orbis://privacy
--:--:--
$ orbis --privacy
[boot]version=3.0 · updated=2026-08-21 · controller=solvent-globalok
#
Privacy Policy
>
This Privacy Policy explains how Solvent Global Ltd collects, uses, discloses, and retains personal data in connection with the Orbis platform, and the rights available to individuals whose data we hold. It applies to our website, the Orbis application, and the business contact data that Orbis surfaces to its customers. It should be read alongside our Terms of Service.
controllerSolvent Global Ltdversion3.0updated2026-08-21contactprivacy@orbis.run
──index────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
SEC.01
Who we are
controller.md
- legal entity
- Solvent Global Ltd
- company number
- 15003424
- jurisdiction
- England and Wales
- registered office
- 100 Bishopsgate, 19th Floor
- city
- London, EC2N 4AG
- privacy contact
- privacy@orbis.run
- legal contact
- legal@orbis.run
>
Solvent Global Ltd ("Solvent Global", "we", "us", "our") operates the Orbis platform. We are the controller of the personal data described in this policy except where we act as a processor on behalf of a customer, as set out in SEC.02.
SEC.02
Scope and roles
>
2.1 Controller. We act as controller for: personal data about our website visitors; personal data about the individuals who register for, administer, and use an Orbis account; billing contact data; and the business contact data we compile from third-party and public sources and make available within the platform.
>
2.2 Processor. We act as a processor for personal data that a customer uploads, imports, or otherwise instructs us to process on its behalf — including customer-supplied contact lists, campaign copy, and the content of replies received in the customer's own mailboxes. For that data the customer is the controller, determines the purposes and means of processing, and is responsible for holding a lawful basis. We process it only on documented instructions, which for most customers are the instructions given through the product itself.
>
2.3 Data processing terms. Customers requiring a signed data processing agreement, standard contractual clauses, or a completed security questionnaire should email legal@orbis.run. We will provide our standard DPA on request.
SEC.03
Data we process
>
The categories of personal data we process, and the typical fields within each, are:
-Account data — name, work email address, hashed authentication material and one-time codes, workspace and role, product preferences, and support correspondence.
-Business contact data — the name, business email address, job title, employer, employer domain, publicly stated professional information, and derived match or fit signals of individuals in their professional capacity.
-Campaign and messaging data — the sequences, subject lines, and message bodies generated or edited for a customer, sending timestamps, delivery and bounce results, opens and replies where recorded, and the content of replies received into a connected mailbox.
-Sending infrastructure data — connected mailbox identifiers, sending domain and authentication configuration, warm-up state, and deliverability telemetry.
-Billing data — company billing details, plan and budget settings, credit balances, per-send charge records, invoices, and payment-method status. Full card numbers are handled by our payment processor and are never stored by us.
-Usage and device data — pages viewed, feature interactions, IP address, browser and device type, approximate location derived from IP, timestamps, and diagnostic logs and error traces.
>
We do not seek to collect special category data (such as health, biometric, political, religious, or trade union data), government identifiers, or payment card numbers, and we do not knowingly process them. Customers must not upload such data to Orbis.
SEC.04
Where data comes from
-Directly from you — when you create an account, configure the product, contact us, or make a payment.
-Automatically — from your use of the website and application, through server logs and product telemetry.
-From our customers — where a customer uploads or imports its own contacts and instructs us to process them.
-From third-party data providers and public sources — business directories, company websites, professional profiles, corporate registries, and licensed enrichment, discovery, and email-verification providers, in each case relating to individuals in their professional capacity.
>
Where we obtain business contact data indirectly, we rely on the transparency provisions of Article 14 UK GDPR and, where an individual is in scope, this policy together with the identification of Solvent Global in outreach and the removal mechanism in SEC.12 constitutes the information provided to that individual.
SEC.05
Purposes and lawful bases
>
5.1 Providing the Service — to create and administer accounts, authenticate users, run discovery, verification, drafting, sending, and reporting, and provide support. Lawful basis: performance of a contract with the customer, or our legitimate interests in operating the platform where the individual is not a party to that contract.
>
5.2 Compiling and supplying business contact data — to build, verify, and maintain the professional-contact records surfaced within the platform. Lawful basis: legitimate interests in operating a business-to-business data and outreach service, balanced against the interests and rights of the individuals concerned. In performing that balancing we limit ourselves to professional-capacity data, exclude special category data, restrict use through our Terms, provide a free removal mechanism, and honour removals across the platform.
>
5.3 Billing and financial administration — to price, meter, charge, invoice, and collect for use of the Service, and to prevent payment fraud. Lawful basis: performance of a contract and compliance with legal obligations, including tax and accounting law.
>
5.4 Security, abuse prevention, and integrity — to authenticate access, detect and investigate misuse of the Service, protect deliverability, and defend our systems. Lawful basis: legitimate interests in keeping the Service secure and lawful, and compliance with legal obligations.
>
5.5 Service communications — to send transactional messages such as verification, billing, incident, dunning, and product notices. Lawful basis: performance of a contract and legitimate interests. These are not marketing and cannot be unsubscribed from while an account is active.
>
5.6 Marketing to businesses — to promote Orbis to business prospects. Lawful basis: legitimate interests, or consent where required by applicable e-privacy law. Every marketing message identifies us and carries a working opt-out, and we honour opt-outs promptly.
>
5.7 Product improvement — to analyse aggregate usage, diagnose faults, and improve accuracy, matching, and deliverability. Lawful basis: legitimate interests. We use aggregated or de-identified data for this purpose wherever it is sufficient. We do not use customer campaign content to train general-purpose third-party models beyond what is necessary to produce that customer's own output.
>
5.8 Legal claims and compliance — to comply with law, respond to lawful requests, and establish, exercise, or defend legal claims. Lawful basis: legal obligation and legitimate interests.
>
You may object to any processing based on legitimate interests by emailing privacy@orbis.run; where we cannot demonstrate compelling grounds that override your interests, we will stop.
SEC.06
Sharing and subprocessors
>
We do not sell personal data. We disclose personal data only in the circumstances below, and only to the extent necessary.
-To customers — business contact data surfaced through the platform is disclosed to the Orbis customer whose search or campaign matched it, subject to the use restrictions in our Terms.
-To service providers acting as our processors — under written terms that limit them to our instructions and impose confidentiality and security obligations.
-In a corporate transaction — to a buyer or successor in a merger, acquisition, financing, or asset sale, subject to this policy continuing to apply.
-For legal reasons — to regulators, courts, or law enforcement where legally required, and to our professional advisers.
>
Categories of subprocessor we currently engage:
subprocessors.md
- application hosting
- cloud application and edge hosting
- database and storage
- managed Postgres, object storage, backups
- sending infrastructure
- email sending and mailbox warm-up platforms
- email verification
- address validity and deliverability checks
- business data
- discovery and enrichment data providers
- transactional email
- notification and system email delivery
- payments
- card processing and subscription billing
- model inference
- language-model providers for drafting
- observability
- logging, error tracking, product analytics
>
A current named list of subprocessors, including entity names and processing locations, is available on request from privacy@orbis.run and is provided to customers under DPA. We will give customers notice of a material change to that list where their DPA requires it.
SEC.07
International transfers
>
We are established in the United Kingdom and our processing is concentrated in the United Kingdom, the European Economic Area, and the United States. Where personal data is transferred outside the UK or EEA, we rely on an adequacy decision where one applies, and otherwise on the UK International Data Transfer Addendum or the European Commission's Standard Contractual Clauses together with a transfer risk assessment and appropriate technical measures, including encryption in transit. You may request details of the safeguards applied by emailing privacy@orbis.run.
SEC.08
Retention
>
We keep personal data only for as long as necessary for the purposes described above, and then delete or de-identify it. Our standard periods are:
retention.md
- account data
- life of account + 12 months
- campaign & message data
- life of account + 12 months
- business contact data
- reviewed and refreshed on a rolling basis
- removal requests
- suppression record kept indefinitely
- billing & invoices
- 7 years (tax and accounting)
- security & access logs
- 12 months
- support correspondence
- 24 months
- backups
- rolling, overwritten within 35 days
>
Where we honour a removal request we retain the minimum record needed to keep that person suppressed — typically a hashed identifier — so the data is not re-acquired from a later source. Deleting an account does not delete records we are required to keep by law, and data already exported by a customer is outside our control and is that customer's responsibility.
SEC.09
Security
>
We maintain technical and organisational measures appropriate to the risk, including encryption in transit, encryption at rest for our primary datastores, row-level access controls, least-privilege and role-based internal access, secret management, audit logging of privileged actions, dependency and vulnerability scanning, environment separation, and backup and restore procedures. No system is perfectly secure; we do not warrant that our measures will prevent every incident. Where we are required to notify a personal data breach we will do so to the relevant supervisory authority and, where the risk to individuals is high, to those individuals, without undue delay. Suspected vulnerabilities should be reported to security@orbis.run.
SEC.10
Your rights
>
Subject to applicable law, you have the right to: request access to the personal data we hold about you; request rectification of inaccurate or incomplete data; request erasure; request restriction of processing; object to processing based on legitimate interests, including profiling; object at any time to direct marketing; request portability of data you provided to us; withdraw consent where processing is based on consent; and lodge a complaint with a supervisory authority.
>
To exercise a right, email privacy@orbis.run or use the removal form in SEC.12. We respond within one month of receipt, extendable by two further months for complex or numerous requests, and we will tell you if we extend. We do not charge a fee unless a request is manifestly unfounded or excessive. We may ask for information sufficient to verify that the request relates to you, and we will use that information only for verification. Where we act as a processor for a customer, we will refer your request to that customer as controller and assist them in responding.
>
If you are in the UK you may complain to the Information Commissioner's Office (ico.org.uk). If you are in the EEA you may complain to your national supervisory authority. We would ask you to raise the matter with us first so we can try to resolve it.
SEC.11
US state privacy rights
>
11.1 Notice at collection. If you are a California resident, the categories of personal information we collect, the purposes, and the retention periods are those set out in SEC.03, SEC.05, and SEC.08. The categories we disclose for a business purpose are those set out in SEC.06.
>
11.2 No sale, no cross-context behavioural advertising. We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined by the California Consumer Privacy Act as amended by the CPRA. Disclosure of business contact data to the Orbis customer whose search matched it is made as a business purpose disclosure under contract, not as a sale for monetary consideration for advertising purposes.
>
11.3 Your rights. Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and other states with comparable laws may request to know or access the personal information we hold, request correction, request deletion, obtain a portable copy, and opt out of any sale, sharing, or profiling with legal or similarly significant effects. We do not use personal information for automated decisions producing legal or similarly significant effects about an individual.
>
11.4 How to exercise and appeal. Submit requests via the form in SEC.12 or to privacy@orbis.run. We will acknowledge within 10 business days and respond within 45 days, extendable once by a further 45 days with notice. An authorised agent may submit a request with written authority and verification of the consumer's identity. We will not discriminate against you for exercising a right. If we deny a request, you may appeal by replying to our decision with the word "appeal"; we will respond to the appeal within 45 days and tell you how to contact your state attorney general.
SEC.12
Remove my data
>
Anyone can ask us to remove their personal information from Orbis, free of charge and whether or not they are a customer. Submit the form below and we will remove matching records and add a suppression entry so the data is not re-acquired.
response time2–4 weeksverificationemail confirmationcostfree
>
Submitting a removal request does not create, and shall not be construed as an admission of, any legal obligation, liability, or wrongdoing on the part of Solvent Global.
>
We use cookies and equivalent local storage that are strictly necessary to run the site and keep you signed in, and a limited set of first-party analytics to understand aggregate product usage and diagnose faults. We do not run third-party advertising or cross-site tracking cookies. Where applicable law requires consent for non-essential storage, we ask for it before setting it. You can block or delete cookies in your browser, but strictly necessary cookies cannot be disabled without breaking sign-in.
SEC.14
FCRA and permissible use
>
Orbis is not a consumer reporting agency, and its outputs are not "consumer reports" under the US Fair Credit Reporting Act. Data obtained through Orbis must not be used, in whole or in part, as a factor in establishing an individual's eligibility for credit, insurance, employment, housing, education, or any other purpose regulated by the FCRA or equivalent legislation, and must not be used for consumer lookup, tenant or applicant screening, or any form of surveillance or harassment. Those restrictions are contractual conditions of use under our Terms of Service.
SEC.15
Children
>
Orbis is a business-to-business service that is not directed to children and is not available to anyone under 18. We do not knowingly collect personal data from children. If you believe a child's data has been provided to us, email privacy@orbis.run and we will delete it.
SEC.16
Changes and contact
>
We may update this policy to reflect changes in our practices or the law. We will change the version and updated date at the top of this page, and where a change is material we will provide additional notice to account holders by email or in-product before it takes effect. Continued use after the effective date constitutes acceptance of the updated policy. Previous versions are available on request.
contact.md
- privacy & data rights
- privacy@orbis.run
- legal and DPAs
- legal@orbis.run
- security disclosure
- security@orbis.run
- post
- Solvent Global Ltd, 100 Bishopsgate, 19th Floor, London EC2N 4AG
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
[boot]EOF — © 2026 SOLVENT GLOBAL LTDok
$ready▍
● readylines 70/70
17063 B