Privacy

Privacy Policy

Last updated: 5 May 2026 · Effective: 5 May 2026

1. Who is responsible

The data controller for personal data processed in connection with Orbit One is:

SuddenPeak GmbH
Hardturmstrasse 5
8005 Zürich, Switzerland
Commercial register / UID: CHE-163.895.734
Email: [PRIVACY_EMAIL]

For users in the European Economic Area, our designated representative under Article 27 GDPR is [EU_REPRESENTATIVE_NAME], [EU_REPRESENTATIVE_ADDRESS], [EU_REPRESENTATIVE_EMAIL].

You can reach our data protection contact at [DPO_EMAIL].

2. What data we process

Depending on how you use Orbit One, we process the following categories of personal data:

We do not knowingly collect special categories of personal data (such as data about health, religion, or political views). Please do not upload such data to Orbit One unless we have explicitly agreed otherwise in writing.

3. Why we process it

• Provide the service: create and secure your account, deliver the features you request, sync your content, and provide customer support.
• Billing: process subscription payments, prevent fraud, issue invoices, and meet our accounting obligations.
• Product improvement: understand how Orbit One is used, fix bugs, run privacy-respecting analytics, and prioritise improvements.
• Communications: send transactional emails (e.g. password resets, billing receipts) and, with your consent, product updates and marketing.
• Security and abuse prevention: detect, investigate, and prevent fraudulent or unlawful activity and enforce our Terms of Service.
• Legal compliance: comply with applicable laws, court orders, and lawful requests from authorities.

4. Legal basis

Under the GDPR (and the equivalent grounds under the revFADP), we rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b) GDPR) — to provide the service, manage your subscription, and provide support.
• Legitimate interests (Art. 6(1)(f) GDPR) — to keep the service secure, prevent abuse, run minimal analytics, and develop the product. We balance these interests against your privacy interests.
• Consent (Art. 6(1)(a) GDPR) — for non-essential cookies, marketing emails, and any optional processing. You can withdraw consent at any time.
• Legal obligation (Art. 6(1)(c) GDPR) — for tax, accounting, and other statutory record-keeping.

5. Sharing and sub-processors

We share personal data only with service providers that help us run Orbit One. Each provider acts as a processor under our written instructions, on the basis of a data processing agreement. Our current sub-processors are:

We may also share personal data with professional advisors (lawyers, auditors, tax consultants) bound by confidentiality, with public authorities when legally required, and with a successor entity in the event of a merger, acquisition, or asset sale. We will inform you in advance where required by law.

An up-to-date list of sub-processors is available on request at [PRIVACY_EMAIL].

6. International transfers

Some of our sub-processors are located outside Switzerland and the European Economic Area, in particular in the United States. Where we transfer personal data to such countries, we rely on:

• Adequacy decisions issued by the Swiss Federal Council and / or the European Commission, where available (e.g. the EU–U.S. Data Privacy Framework and its Swiss extension);
• Standard Contractual Clauses approved by the European Commission, with the Swiss adaptations published by the Federal Data Protection and Information Commissioner (FDPIC); and
• Additional safeguards such as encryption in transit and at rest, pseudonymisation, and access controls.

You may request a copy of the relevant transfer mechanism by contacting [PRIVACY_EMAIL].

7. How long we keep data

8. Security

We use technical and organisational measures appropriate to the risk, including encryption in transit (TLS) and at rest, role-based access control, audit logging, regular backups, secure development practices, and provider-side controls from our sub-processors. No system is completely secure, and we cannot guarantee absolute security.

If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware of it (GDPR Art. 33; revFADP Art. 24), and we will notify affected users without undue delay where the risk is high.

8a. Automated decision-making and AI processing

Orbit One is an AI-driven validation platform. When you submit an idea, a draft experiment, or a survey for analysis, we send the text content to third-party large-language-model APIs to generate a validation output. Today these AI sub-processors are:

• OpenAI — API processing only; OpenAI does not use API inputs to train its models, and retains inputs for up to 30 days for abuse-monitoring (Zero Data Retention may be available on request);
• Anthropic — API processing only; Anthropic does not use API inputs to train its models, and applies a standard retention window described in its Trust Center.

Both providers act as our processors under Art. 28 GDPR. We have data processing agreements (DPAs) and Standard Contractual Clauses in place where required.

AI-generated outputs are statistical inferences, not professional, legal, financial, or investment advice. We do not currently take decisions that produce legal effects on you solely by automated means within the meaning of Art. 22 GDPR. You always retain control of the decision to act on a verdict, recommendation, or score. You may request a human review of any AI-generated output, or an explanation of how an output was produced, by emailing [PRIVACY_EMAIL].

You can withdraw your idea from AI processing at any time by deleting the project; deletion removes the content from our systems and instructs our AI sub-processors to delete copies in accordance with their retention windows.

9. Cookies and tracking

We use a small number of strictly necessary cookies to run the site, plus optional cookies for analytics and marketing that load only after you give consent through our cookie banner. See our Cookie Policy for the full list and instructions on how to change your preferences.

10. Your rights

Subject to the conditions of the revFADP and the GDPR, you have the right to:

• request information about the personal data we process about you (right of access);
• have inaccurate data corrected (right to rectification);
• have your data deleted (right to erasure / "to be forgotten");
• restrict or object to certain processing;
• receive your data in a portable, machine-readable format (data portability);
• withdraw consent at any time, without affecting prior processing;
• not be subject to a decision based solely on automated processing that produces legal effects on you (see section 8a — we generate AI outputs but the decision to act on them is always yours; you can request human review at any time);
• lodge a complaint with a supervisory authority — in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch); in the EU, your local data protection authority.

To exercise any of these rights, email [PRIVACY_EMAIL]. We will respond within 30 days. We may need to verify your identity before acting on your request.

11. Children

Orbit One is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top will reflect the latest version. If the changes are material, we will notify you by email or by a notice in the product before they take effect.

13. Contact

For any privacy question or to exercise your rights, contact us at [PRIVACY_EMAIL] or by post at the address listed in section 1.