Privacy Policy

Last updated: 30 October 2026

1. Who we are and how to contact us

Orbis Social is a business-to-business social media management service operated by Orbis Digital Ltd, a private limited company registered in England and Wales (company number 17116737). Our registered office is 66 Paul Street, London, EC2A 4NA. In this policy, "we", "us" and "our" mean Orbis Digital Ltd.

This policy explains how we handle personal data on our website (orbissocial.co.uk) and in our application (app.orbissocial.co.uk). It is written to meet the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (both as amended by the Data (Use and Access) Act 2025) and the Privacy and Electronic Communications Regulations 2003 (PECR).

Contact us about privacy at support@orbisdigital.co.uk or on 0330 223 7919. To disconnect an account or request deletion, see our data deletion page.

2. Controller and processor roles

We are the controller for: account holders' and users' data; billing records; support enquiries; website contact-form enquiries; security and audit logs that we use to run the service; and marketing to business contacts.

We are a processor for the content that customers put into Orbis Social, including posts, captions, media, Brand Brain content, ideas and comments, and for any personal data in that content. The customer is the controller of that data, and our Data Processing Agreement applies. If you have a question about a customer's content, please contact that customer first.

3. The personal data we collect

• Account and user data: names, business email addresses, phone numbers, business details, roles and login and security data.
• Usage and technical data: IP addresses, browser information, and activity logs, including the audit log.
• Customer content: the posts, media, Brand Brain content, comments and ideas that users add.
• Enquiries: what you tell us through our contact form, by email or by phone.
• Billing records: where you are billed, the records needed to do so. This includes your plan, billing email, subscription status and invoices. Card details are entered directly with Stripe, and we never see or store full card numbers.
• Data from Facebook and Instagram: see section 4.

4. Data from Facebook and Instagram

Customers can connect Facebook Pages and Instagram professional accounts to Orbis Social through Meta's permission screens. We do not support personal profiles. When a customer connects an account, we access:

• Page and Instagram account details, such as the account's name, identifier and profile picture, so that the customer can select the account and see where a post will go.
• Access tokens issued by Meta, which let us publish on the customer's instruction. They are encrypted at rest.
• Content that customers publish through Orbis Social, with information about whether publication succeeded.

We use this data only to provide the service to the customer: to connect accounts, schedule and publish content, and show publishing status and failures. We do not sell it, and we do not use it for advertising.

Disconnecting and deletion. Customers can disconnect an account at any time in Orbis Social or through their Facebook or Instagram settings, and can ask us to delete data by email. Our data deletion page explains how. Meta's own use of data is covered by Meta's privacy policy.

5. AI features

When a user uses AI writing, caption refinement, the brand-rule check or AI campaign plans, we send the relevant content, such as the prompt, draft caption and Brand Brain content, to OpenAI, our AI model provider, to generate a result. Please avoid including unnecessary personal data in this content.

AI output can be inaccurate. These features produce suggestions for people to review and do not make decisions with legal or similarly significant effects on individuals.

6. How we use data and our lawful bases

7. Direct marketing and PECR

We may send business contacts information about Orbis Social and related Orbis Digital services where the law allows. You can opt out at any time using the link in the message or by emailing us. You have an absolute right to object to direct marketing.

8. Who we share data with

We use these suppliers, who act on our instructions:

• OVHcloud (OVH SAS): server hosting, in a data centre in Gravelines, France.
• Meta Platforms: when a customer publishes, we send content to Facebook and Instagram. Meta then handles it as an independent controller under its own terms.
• OpenAI: our AI model provider, to generate AI suggestions, as described in section 5.
• Brevo (Sendinblue SAS), France: transactional email and website contact-form emails.
• Cloudflare, Inc.: DNS and, where enabled, a security and content delivery proxy, which may process IP addresses.
• Google LLC: Google Fonts on our website and application. Google receives the visitor's IP address when fonts load. No cookies are set.
• Stripe Payments Europe Ltd / Stripe, Inc.: our card payment provider. Stripe processes payment details, billing contact details and subscription records to take payments, prevent fraud and meet its legal obligations.

We may also share data with professional advisers, or where the law requires it. We do not sell personal data. We do not use advertising or tracking pixels.

9. International transfers

Our hosting is in the European Economic Area, which the UK recognises as adequate. Some suppliers may process data in the United States or elsewhere. Where they do, we rely on UK adequacy regulations, including the UK extension to the EU-US Data Privacy Framework, or on the UK International Data Transfer Addendum or Agreement, as applicable.

10. How long we keep data

11. How we protect data

We use technical and organisational measures appropriate to the risk, including encrypted connections (HTTPS), encryption of access tokens at rest, role-based access, audit logging and access-restricted backups. No system is completely secure, and you should keep your own login details safe.

12. Your rights

You have rights to access, rectify and erase your personal data, to restrict or object to its use, to data portability, and rights related to automated decisions. These rights have limits in some situations. They are normally free to use, and we will respond within one month, or up to two months longer for complex requests. We may need to confirm your identity. To use your rights, email support@orbisdigital.co.uk. If your request concerns content controlled by a customer, we may refer you to that customer.

13. Children

Orbis Social is for businesses and is not for anyone under 18. We do not knowingly collect children's data for our own purposes. Customers are responsible for any data about children in their own content.

14. Complaints

Please tell us first if you have a data protection complaint, by emailing support@orbisdigital.co.uk. We will acknowledge it within 30 days and respond without undue delay. You can also complain to the ICO (or its successor, the Information Commission) at ico.org.uk or on 0303 123 1113.

15. Changes to this policy

We may update this policy, and we will show the new date at the top. We will tell customers about material changes by email or in the application.