Privacy Policy.

When you use our general project form, we collect your name, work email, what you need, optional budget range, optional timeline, and the message or context you send. When you use our agency-partner form, we collect your name, work email, agency name, agency website, capability, opportunity stage, expected start window, optional budget range, and the context you provide. Our prototype enquiry form collects your name, email, and idea. We use this information to respond to and qualify your project or partnership inquiry.

When you request an MVP estimate or tech stack report, we collect the answers you provide, the generated result, and—if you choose to save or email the report—your name and email address. Saved reports are available through an unlisted shareable link.

When you book a call via Calendly, Calendly collects your name, email, and scheduling preferences directly. Please refer to Calendly's privacy policy for details on how they handle that data.

We use Google Tag Manager and Google Analytics to understand how visitors interact with our website. This includes usage information such as pages visited, time on site, and referral source. Before analytics events are sent, our application removes direct identifiers and submitted free text, including name, email address, agency identity or website, phone number, and message or context.

We use the OpenAI Pixel to measure page visits, successful enquiries, and website interactions such as navigation, call-to-action clicks, tools, reports, and film engagement associated with our ads. Our application sends page paths and event types. After a successful enquiry with an existing permitted measurement session, we also supply a SHA-256 hash of your normalized email address to the Pixel to improve matching. We do not manually attach raw email addresses, names, phone numbers, or enquiry messages. When automatic advanced matching is enabled for the pixel, the SDK may detect supported contact details, normalize and hash them in your browser, and include those hashes with measurement events. Raw contact details are not sent through that matching feature.

For successful enquiries with an existing permitted Pixel measurement session, we also send a server-side conversion to OpenAI. It contains an event reference, submission time, form page, and available Pixel browser and ad-click references. To improve conversion matching, this server event also includes a SHA-256 hash of your normalized email address and, when available, your IP address and browser user agent. We do not attach raw email addresses, enquiry text, names, phone numbers, or a monetary value. A shared event reference prevents the browser and server reports being counted twice. Matching references, email hashes, IP addresses, and browser user agents are held temporarily in a delivery queue and removed when delivery succeeds or retries end.

Contact form submissions are used to respond to your enquiry and, if relevant, to follow up on a potential project. Where measurement is permitted, a hash of your email address is also used for the advertising measurement described above. We do not add you to any mailing list without your explicit consent.

Tool answers are sent to OpenAI to generate recommendations and estimates. If you request a saved report, its inputs, generated output, name, and email address are stored in Convex so we can provide the report link, deliver the result, and follow up on the enquiry.

Analytics data is used to improve the website experience — understanding which pages are useful, where visitors drop off, and how the site performs overall.

Advertising measurement helps us understand which ads lead to website visits and enquiries. OpenAI may associate the submitted measurement events with eligible ad interactions for campaign reporting.

We do not sell, rent, or trade your personal information to third parties under any circumstances.

Our studio website uses the following third-party services, each with their own privacy policies:

Calendly — for discovery call scheduling. Vercel — for website hosting and edge delivery. Sanity — as a content management system for our blog. Google Analytics / Google Tag Manager — for usage analytics. OpenAI — for generating tool recommendations and reports, and advertising measurement. Convex — for enquiry and saved report storage and rate limiting. Postmark — for processing contact form and report email notifications.

We recommend reviewing the privacy policies of these services if you have questions about how they handle data.

We use cookies for analytics purposes through Google Analytics. These are non-essential cookies. By continuing to use the site, you consent to their use.

The OpenAI Pixel loads automatically on public studio pages without a separate consent popup. Its first-party cookies can include __oppref, which stores an ad click reference for up to 30 days after it is written, and __obref, which stores a browser reference for up to 365 days. Browser settings or clearing cookies may shorten these lifetimes. You can manage cookies using your browser settings; browser tracking protections or content blockers may prevent measurement. The implementation does not overwrite a denial already stored by the Pixel, and honors a denial saved by an earlier version of our advertising measurement settings.

We use browser session storage to remember the first landing page, referring website origin, and campaign tags while you navigate to an enquiry form. We do not retain full referring URLs or unrelated query parameters for this purpose. Essential SEO workspace session cookies are described separately below.

Project, prototype, and agency-partner enquiries are stored in Convex before we attempt an email notification. We store the submitted details, submission time, form source, and notification status. We also store the first landing page, referring website origin, and UTM campaign tags when available, to understand where enquiries come from. Saved tool reports and their associated lead details are also stored in Convex.

Saved report links are unlisted rather than access-controlled. Anyone with the link can view the report, so you should not enter confidential or sensitive information into the tools.

We retain enquiries and saved reports for as long as reasonably necessary to respond, provide the requested report, and maintain business records. You may request access or deletion using the contact details below.

Our website is hosted on Vercel's global edge network with HTTPS enforced on all pages. We take reasonable technical measures to protect data in transit.

You have the right to request access to any personal information we hold about you, and to request its deletion. To exercise these rights, email us at rahul@buildorbit.studio with the subject line 'Privacy Request'.

If you are located in the European Economic Area, you may also have rights under GDPR including data portability and the right to object to processing.

BuildOrbit also operates an invitation-only SEO workspace, including its Setu AI assistant. For this service we process account identity and organization membership, website and business details, competitor and keyword research, saved reports, chat messages and responses, action records, and usage and budget records. These records support the workspace features requested by users and access, security, and spending controls.

The SEO workspace uses WorkOS for sign-in and membership, Cloudflare for application hosting and storage, PostgreSQL hosted by PlanetScale for workspace records, and OpenAI for AI responses. Search-research providers process the website, keyword, or other research inputs needed for a requested lookup. These service providers may process information outside your country. Studio website tools described elsewhere in this policy use a separate infrastructure.

When an authorized user connects Google, we receive the account identifier and granted permissions. We store encrypted connection credentials to refresh access. Search Console access reads selected website properties and search-performance data such as queries, pages, clicks, impressions, and positions. Google Analytics access reads selected accounts, properties, and reporting metrics. We use these connections to display reports and support the SEO features the user requests; we do not edit Search Console or Analytics settings.

Google Ads access reads advertiser and manager account identifiers, selected Search campaign performance, budgets, available search terms and keywords, and conversion settings. We associate the selected advertiser with an agency client and project, save report snapshots and action evidence, and use the data to display performance and suggest work for the agency to review. Google provides a broad Ads permission, but this integration only reads Ads data; it does not create or edit ads, bids, or budgets.

Google Sheets export requests permission to create or access files created or explicitly opened with the app, rather than access to all Drive files. When you choose an export, the selected report content is sent to Google Sheets. Exported files remain in your Google account and are subject to your Google sharing settings.

When you ask Setu to analyse connected reports or use an AI feature, relevant report data, your question, and project context may be sent to OpenAI to generate that response. Messages and generated results may be saved in the workspace so you can return to them. Do not enter passwords, API keys, or information you are not authorized to share.

We use Google data only to provide the user-facing features described here. We do not sell it, use it to target or serve our own or third-party advertising, use it for credit decisions, or use it to train general-purpose AI models. Customer-requested analysis of their own Google Ads performance is limited to the reporting and agency workflow described above. Access by our personnel is limited to cases where you authorize access to specific data, security investigations, or legal requirements. Our use and transfer of Google API data adhere to the Google API Services User Data Policy, including its Limited Use requirements.

Workspace records and saved results are retained while needed to provide the service, maintain the requested history, resolve usage charges, and meet applicable legal or security obligations. We do not promise that disconnecting an integration deletes previously saved reports or messages.

An authorized workspace administrator can disconnect Google in Website settings → Connections. This removes the locally stored connection credentials and attempts to revoke the grant with Google. You can also revoke BuildOrbit access through your Google Account third-party connections settings. Disconnecting stops future access through that connection; it does not delete files already exported to your Google Drive.

For Google Ads, administrators can open the project’s Google Search Ads page and expand Manage connection. Unlink advertiser removes that project’s saved Ads report connection while leaving the agency’s shared Google connection available. Remove agency Google connection erases the agency’s locally stored Ads credentials and attempts Google revocation; previously saved reports and action history may remain. Google revocation can also require reconnecting other integrations authorized by the same Google account.

To request access, correction, or deletion of SEO workspace data, email rahul@buildorbit.studio and identify your workspace. We verify the requester’s authority and explain any records that must be retained. Full workspace deletion is handled through support; the application does not currently provide a self-service organization-erasure workflow.

The SEO workspace uses HTTPS, authenticated sessions, organization-scoped authorization, and encrypted Google refresh credentials. It uses essential session cookies for sign-in and security. These are distinct from analytics cookies used on the public studio website.

Workspace members may access project records according to their roles. Only share information you are authorized to make available within that workspace. Operational and usage records help us investigate faults, prevent abuse, and enforce configured spending limits.

We may update this Privacy Policy from time to time. The effective date at the top of this page will reflect the most recent update. Continued use of the website after changes constitutes acceptance of the revised policy.

If you have questions about this Privacy Policy, please contact us at rahul@buildorbit.studio or write to BuildOrbit Studio, Pune, Maharashtra, India.