Privacy policy

Orbyte Labs Limited is a company registered in Hong Kong. This policy explains how we handle personal data through orbytelabs.com, our documentation, the Credit billing service, and sales, support, and project communications.

Other products, including Teamy, have their own privacy notices. Third-party websites and services have their own policies. A data processing agreement or service-specific notice may supplement this policy for a particular engagement.

• Contact information. Your name, work email, company, role, message, and information you share in correspondence or a meeting booking.
• Account information. Login identifiers, profile details, organization membership, permissions, and account settings when you use the Credit dashboard.
• Billing and usage records. Customer identifiers supplied by your app, credit prices, balances, usage events, event identifiers, transaction history, subscription and payment references, and related metadata. An identifier may be personal data even if it is not a name or email address.
• Technical information. Requests, IP addresses, browser and device information, pages visited, referrers, approximate location, performance measurements, and diagnostic or security logs processed by our services and infrastructure providers.

All visible contact-form fields are required to assess and reply to your inquiry. Without them, the form cannot be submitted. You can also email us directly. Please do not include passwords, API secrets, payment card details, or personal data that is unnecessary for your request or billing integration.

We use contact information to respond to inquiries, arrange meetings, discuss projects, and provide support. We use account and billing data to manage access, apply your credit configuration, record usage and transactions, process subscriptions and payments, and investigate billing issues.

Technical data helps us operate and secure the services, prevent abuse, diagnose failures, and understand website traffic and performance. We also keep information needed to meet legal and accounting obligations, resolve disputes, and enforce our agreements. We do not sell personal data.

We decide how personal data is used for our own website, business relationships, account administration, support, security, and billing. When a customer sends its end users' identifiers or usage records to Credit, we process that data on the customer's behalf to provide the billing service. The customer determines the purposes of that processing and is responsible for its own privacy notice and lawful instructions.

Where EU or UK data protection law applies to our own processing, our grounds are performing a contract or taking requested steps before a contract, legitimate interests in operating and securing our business, legal obligations, and consent where required. We consider individuals' rights when relying on legitimate interests. If your use of Credit requires a data processing agreement, contact us to arrange one before sending personal data.

We use providers to deliver the services. Their access depends on the feature you use:

• Vercel hosts the website and provides traffic and performance analytics.
• Resend delivers contact-form messages to our business email inbox.
• Google Calendar handles bookings opened from our meeting links.
• Clerk provides Credit account authentication and organization access.
• Convex provides Credit's database and backend infrastructure.
• Stripe processes payments and subscriptions. Payment card details are handled by Stripe; Credit stores payment references and status, not full card numbers.

Customer organization members may see billing data according to their permissions. We may also disclose information to professional advisers, authorities, or courts when necessary to meet legal obligations or protect our rights. A business transfer may require disclosure to a successor, subject to appropriate confidentiality and data protections.

We require service providers processing personal data on our behalf to protect it and use it for the services they provide. Providers may also process some information for their own purposes under their privacy notices, including payment and booking administration.

The public website uses Vercel Web Analytics for traffic statistics and Vercel Speed Insights for loading speed, responsiveness, and visual stability measurements. Web Analytics uses request-derived visitor identifiers rather than third-party cookies. Its visitor identifier is discarded after 24 hours; this does not mean all analytics records are deleted after 24 hours. See Vercel's analytics privacy documentation.

The signed-in Credit dashboard uses authentication cookies. Payment and booking services may use their own cookies or similar technologies. You can control cookies through your browser settings, although blocking necessary cookies may prevent sign-in or other features from working.

Orbyte Labs is based in Hong Kong. Our providers may store or process data in other countries, whose privacy laws may differ from those in your country. Using an overseas provider does not remove our responsibility to protect personal data entrusted to us.

Where applicable law requires safeguards for a transfer, we use an appropriate lawful transfer mechanism and contractual protections. Contact us if you need information about the arrangements relevant to your use of the services.

We keep inquiry and correspondence records as needed to respond, follow up, and manage the business relationship. Account, wallet, and transaction records are kept as needed to operate the service, reconcile charges, and meet the relevant agreement. Security and diagnostic records are kept as needed to investigate incidents and protect the service.

Retention depends on the type of information, account status, contractual commitments, and legal requirements. Accounting records or information needed for a dispute may need to be retained after an account closes. We delete or anonymize personal data when it is no longer needed, subject to required retention and backup handling. Contact us for a deletion request or the retention arrangements for your account.

We take reasonable technical and organizational steps to protect personal data against unauthorized access, disclosure, alteration, loss, or misuse. These include account authentication, organization permissions, API access controls, and encrypted connections. No online service can guarantee complete security.

You are responsible for protecting your own credentials, devices, and integration permissions. Contact us promptly if you suspect an account or API key has been compromised.

Under Hong Kong's Personal Data (Privacy) Ordinance, you can request access to personal data we hold about you and ask us to correct inaccurate data, subject to the Ordinance. Other applicable laws may also provide rights to deletion, restriction, objection, portability, or withdrawal of consent. Withdrawing consent does not affect lawful processing carried out before withdrawal.

Send requests to contact@orbytelabs.com. We may need to verify your identity or authority and will respond within the applicable legal time limits. If the request concerns data supplied by a Credit customer, contact that customer first; we can help it respond under our agreement. You can also complain to the Hong Kong Privacy Commissioner for Personal Data or another competent data protection authority.

Sending an inquiry or booking a meeting does not subscribe you to a marketing list. We may send messages needed to answer your request or administer your service. Any marketing communications must have a lawful basis, and you can ask us to stop them by email or through an unsubscribe option when provided.

Our business website, sales communications, and account signup are intended for professional adult users. If you believe a child has provided personal data directly to us, contact us so we can address it. A customer's application may have its own audience and privacy obligations.

We will publish changes on this page and update the date above. Where required, we will provide additional notice or obtain consent before using personal data for a new purpose.

Orbyte Labs Limited
Unit B, 11/F, Yam TZE Commercial Building
23 Thomson Road, Wan Chai, Hong Kong SAR

For privacy questions, access or correction requests, or other data concerns, email contact@orbytelabs.com.