Orbit ("Platform", "we", "us") is committed to protecting your personal information. This Privacy Policy explains what data we collect, how we use it, and your rights under the Personal Information Protection Law of the People's Republic of China (PIPL) and other applicable regulations.
By using the Platform, you consent to the practices described in this policy. If you do not agree, please do not use the Platform.
1. Data We Collect
Account Information
- Email address or mobile phone number (used for authentication);
- Display name (optional, set by you);
- Account creation timestamp and last login timestamp.
API Usage Data
- API key identifiers (not the key value itself after creation);
- Request metadata: model ID, token counts (input/output), latency, status code, and cost;
- Timestamps of API calls.
Billing Data
- Credit balance and transaction history (top-ups, deductions);
- Account tier (Free, Basic, Pro).
Technical Data
- IP address (logged for security and abuse prevention);
- Browser/client user-agent strings.
2. Data We Do Not Persistently Store
We do not permanently store the content of your API prompts (inputs) or model-generated responses (outputs). These are forwarded to the upstream provider in real time and are not retained in our databases after the API call completes.
We do not collect payment card numbers or other financial instrument details. Credit top-ups are handled through separate channels.
3. How We Use Your Data
- Service delivery: To authenticate your account, issue API keys, route requests to model providers, and return responses.
- Billing: To track credit consumption, generate usage reports visible in your console, and process top-up transactions.
- Analytics: To generate aggregated, anonymised usage statistics that help us improve the Platform. Individual usage data is not shared with third parties for analytics purposes.
- Security and abuse prevention: To detect unusual usage patterns, enforce rate limits, and protect the integrity of the Platform.
- Communications: To send you service notifications, billing alerts, and (with your consent) product updates via your registered contact method.
4. Third-Party Sharing
AI model providers: When you make an API call, your prompt content is forwarded to the selected model provider (e.g., DeepSeek, Qwen, Moonshot). We do not attach your personally identifiable information (PII) — such as your email, phone number, or account ID — to these forwarded requests. Each provider has its own privacy policy governing how they handle inputs.
Infrastructure providers: We use Alibaba Cloud services (computing, databases, storage) hosted in the China (mainland) region. Alibaba Cloud processes data on our behalf under appropriate data processing agreements.
We do not sell, rent, or trade your personal information to third parties for marketing purposes. We do not transfer your data outside the People's Republic of China except where required to route requests to providers that operate cross-border, and only to the minimum extent necessary.
We may disclose personal information if required by law, regulation, court order, or government authority.
5. Data Storage and Security
Your data is stored on Alibaba Cloud infrastructure located in the China (mainland) region. We implement reasonable technical and organisational measures to protect your personal information against unauthorised access, disclosure, alteration, or destruction, including:
- Encryption of data in transit via TLS;
- Hashed storage of passwords (we never store plaintext credentials);
- API keys are shown only once at creation and not stored in recoverable form;
- Row-level security policies on database access.
No security system is impenetrable. In the event of a data breach that affects your rights and interests, we will notify you in accordance with applicable law.
6. Data Retention
Account information and billing records are retained for the lifetime of your account and for a period required by applicable law after account closure (typically 3 years for financial records under PRC law).
API usage metadata (token counts, model, cost, timestamp) is retained for up to 12 months and then aggregated or deleted.
7. Your Rights Under PIPL
Under the Personal Information Protection Law of the People's Republic of China (PIPL), you have the following rights with respect to your personal information:
- Right to access: You may request a copy of the personal information we hold about you.
- Right to correction: You may update or correct inaccurate personal information via the Settings page or by contacting us.
- Right to deletion: You may request deletion of your personal information. You can initiate account deletion from the Settings page. We will delete your data within the timeframes required by law.
- Right to portability: You may request a machine-readable export of your personal information.
- Right to withdraw consent: Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of prior processing.
- Right to explanation: You may request an explanation of the rules governing our automated processing of your personal information.
To exercise these rights, please contact us using the information below. We will respond within 15 business days.
8. Cookies and Session Storage
We use cookies and local storage solely for authentication session management (keeping you logged in) and locale preferences (language selection). We do not use third-party tracking cookies or advertising cookies.
9. Minors
The Platform is not directed at persons under 18 years of age. We do not knowingly collect personal information from minors. If you believe a minor has registered, please contact us and we will take appropriate action.
10. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via the Platform console or your registered contact method. Continued use of the Platform after changes take effect constitutes acceptance of the revised policy.
11. Contact Us
For privacy-related inquiries, to exercise your rights, or to report a concern, please contact us through the Platform console or via the contact information published on our website. We have designated a personal information protection officer responsible for overseeing compliance with this policy.