1. Introduction

Effective date: 21 October 2026. This policy explains how RedOrbit collects, uses and protects personal data, both on our website and in the tools we run for our clients on Facebook, Instagram and WhatsApp.

RedOrbit (“we”, “our”, “us”) is a global digital solutions company providing web and mobile development, UI/UX design, Microsoft 365 solutions, digital marketing, cybersecurity and project management services. Website: https://redorbit.io.

We comply with applicable data protection laws, including the EU General Data Protection Regulation (GDPR) and Sri Lanka’s Personal Data Protection Act, No. 9 of 2022, where they apply.

2. Who is responsible for your data

For data collected through our website, RedOrbit is the data controller. For data processed through the tools we run for our clients (section 4), our client is the controller and RedOrbit acts as their data processor, working only on their instructions.

For any privacy question or request, contact us at reach@redorbit.io.

3. Data we collect through our website

• Identity and contact data: name, email address, phone number, company name and anything you submit in our contact forms.
• Technical data: IP address, browser type and version, device information, pages visited, referring URLs and usage data.
• Communication data: messages sent through contact forms and email correspondence with us.

4. Data from Facebook, Instagram and WhatsApp (RedOrbit PostWatch)

RedOrbit operates RedOrbit PostWatch, a tool we use on behalf of our clients to manage their Facebook Pages, Instagram business accounts and WhatsApp business accounts. It connects only through Meta’s official APIs, and only to accounts our clients have authorised us to manage.

Through these APIs the tool may process:

• Public comments on our clients’ Facebook and Instagram posts, with the commenter’s public name or username, so it can post a reply on the client’s behalf.
• Our clients’ own posts and stories, to publish scheduled content and check that it went live on time.
• Messages sent to our clients’ business accounts (for example WhatsApp enquiries), where the client has enabled this, so the client can follow up with the people who contacted them.

We use this data only to provide the service to that client. We do not sell it, use it for our own advertising, or share it with anyone other than the client and the service providers listed in section 7.

5. How we use data, and our legal bases

We use personal data to respond to enquiries, provide the services you or our clients request, publish and monitor our clients’ social media content, reply to comments on their behalf, improve and secure our website, and meet legal obligations. We never sell personal data.

• Consent: when you submit information voluntarily, for example through a contact form.
• Contract: when processing is needed to deliver a service agreed with you or our client.
• Legitimate interest: to run, improve and secure our services and respond to business enquiries.
• Legal obligation: when the law requires it.

6. Use of AI

To draft replies to comments, the text of a comment and the post it was written on are sent to our AI provider (Anthropic’s Claude API), together with the client’s own business information such as opening hours and menu. The AI returns a suggested reply, which is posted as the client’s account.

The AI never answers complaints or sensitive comments; those are left for the client’s team. We do not use automated decision-making or profiling that has legal or similarly significant effects on anyone.

7. Who we share data with

We share personal data only with the service providers we need to run our services, each bound to keep it secure, and with legal authorities where the law requires.

8. International transfers, retention and security

Transfers. As a global provider, we may process data outside your country, including outside the European Economic Area. Where we do, we use safeguards such as Standard Contractual Clauses and data protection agreements with our providers.

Retention. We keep personal data only as long as needed for the purpose it was collected for, to meet legal obligations, or to resolve disputes. Records of comments handled by RedOrbit PostWatch are kept for up to 30 days. Media files used for publishing are deleted from our servers within 2 days. Lead sheets belong to our clients and are kept for as long as each client decides.

Security. We use technical and organisational measures to protect data against unauthorised access, disclosure, alteration and destruction, including access only through official, permission-based APIs and keys stored securely on our servers. No online system is completely secure.

9. Your rights

Depending on where you live, you have the right to:

• access the personal data we hold about you
• correct inaccurate data
• ask us to delete your data (section 10)
• restrict or object to processing
• receive your data in a portable format
• withdraw your consent at any time

To use any of these rights, email reach@redorbit.io. We reply within one month. If your data was processed for one of our clients, we may pass your request to that client, who is the controller.

10. How to request deletion of your data

You can ask us to delete any data about you that was processed through our website or through RedOrbit PostWatch.

1. Email reach@redorbit.io with the subject “Data deletion request”.
2. Include your name and, for Facebook or Instagram data, your profile or username (and the business Page or account you interacted with, if you know it).
3. We confirm receipt within 7 days and delete the data within 30 days, unless the law requires us to keep it. We will tell you when it is done.

You can also delete your own comments directly on Facebook or Instagram at any time, and remove any app’s access in your Facebook settings under Apps and websites.

11. Cookies, children and changes

Cookies. Our website uses cookies and similar technologies to work properly, improve your experience and analyse traffic. Where the law requires, we ask for your consent before placing non-essential cookies. You can manage cookies in your browser settings.

Children. Our services are not aimed at children, and we do not knowingly collect data from children under 16.

Changes. We may update this policy from time to time. Changes are published on this page with a new effective date.

12. Contact us

• Company: RedOrbit
• Website: https://redorbit.io
• Email: reach@redorbit.io
• Address: 1401 Pennsylvania Ave, Suite 105, Wilmington, DE 19806, United States