Orbit Notetaker Data Processing Terms

These terms form part of the Orbit Terms of Service between Fraima LLC, a Wyoming limited liability company (filing ID 2026-001984197), 30 N Gould St, Ste R, Sheridan, WY 82801, United States, trading as Orbit ("Orbit"), and the company that uses the Orbit Notetaker in its workspace (the "Customer"). They apply from the day the Customer sets up the notetaker, and cover the personal data the notetaker processes for the Customer ("Meeting Data"): Annex I describes it.

1. Roles

1.1 For Meeting Data the Customer is the controller and Orbit is its processor. Orbit uses ClioIQ as its sub-processor for recording, transcription and notes.

1.2 The Customer decides whether a meeting is recorded, has a lawful basis for it, and tells the people in the meeting before the notetaker records it, as each user confirms when setting up the notetaker.

1.3 "Data Protection Law" means every law on personal data that applies to Meeting Data, including the GDPR, the UK GDPR, the LGPD (Brazil), the KVKK (Turkey), the UAE PDPL, the Australian Privacy Act 1988, India's DPDP Act 2023 and the US state privacy laws, including the CCPA. Their terms (controller, processor, personal data, data subject, personal data breach) carry the meaning those laws give them.

2. Instructions and purposes

2.1 Orbit processes Meeting Data only on the Customer's documented instructions: these terms, the Terms of Service, and the Customer's settings and use of the notetaker, including what its users and agents are set up to do. Orbit tells the Customer if, in its opinion, an instruction breaks Data Protection Law, and may hold that instruction until the Customer confirms or changes it.

2.2 As a service provider and contractor under the CCPA, and a processor under the other US state laws, Orbit will not sell or share Meeting Data, retain, use or disclose it for any purpose other than providing the notetaker, or combine it with other personal data except as those laws allow a service provider to. Orbit understands these restrictions and will comply with them, and tells the Customer if it can no longer meet them.

2.3 Orbit does not use Meeting Data to train AI models, and its sub-processors' terms bar them from doing so. Meeting content goes only to the AI providers in Annex III, never to MiniMax, Moonshot (Kimi) or free model tiers.

3. Confidentiality and security

Only Orbit staff and contractors bound by confidentiality may access Meeting Data, and only for support the Customer asked for, security and abuse investigations, and legal obligations. Orbit maintains the measures in Annex II for as long as it processes Meeting Data.

4. Sub-processors

4.1 The Customer authorises the sub-processors in Annex III. 4.2 Orbit tells the Customer at least 20 days before a new or replacement sub-processor processes Meeting Data, by email to the workspace owner, with its name, service, the data involved and its location. The Customer may object on reasonable data protection grounds within 10 days. If the parties can't agree before the change takes effect, the Customer may stop using the notetaker without penalty, and Orbit refunds what was prepaid for it. A replacement needed urgently to keep the service secure or running may take effect sooner, with notice as soon as possible and the same right to object. 4.3 Each sub-processor works under a written contract that protects Meeting Data at least as well as these terms. Orbit stays liable to the Customer for each of them.

5. Requests from data subjects

Orbit passes to the Customer, within 5 business days, any request about Meeting Data it receives from a data subject, and answers it only on the Customer's instruction. In the app the Customer can delete a meeting with its recording, transcript and notes, erase a person by email address, and delete all its meeting data once its plan has ended. When a person is erased, meetings where they were the only outside participant are deleted; in a meeting with other outside participants their link and email address are removed but their spoken words stay in that meeting's transcript, and Orbit shows the Customer each such meeting so it can decide whether to delete it.

6. Personal data breaches

Orbit tells the Customer without undue delay, and within 48 hours of becoming aware, of a personal data breach affecting Meeting Data, by email to the workspace owner, with what it then knows: what happened and when, the people and records affected, the likely consequences, the measures taken and a contact. Orbit sends updates as it learns more and helps the Customer with the notices the law requires of it.

7. Assistance and public authorities

Orbit gives the Customer the information it reasonably needs for impact assessments, transfer impact assessments and consultations with a supervisory authority. If a public authority asks Orbit for Meeting Data, Orbit tells the Customer unless the law forbids it, checks the request is lawful and challenges it where it has grounds, discloses only the minimum, and keeps a record.

8. Retention and deletion

Recordings are kept 30 days. Transcripts and notes are kept while the Customer uses the notetaker, until it deletes them. When the Customer's notetaker plan ends, Orbit asks ClioIQ to delete everything it holds for the Customer and confirm in writing. When the Customer deletes its account, Orbit deletes Meeting Data within 30 days, unless the law requires it to keep some; backups roll off on their own schedule. Orbit confirms deletion in writing on request.

9. Audits

Orbit answers the Customer's written security and privacy questionnaire within 30 days, at most once in 12 months. If that leaves a reasonable concern unanswered, after a personal data breach, or when an authority requires it, the Customer (or an independent auditor bound by confidentiality who is not Orbit's competitor) may audit Orbit's processing of Meeting Data on 30 days' notice, in business hours, at its own cost and without access to other customers' data. Orbit holds no SOC 2 or ISO 27001 certification; it builds on providers that do.

10. Transfers

Meeting Data is stored in the United States and processed by the sub-processors in Annex III where that annex says. Schedule 1 sets out what applies for a Customer in each country. The notetaker is not offered to a Customer in a country Schedule 1 doesn't list until what that country requires is in place.

11. Liability, precedence and changes

The limitations of liability in the Terms of Service apply, except where Data Protection Law or a clause set in Schedule 1 doesn't allow them; nothing here limits a data subject's rights under those clauses. For a transfer, the clauses in Schedule 1 prevail over these terms, and on personal data these terms prevail over the Terms of Service. Orbit may update these terms to follow the law or its sub-processors, with at least 20 days' notice of a material change, and a change never lowers the protection of Meeting Data.

Schedule 1: Transfers by the Customer's country

Annex I: The processing

Parties. Data exporter: the Customer, the controller, as named in its Orbit account. Data importer: Fraima LLC, trading as Orbit, the processor (address above); contact for privacy, requests and incidents: admin@fraima.com.

Data subjects. The Customer's users of the notetaker, and the people who speak in, or are listed as attendees of, a meeting the notetaker records.

Personal data. Names and email addresses of users and attendees; meeting audio; transcripts; summaries, action items, intelligence and follow-up drafts drawn from them; meeting titles, times and platforms; request logs and usage records. No sensitive data is intended or requested; a participant may reveal anything they choose to say, and Annex II applies to it the same way.

Nature and purpose. Recording, transcription and summarising of meetings; linking them to the Customer's CRM in Orbit; making notes available to the Customer's users and agents; storage, export and deletion; providing the notetaker as the Terms of Service describe it. Continuous, for as long as the Customer uses it.

Retention. As in section 8. Supervisory authority. As Schedule 1 sets for the Customer's country.

Annex II: Technical and organisational measures

• HTTPS only, TLS 1.2 and 1.3.
• Managed Postgres encrypted at rest (AES-256); connected keys and tokens encrypted again with AES-256-GCM, never sent to the browser or shown to an AI model.
• Row-level security on every table, so a request reaches only a workspace the signed-in person belongs to.
• Each agent run gets its own access token, tied to one workspace and one agent, valid for at most six hours, with spend, time and tool-call limits and a record of its steps.
• Meeting events from ClioIQ carry ids only and are signed (HMAC-SHA256). Every notetaker action that sends, deletes or exports personal data is written to an audit log first, with ids and counts, never content.
• Staff access limited to a few people with an admin role, checked by the server; no "log in as the customer".
• ClioIQ: access to content limited to written support requests, incident investigation and legal obligations, each access logged; production access for one named person with two-step verification; incidents reported to Orbit within 24 hours.

Annex III: Sub-processors

ClioIQ's own providers for the notetaker: