Privacy Policy

Overview

Orbeno is a reputation management platform that helps businesses collect, analyze, and respond to customer feedback from Google Business Profile, Facebook, and Instagram. This policy explains what personal information we collect when you use Orbeno, how we use that information, and the choices you have about your data.

This policy is designed to comply with applicable data protection laws including the GDPR and CCPA.

Information We Collect

We collect the following categories of personal information:

• Account information. Your email address and a hashed password used to authenticate your account. Passwords are hashed using PBKDF2 and are never stored in plain text.
• Workspace content. Data you create within your workspace, including team member assignments, locations, alert configurations, and workspace preferences.
• Third-party platform data. When you connect a third-party account, we access the data you authorize — such as business information, reviews, messages, and profile data — using the permissions shown to you at the time of connection.
• OAuth tokens. Access tokens and refresh tokens for connected platforms. All tokens are encrypted using AES-GCM before storage and are used only to sync the data you authorized.
• Communications. Messages you send us through support channels or email.
• Usage data. Log data including IP address, browser type, and pages visited, collected to maintain service security and reliability.

How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain your Orbeno workspace
• Sync and display review and feedback data from connected platforms
• Generate aggregated sentiment analysis and trend reports
• Send service-related notifications and security alerts via email
• Respond to support requests and escalations
• Detect, prevent, and address security incidents and abuse

We do not sell your personal information. We do not use your data for advertising. We do not share your data with third parties except as described in the “Data Sharing” section below.

Data Sharing

We share data only in the following circumstances:

• Connected platforms. When you connect Google, Facebook, or Instagram, we access data from those platforms on your behalf. We do not share your data back to those platforms except when you explicitly use a feature (such as posting a reply) that requires it.
• Service providers. We use cloud infrastructure providers to host the service. These providers have access to data only to perform services on our behalf and are contractually bound to protect it.
• Legal requirements. We may disclose information if required by law, court order, or governmental authority.

Data Retention

• Active accounts. We retain your data for as long as your account is active.
• After deletion. When you delete your account or workspace, all associated data is permanently deleted within 30 days.
• Backups. Encrypted backups may persist for up to an additional 30 days after deletion, after which they are purged.
• OAuth tokens. When you disconnect a connected platform, we delete the associated access and refresh tokens immediately.

Data Storage & Security

• Workspace data is stored in secure cloud infrastructure with encryption at rest.
• OAuth tokens are encrypted with AES-GCM before storage.
• All data in transit is encrypted via TLS.
• Passwords are hashed using PBKDF2 with per-user salts.
• Access to production data is restricted to authorized personnel only.

Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access. Request a copy of the personal data we hold about you.
• Correction. Request that we correct inaccurate or incomplete data.
• Deletion. Request deletion of your account and all associated personal data.
• Portability. Export your workspace data in a machine-readable format.
• Disconnect. Revoke access to connected platforms at any time from within Orbeno or directly from the connected platform.
• Objection. Object to certain processing of your data.

To exercise any of these rights, contact us at inquiries@orbeno.com. We will respond within 30 days.

International Data Transfers

Orbeno is hosted in the United States. If you access Orbeno from outside the United States, your data may be transferred to and processed in the United States. By using Orbeno, you consent to this transfer.

Changes to This Policy

We may update this privacy policy from time to time. We will notify you of material changes by email or through the service at least 14 days before they take effect. The "Last updated" date at the top of this page will be revised accordingly.

Contact

For questions, concerns, or data requests, please reach us at inquiries@orbeno.com.