Who we are
Orbiz is built and operated by Innovation Insight (www.innovation-insight.com). For the personal data of people who visit this website or contact us, Innovation Insight is the data controller. For the data an organisation enters into Orbiz — its employees, candidates, files, credentials and payroll — that organisation is the controller and Innovation Insight is the processor acting on its instructions, under the data processing agreement.
Questions about this policy, and every request described in it, go to orbiz-support@innovation-insight.com. A person reads that inbox.
Three kinds of people, three kinds of data
Swipe sideways to see every column
| Who | What we hold | Why |
|---|---|---|
| Visitors to this website | Pages viewed, referrer, device and browser type, approximate location from your IP address — through Google Tag Manager and Google Analytics when they are enabled in production. Anything you type into the contact form. | To understand which pages are useful and to reply to you. |
| Members of a subscribing organisation | Your name, work email, hashed password, role and permissions, the organisation you belong to, and whatever your organisation records about you in the tools it has enabled: attendance, leave, timesheets, employee records and documents, project work, notes, recordings, pay and payslips. | To run the tools your organisation has subscribed to, on its instructions. |
| Candidates applying through a careers page | What you submit with your application — name, contact details, CV and answers — and the organisation’s notes, interview feedback and assessment results about you. | To run that organisation’s hiring process, on its instructions. |
Vault credentials are a special case: they are encrypted in your browser with a key derived from your passphrase before they are sent. We store ciphertext we cannot read, so they are not personal data we can access, disclose or search.
What we do with it, and on what basis
- Providing the service. Running the tools, sending the notifications your organisation and you have chosen, issuing payslips, keeping audit logs. Basis: performance of the contract with your organisation.
- Replying to you. A contact-form message reaches our support inbox and is used only to answer it. Basis: your request.
- Keeping the platform secure. Server logs, rate limiting and abuse detection. Basis: our legitimate interest in running a secure service.
- Understanding the website. Aggregate analytics on the marketing pages. Basis: your consent, where the law requires it, otherwise our legitimate interest in knowing which pages help.
- AI features you switch on. If your organisation uses résumé parsing or AI screening in HRMS, the text of a submitted CV is sent to OpenAI to be read and summarised. That happens only when the feature is used, and OpenAI does not train on data sent through its API.
- AI assistants a member connects. A member can connect an AI assistant, such as Claude or ChatGPT, to Orbiz through Orbiz MCP. When they ask it to read or change something, Orbiz sends that assistant what the member is allowed to see, at the member’s request. The assistant’s provider then handles that content under its own terms with the member or their organisation; it is not acting on our behalf. An organisation’s admin can switch AI assistants off for everyone. Basis: the member’s and the organisation’s instruction.
We do not sell personal data, we do not run advertising, and we do not use your organisation’s data to build products for anyone else.
Where it lives
Every organisation has its own database on MongoDB Atlas, and its own storage prefix on Amazon S3 for files, recordings, documents and payslips, served through Amazon CloudFront. The application runs on Amazon Web Services in the Asia Pacific (Mumbai) region. Nothing is pooled with another customer’s data. Dedicated or region-specific hosting is available on the Enterprise plan.
The providers who handle data on our behalf, and what each one does, are listed on the sub-processors page. We tell subscribing organisations before adding one.
How long we keep it
- Your organisation’s data — for as long as the organisation subscribes. When a subscription ends we export the whole database and storage prefix on request and delete them once the organisation confirms it has its copy.
- A member who leaves — an Admin of the organisation can mark them inactive (records kept, access removed) or erase them across every tool. Erasure is irreversible and is logged.
- Contact-form messages — kept in our support mailbox for as long as they are needed to answer you and to keep a record of the conversation.
- Server and security logs — kept for a limited period for debugging and incident response, then rotated.
- Screen recordings — subject to the retention rules each organisation sets in Grabr, which delete old recordings automatically.
- Deleted notes and files — recoverable from a trash for 30 days in Notely, and until the trash is emptied in Filespace, then removed.
Your rights
Depending on where you live you may have the right to access, correct, export, restrict or erase your personal data, to object to certain processing, and to complain to a supervisory authority. We honour these requests whether or not the law where you live requires it.
If you are a member or a candidate of a subscribing organisation, that organisation controls your data: contact its administrator first, and we will help them respond. Most requests — correcting a record, exporting your own data, erasing a leaver — can be done by an Admin inside the product. If you cannot reach the organisation, write to us and we will pass the request on.
Cookies and local storage
Signed-in use of the platform relies on a session token and small preferences (theme, selected organisation) held in your browser; without them you cannot stay logged in. The marketing pages set analytics cookies only when Google Tag Manager is configured for the site and, where required, only after you consent. We use no advertising cookies.
Children
Orbiz is business software for organisations and is not directed at children. We do not knowingly collect data from anyone under 16 except as an organisation records it about its own employees or applicants in accordance with local employment law.
Changes to this policy
When we change this policy we update the date at the top. If a change affects how a subscribing organisation’s data is processed, we tell its administrators by email before it takes effect.