared with Resend for this purpose.
- To maintain and improve the Service: Monitoring performance, diagnosing errors, and ensuring system reliability.
- To enforce our Terms of Service: Detecting and preventing misuse, fraud, or violations of our acceptable use policies.
We do not sell your personal information. We do not use your data for advertising purposes. We do not share your data with third parties for their own marketing.
3. Third-Party Services and Data Sharing
Orbit Velocity relies on several third-party services to operate. The following table describes what data is shared with each service and why:
| Service | Data Shared | Purpose |
|---|---|---|
| Anthropic (Claude API) | Contact name, conversation history, org knowledge, voice calibration, prospect profile data | AI draft generation and deliverable content creation |
| GoHighLevel API | Your GHL API key and Location ID; outbound email content when you click "Send" | CRM data sync and email delivery on your behalf |
| Stripe | Email, organization name, subscription status | Payment processing and billing management |
| Resend | Email address, first name | Transactional email delivery (welcome, billing, alerts) |
| Firebase (Google) | Email, user ID, authentication tokens | User authentication |
| Google Cloud SQL | All application data | Database hosting (encrypted at rest) |
| Google Cloud Storage | Deliverable assets (HTML files, PNG screenshots) | Storage and public hosting of generated deliverables |
| Google Cloud Run | All request data | Application and microservice hosting |
| Fireflies.ai (optional) | Your Fireflies API key; no PII is sent by us | Retrieval of meeting transcripts |
| HeyReach (optional) | Contact LinkedIn URLs | LinkedIn profile enrichment |
3.1 Anthropic AI Data Usage
Orbit Velocity uses the Anthropic Claude API to generate AI-powered content. As an API customer, Anthropic does not use data submitted through the API to train their models by default. Data sent to Anthropic's API is processed for the purpose of generating a response and is subject to Anthropic's Privacy Policy and API Data Usage Policy. We encourage you to review Anthropic's policies directly.
3.2 Published Deliverables
When the Service generates deliverables such as personalized microsites, the rendered HTML and associated screenshots are stored in Google Cloud Storage and may be published at a public URL (e.g., under samples.orbitvelocity.com) so you can share them with your prospects. These published deliverables contain the prospect's name, company, and AI-generated marketing content. You are responsible for ensuring you have the appropriate basis to share this content with the intended recipient.
4. Data Controller and Data Processor Roles
Orbit Velocity processes CRM contact data on your behalf:
- You (the subscriber) are the data controller for the personal data of your CRM contacts. You determine the purposes and means of processing this data by choosing to connect your CRM and use the Service.
- Orbit Metrics is the data processor for your CRM contact data. We process this data solely to provide the Service to you, as described in this Privacy Policy.
You are responsible for ensuring that you have a lawful basis for processing your contacts' personal data and for complying with applicable data protection laws (such as GDPR or CCPA) with respect to the data you provide to the Service.
If you require a formal Data Processing Agreement (DPA) for compliance purposes, please contact us at support@orbitvelocity.com.
5. Data Retention
- Active accounts: Your data (CRM contacts, conversation history, AI-generated content, knowledge library, deliverables) is retained for as long as your subscription is active.
- After cancellation: When you cancel your subscription, your data is retained for 30 days to allow for reactivation or data export requests. After 30 days, your organization's data is permanently deleted from our systems, including CRM contacts, conversation history, AI-generated drafts, deliverables, and stored API keys.
- API keys: Integration API keys (GHL, Fireflies, HeyReach) are deleted immediately when you disconnect an integration or when your organization data is purged.
- Published deliverables: Publicly hosted deliverable assets (microsites, screenshots) are removed during the data purge process after account cancellation.
- Logs: Application logs are retained according to Google Cloud's default retention policies (typically 30 days for request logs).
6. Data Security
We implement the following security measures to protect your data:
- Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS (HTTPS).
- Encryption at rest: All data stored in Google Cloud SQL is encrypted at rest using Google-managed encryption keys.
- Authentication: User authentication is managed by Firebase Authentication. Orbit Velocity does not store passwords directly.
- API key storage: Third-party API keys (GHL, Fireflies, HeyReach) are stored encrypted in our database and are never included in application logs.
- Multi-tenant isolation: All data is scoped to your organization. Database queries enforce organization-level access controls to prevent cross-tenant data access.
- Secrets management: Sensitive configuration values (database credentials, API keys, signing keys) are stored in Google Cloud Secret Manager, not in application code or environment variables.
- Infrastructure security: The Service runs on Google Cloud Run with Google Cloud's infrastructure security controls, including network isolation, DDoS protection, and regular security patching.
7. Your Rights
Depending on your jurisdiction, you may have the following rights regarding your personal data:
- Access: You may request a copy of the personal data we hold about you and your organization.
- Correction: You may request that we correct inaccurate or incomplete personal data.
- Deletion: You may request that we delete your account and all associated data. We will process deletion requests within 30 days.
- Data portability: You may request an export of your data in a structured, commonly used format.
- Restriction of processing: You may request that we limit the processing of your data in certain circumstances.
- Objection: You may object to certain types of data processing.
To exercise any of these rights, please contact us at support@orbitvelocity.com. We will respond to your request within 30 days.
7.1 California Residents (CCPA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):
- The right to know what personal information we collect, use, and disclose.
- The right to request deletion of your personal information.
- The right to opt out of the sale of your personal information. We do not sell personal information.
- The right to non-discrimination for exercising your CCPA rights.
7.2 European Economic Area Residents (GDPR)
If you are located in the European Economic Area, our legal basis for processing your personal data depends on the context:
- Contract performance: Processing necessary to provide the Service you have subscribed to.
- Legitimate interest: Processing necessary for our legitimate business interests (service improvement, security, fraud prevention), balanced against your rights.
- Consent: Where applicable, we rely on your consent (e.g., optional integrations you choose to enable).
You may contact your local data protection authority if you believe your rights have not been adequately addressed.
8. Children's Privacy
Orbit Velocity is a business-to-business service designed for sales professionals. We do not knowingly collect personal information from anyone under the age of 18. If we become aware that we have collected personal data from a child, we will take steps to delete that information promptly.
9. International Data Transfers
Orbit Velocity's infrastructure is hosted in the United States (Google Cloud, us-central1 region). If you are accessing the Service from outside the United States, your data will be transferred to and processed in the United States. By using the Service, you consent to this transfer. We rely on Google Cloud's data processing terms and standard contractual clauses where applicable to ensure adequate protection for international data transfers.
10. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we make material changes, we will:
- Update the "Last updated" date at the top of this page.
- Notify you via email (to the address associated with your account) or through a notice within the Service.
Your continued use of the Service after any changes take effect constitutes your acceptance of the revised Privacy Policy. We encourage you to review this page periodically.
11. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:
Orbit Metrics
Email: support@orbitvelocity.com
Product: Orbit Velocity (orbitvelocity.com)