1. Parties and roles

These terms are between the customer who holds an Orbit Cue workspace (“you”) and Infinity Consciousness Europe SIA, registration number 50203642241, Vēja iela 4 – 2, Ādaži, Ādažu novads, LV-2164, Latvia (“Orbit Cue”).

For account, billing, and security records, Orbit Cue is the controller. For captions, media, channel tokens, and other content you submit so that Orbit Cue can publish or store it, you are the controller and Orbit Cue is the processor under GDPR Article 28. A countersigned copy is available on request at hello@orbitcue.app.

2. Instructions

Orbit Cue processes customer content only to provide the service you configure: storing drafts, scheduling, publishing to channels you connect, and showing that activity back to your workspace. A written support request from a workspace owner or admin is an additional instruction.

3. Security, people, and subprocessors

OAuth tokens and integration secrets are encrypted with AES-256-GCM before storage.
Workspace data is isolated with Postgres row-level security.
People who can operate the platform are limited to an allowlist of confirmed email addresses.
Subprocessors are Supabase (database and authentication, EU Frankfurt), Vercel (hosting), Paddle (payments), and, only when you or Orbit Cue turns it on, OpenAI or Anthropic for writing assistance. The social networks you connect receive the posts you choose to publish.
Transfers outside the EEA use an adequacy decision or Standard Contractual Clauses.

4. Assistance, deletion, and breaches

Orbit Cue helps you answer requests from people whose data is in content you control, using the export and deletion tools in the product or a request to hello@orbitcue.app.
Disconnecting a channel deletes its stored tokens. Closing a workspace removes its active content, except records Orbit Cue must keep as controller for tax law.
If Orbit Cue becomes aware of a personal-data breach affecting customer content, it notifies you without undue delay and, where Article 33 requires it, the Latvian Data State Inspectorate within 72 hours of becoming aware.

5. Audits

Once a year, or after a confirmed breach affecting your content, you may ask for a written description of the controls on this page and the current subprocessor list. On-site audits are limited to what is reasonable for a multi-tenant service and must not expose another customer’s data.