Orbiton Inc. ("Orbiton", "we", "us", or "our") is a San Francisco based company that provides investor relations technology, including AI-powered chatbot, research workspace, and analytics tools, to public companies and their stakeholders. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you interact with an Orbiton-powered chatbot, widget, website, research workspace, or related service.

In many cases, Orbiton provides its services on behalf of a public company customer. Where we process personal information on behalf of that customer, we act as a service provider or processor. Where we operate our own website, administer our services, or manage business relationships, we may act as an independent controller.

Information We Collect

Depending on how you use the service, we may collect the following categories of information:

• Chat content: questions, messages, feedback, and other information you submit through the chatbot or research workspace.
• Contact information: name, email address, investor type, company name, or similar details if you choose to provide them.
• Account information: if you create an account, your email address and authentication credentials, plus your saved preferences such as watchlists and conversation history.
• Technical information: IP address, browser type, device type, operating system, referring page, pages visited, timestamps, and general location derived from IP address.
• Usage and analytics information: chatbot interactions, session activity, clicks, preferences, and diagnostic information used to improve reliability and product performance.
• Cookies and local storage: identifiers and preferences used to maintain chat continuity, remember settings, and understand usage of the service.

Account Sign-In Data (Google and Microsoft)

If you choose to sign in with Google or Microsoft, we receive only your basic profile information from that provider: your name, email address, and profile picture. We use this information solely to create and authenticate your Orbiton account, associate your saved watchlist and conversation history with it, and communicate with you about the service. We do not request access to your contacts, files, calendar, email content, or any other provider data, and we do not sell this information or share it with third parties except as described in this policy. You can delete your account and associated data at any time by contacting us at privacy@orbitonfinancial.com. Orbiton's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How We Use Information

We use personal information for the following purposes:

• To provide, operate, maintain, and improve the chatbot, research workspace, and related services.
• To respond to questions and generate relevant investor relations responses.
• To maintain chat history, session continuity, preferences, watchlists, and user profiles where applicable.
• To provide analytics and usage insights to our public company customers.
• To detect, prevent, investigate, and address fraud, abuse, security incidents, technical issues, and service misuse.
• To comply with legal obligations and enforce our agreements.
• To communicate with you if you request updates, submit contact information, or otherwise ask us or our customer to follow up.

AI Processing

The service uses third-party artificial intelligence providers to generate responses. Chat messages you submit, together with relevant context (such as public company disclosures and your conversation history), are processed by our AI subprocessors — OpenAI (conversational language models and stored conversation state) and Anthropic (certain document- and image-analysis features) — solely to provide the service, improve safety and reliability, and support product functionality, subject to contractual restrictions and applicable law. Under our API agreements with these providers, your chat content is not used to train their models. These providers may temporarily retain API inputs and outputs (typically for up to 30 days) for abuse and misuse monitoring in accordance with their own policies; that short-term retention is controlled by the provider, not by Orbiton. You should not submit sensitive personal information, confidential information, material non-public information, account credentials, or information you are not authorized to share. Responses generated by the service are for informational purposes only and do not constitute financial advice.

How We Share Information

We may share information with:

• Our public company customers: so they can understand investor questions, respond to inquiries, manage communications, and improve their investor relations programs.
• Service providers and subprocessors: including hosting, database, analytics, monitoring, communications, security, and AI infrastructure providers that help us provide the service.
• Professional advisors: such as legal, accounting, security, or compliance advisors.
• Authorities or third parties when legally required: if necessary to comply with law, legal process, or valid governmental requests, or to protect rights, safety, and security.
• Business transaction parties: in connection with a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate confidentiality protections.

Cookies, Local Storage, and Analytics

We use cookies, local storage, and similar technologies to operate the service, remember preferences, maintain sessions, measure usage, and improve the service. Your browser may allow you to block or delete these technologies, but some features may not function properly without them.

Data Retention

We retain personal information only for as long as needed for the purposes described in this policy, and no longer than the maximum periods below, unless a longer period is required by law or needed to resolve disputes, enforce agreements, or maintain security:

• Chat conversations: your messages and the AI responses are retained for up to 24 months after your last activity in the conversation, unless you request earlier deletion.
• Anonymous visitor profiles and usage analytics: visitor identifiers, technical information, and activity events are retained for up to 13 months after your last visit, after which they are deleted or de-identified.
• Contact information you submit (for example to receive updates, request a meeting, or be notified when a feature is ready): retained while relevant to your request, and no longer than 24 months after your last interaction, unless you ask us or the relevant company to remove it sooner.
• Presentation sessions and private notes: retained for up to 24 months after your last activity, unless you request earlier deletion.
• Account information: retained for as long as your account exists and deleted when your account is deleted, except where limited records must be kept by law.
• Consent and deletion records: retained for up to 5 years to document compliance with legal obligations.
• Technical and security logs: retained for up to 90 days.

AI provider copies: conversation content processed by our AI subprocessors is also stored by the provider to maintain conversation continuity. When you request deletion of your data, we delete your conversations from our systems and request deletion of the corresponding stored conversation data from our AI provider. Conversation data held by AI providers is otherwise subject to the provider's own retention policies, and providers may retain copies for a limited period (typically up to 30 days) for abuse and misuse monitoring; those provider-side periods are controlled by the provider, not by Orbiton.

Security

We implement technical and organizational measures designed to protect personal information, including access controls, environment-based secret management, encrypted transmission, monitored infrastructure, logging and error monitoring, dependency management, and least-privilege operational practices. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

International Transfers

Orbiton is based in the United States, and information may be processed in the United States and other jurisdictions where we, our customers, or our service providers operate. Where required, we use appropriate safeguards for international transfers.

Your Privacy Rights

Depending on your location, you may have rights to request access, correction, deletion, portability, restriction, objection, or withdrawal of consent regarding your personal information. You may also have the right to appeal a decision or lodge a complaint with a data protection authority.

You can also act directly: where the chat widget or chat page offers privacy controls, you may withdraw your consent to tracking and request deletion of your conversations and associated data from within the chat experience, at any time and without affecting your ability to keep using the chat. Deletion covers our systems; the treatment of copies held by our AI providers is described in "Data Retention".

If you interacted with an Orbiton chatbot on behalf of a public company, we may refer your request to that company or coordinate with them as appropriate. To submit a privacy request, contact us at privacy@orbitonfinancial.com.

Children

The service is intended for business and investor relations purposes and is not directed to children. We do not knowingly collect personal information from children under the age required by applicable law.

Data Processing Agreements

For public company customers and enterprise partners, Orbiton can enter into a Data Processing Agreement covering processor obligations, security commitments, subprocessors, international transfer safeguards, assistance with data subject requests, and other applicable data protection requirements.

Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the effective date and provide additional notice where required by law.

Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us at privacy@orbitonfinancial.com.