Privacy Policy

This Privacy Policy explains how Navybits ("Navybits", "we", "us", "our") collects, uses, discloses and protects information when you use Orbit, our WhatsApp Business Platform product (the "Service"), including this website, the Orbit web app, the Orbit agent mobile app, and related APIs.

If your organization ("Customer", "you") uses Orbit to communicate with your own end customers ("End Users"), Customer is generally the data controller of End User conversation data, and Navybits acts as a data processor on Customer's behalf for that data. This policy explains both how we handle Customer account data (as controller) and how we process End User data on Customer's instructions (as processor).

1. Information we collect

1.1 Account & organization data

When you sign up, we collect information such as your name, work email, phone number, business name, organization/team structure, role, and password (stored hashed, never in plain text).

1.2 WhatsApp / Meta channel data

To connect your WhatsApp Business Account, we collect your WhatsApp Business Account (WABA) ID, phone number ID, and access tokens issued via Meta's Embedded Signup flow. Access tokens and other channel secrets are encrypted at rest (AES-256) and are never displayed in plain text after initial setup.

1.3 Conversation data

Orbit synchronizes messages, contacts, media attachments, message templates and delivery/read status between your WhatsApp Business Account and our platform so your team can view and respond to conversations in a shared inbox. This data is provided by Meta's WhatsApp Business Platform (Cloud API) and by your End Users, and is stored on our servers to power the Service (inbox, chatbot flows, campaigns, analytics).

1.4 Voice calling data

If you enable WhatsApp Calling / IVR, we process call metadata (caller number, duration, routing/DTMF path, transfer history) and, where call recording is enabled for your organization, audio recordings and machine-generated transcripts of calls. You are responsible for ensuring you have the legal basis and consent required in your jurisdiction to record calls.

1.5 AI agent data

If you enable the AI agent, message content and, for voice, audio may be sent to third-party AI model and speech-to-text providers (see Section 3) to generate automated replies or transcriptions. You control which conversations the AI agent handles and can disable it at any time.

1.6 Usage, device & cookie data

We collect standard technical data — IP address, browser/device type, pages visited, timestamps and log data — for security, debugging and analytics. Our website and app use essential cookies for authentication (session/refresh tokens in httpOnly cookies) and may use limited analytics cookies to understand product usage.

2. How we use information

• To provide, operate and maintain the Service, including the shared inbox, chatbot flow engine, campaigns, calling and analytics.
• To authenticate accounts, enforce organization/team permissions, and secure the platform.
• To communicate with you about your account, billing, and Service changes.
• To provide customer support and troubleshoot issues.
• To improve the Service, including aggregated and de-identified usage analysis.
• To comply with legal obligations and enforce our Terms and Conditions.

We do not sell personal information, and we do not use Customer or End User conversation content to train third-party AI models beyond what is strictly needed to generate a response within a conversation you have configured the AI agent for.

3. How we share information

We share information with the following categories of service providers ("subprocessors"), each bound by confidentiality and data-protection obligations:

• Meta Platforms, Inc. — the WhatsApp Business Platform (Cloud API), Instagram and Messenger APIs that Orbit connects to, to send and receive messages on your behalf.
• Cloud hosting & infrastructure providers — to host application servers, databases and file/media storage.
• AI and speech-to-text providers — to power optional AI agent replies and voice transcription, limited to conversations you enable this for.
• Odoo — only if you connect the optional Odoo integration, to exchange order, customer and inventory data you request.
• Payment processors — to process subscription billing; Navybits does not store full payment card numbers.
• Email/SMS delivery providers — for transactional notifications (e.g. password resets, alerts).

We may also disclose information if required by law, to protect the rights, property or safety of Navybits, our customers or the public, or in connection with a merger, acquisition or sale of assets (subject to continued protection under an equivalent policy).

4. Data retention

We retain account and conversation data for as long as your organization maintains an active Orbit account, plus a limited period afterward for backups, legal, tax and dispute-resolution purposes. Encrypted nightly backups are retained for 14 days on a rolling basis. You may request deletion of your organization's data as described in Section 6, subject to legal retention requirements.

5. Security

We use industry-standard safeguards including encryption in transit (TLS), encryption at rest for secrets (AES-256), hashed passwords, role-based access control, and short-lived authentication tokens. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

6. Your rights

Depending on your jurisdiction (including GDPR for individuals in the EEA/UK and similar laws elsewhere), you may have the right to access, correct, export, or request deletion of your personal data, and to object to or restrict certain processing. Organization administrators can manage most End User data directly within Orbit. To exercise these rights or make a request on behalf of your organization, contact us at the details in Section 9.

7. International data transfers

Navybits and its subprocessors may process data in countries other than your own. Where required, we rely on appropriate safeguards (such as standard contractual clauses or equivalent mechanisms) for cross-border transfers.

8. Children's privacy

Orbit is a business platform not directed at children, and we do not knowingly collect personal information from individuals under 16 through our own sign-up flow. End User conversation content is controlled by the Customer operating that WhatsApp number.

9. Contact us

Questions about this Privacy Policy or data requests can be sent to info@navybits.com or WhatsApp.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified via the Service or by email. Continued use of Orbit after changes take effect constitutes acceptance of the updated policy.