Privacy Policy
Last updated November 3, 2026
This explains, in plain language, what Orbit collects, why, who else handles it, and the choices you have.
1. Who we are and what this covers
Orbit is a business workspace run by Moonlight Productions LLC. This policy explains what information Orbit collects, why, who else handles it, and the choices you have. It covers the people who have an Orbit account (business owners and their teams) and the clients and contacts of those businesses whose details are stored in Orbit.
There are two roles. For your own account we decide how your information is used. For the details of a business's clients (names, emails, projects, invoices, contracts, messages), the business decides how they are used and we handle them on the business's behalf. If you are a client of a business that uses Orbit and have a question about your details, please ask that business first.
2. What we collect
- Account details: your name, email address, and a password (stored only as a one-way scrambled hash, never in readable form). If you sign in with Google, we receive your name, email address and Google account ID.
- Your business details: business name, logo, address, tax and payment details you choose to show, settings, and team members you invite.
- Your work: clients, leads, projects, notes, files and photos, tasks, bookings, contracts and signatures, invoices and estimates, budgets, messages, and everything else you or your clients enter.
- What your clients enter: for example a booking form, contact form, questionnaire answers, comments on a review, photo favourites, and the name they type when they sign or accept something.
- Technical details: the internet address and browser of a sign-in, of a contract signing, and of public links being opened, kept for security, abuse limits and signing records. Orbit does not use advertising or analytics trackers.
- Payments: card details are entered with Stripe and never reach Orbit. We keep the payment's amount, status and reference.
- Email we send for you: the messages Orbit emails on your behalf and to you (invitations, links, notices), and whether sending worked.
3. How we use it
- To run Orbit: show you your workspace, send the invoices, links and emails you ask for, take bookings, record signatures and payments, and show your clients their pages.
- To keep Orbit safe: sign-in protection, rate limits, preventing abuse, and investigating problems.
- To email you things you need: confirming your address, password resets, security notices, and notices about activity in your workspace.
- To improve and fix Orbit, using what we see in our own logs. We do not sell your information, and we do not use it for advertising.
4. Google sign-in and Google Calendar
If you choose Sign in with Google, we use your Google name and verified email address to create your account or sign you in. If you choose to connect Google Calendar, Orbit asks for two permissions on the Google account you connect: calendar.events (to add a booking as an event, with a Google Meet link when you ask for one) and calendar.freebusy (to see when you are busy so people can't book those times). Orbit uses your primary calendar, does not read the details of your other events, and uses this access only to offer those two features inside Orbit. The connection's refresh token is stored encrypted. You can disconnect at any time in Orbit's settings or from your Google account's security page.
Orbit's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We do not use Google user data for advertising, we do not sell it, and no person at Orbit reads it except where needed for security, to follow the law, or with your permission.
6. Other sharing
A business decides what its clients see, such as an invoice, a contract, a portal or a gallery link. Anyone with a private link can open what the link shows, so share links carefully; you can turn a link off or make a new one in Orbit.
We may also share information if the law requires it, to protect people's safety or Orbit's security, or if Orbit is sold or merged (we would tell you first).
8. How long we keep it
We keep your information while your account is open. When a business closes its account, we delete its workspace data, except what we must keep to follow the law or settle disputes, and ordinary backups that expire on their own schedule. Signed contracts and invoices are records your business may need, so please download what you need before closing.
9. How we protect it
Each business's information is kept separate from other businesses', passwords are hashed, sign-in links and invitations are stored hashed and expire, Google connection tokens are encrypted, and sign-in attempts are rate limited. No system is perfectly secure; if something happens that affects your information, we will tell you as the law requires.
10. Your choices and rights
You can see and change much of your information in Orbit. You can ask us to give you a copy of your information, correct it, or delete it, and to close your account. Depending on where you live, you may have further rights under the law, for example to object to or limit certain uses, or to complain to a data protection authority. If you are a business's client, please ask that business too. Write to us at orbit@moonlightmedia.space.
11. Children
Orbit is for businesses and is not meant for people under 18. We do not knowingly collect information from children.
12. Where your information is handled
Our providers may handle information in the United States and other countries. We choose providers that protect it and we ask them to handle it only for the purpose of running Orbit.
13. Changes and contact
If we change this policy in a way that matters, we will tell you before it applies to you and update the date on this page. Write to us at orbit@moonlightmedia.space.
See also our Terms of Service.