Privacy Policy

1. Introduction

This Privacy Policy describes how Orbyfy Inc. ("Orbyfy," "we," "us," or "our") collects, uses, shares, stores, and protects information in connection with the Orbyfy Earthflow platform ("Platform"), including the Cirra AI assistant, web dashboard, analytics, reports, and all integrated communication channels. This Policy applies to all users regardless of how you access the Platform.

By using the Platform, you consent to the practices described in this Privacy Policy. If you do not agree, you must not use the Platform.

2. Information We Collect

2.1 Information You Provide

• Account information: Name, email address, company or organization name, job title, phone number, and other registration details.
• Project and site data: GPS coordinates, site names, project identifiers, acreage, capacity specifications, land ownership details, and other project-specific parameters you enter.
• AI interactions: All queries, prompts, messages, instructions, and communications submitted to Cirra AI through any channel, including the web dashboard, Slack, Microsoft Teams, Email, Signal, and Telegram.
• Uploaded content: Documents, images, datasets, shapefiles, reports, or other files you upload.
• Communications: Correspondence you send to Orbyfy, including support requests and feedback.
• Payment information: Billing and payment details if applicable, processed through third-party payment processors. Orbyfy does not store full credit card or bank account numbers.

2.2 Information Collected Automatically

• Usage data: Pages viewed, features used, analysis requests, report generation activity, AI interactions, session duration, click patterns, and interaction sequences.
• Device information: IP address, browser type and version, operating system, screen resolution, device identifiers, and language preferences.
• Log data: Access timestamps, error logs, API call records, request/response metadata, and performance metrics.
• Location data: Approximate geographic location derived from IP address.
• Cookies and similar technologies: Session cookies for authentication and session management, analytics cookies, and similar tracking technologies. See Section 7 for details.

2.3 Information from Third-Party Sources

• Environmental and geospatial data from 70+ external sources including NREL (National Renewable Energy Laboratory), SSURGO (Soil Survey Geographic Database), NOAA, USGS, EPA, state environmental agencies, satellite imagery providers, and other government and commercial data feeds.
• Grid and utility data from public sources and commercial databases.
• Authentication data from third-party identity providers if you use single sign-on (SSO).
• Channel platform data from Slack, Microsoft Teams, or other integrated communication platforms when you interact with Cirra AI through those channels.

2.4 AI-Specific Data Collection

All data submitted to and generated by Cirra AI is collected and stored, including:

• All queries, prompts, and messages you submit to Cirra AI through any channel.
• All AI-generated responses, analysis outputs, risk scores, reports, and recommendations.
• Interaction metadata including the originating channel, timestamp, session context, model version, and processing parameters.
• Conversation histories across all channels where you access Cirra AI.
• Feedback you provide on AI outputs (e.g., ratings, corrections, flagged errors).

3. How We Use Your Information

We use collected information for the following purposes:

1. Service delivery: To operate the Platform, process your requests, generate environmental analyses, run AI models, produce reports, and deliver the services you request.
2. AI model development: To train, fine-tune, evaluate, test, and improve Cirra AI and our physics-informed neural network models. We may use interaction data, including your queries and feedback, for this purpose. We endeavor to use anonymized and aggregated data where practicable, but model improvement may require use of specific interaction data.
3. Platform improvement: To analyze usage patterns, diagnose technical issues, optimize performance, conduct A/B testing, and develop new features.
4. Security: To detect, investigate, prevent, and respond to fraud, unauthorized access, abuse, security incidents, and other harmful activity.
5. Communications: To send service-related notices, security alerts, maintenance notifications, and, where you have opted in, product updates and marketing communications.
6. Legal compliance: To comply with applicable laws, regulations, legal processes, governmental requests, and enforcement actions.
7. Research and publication: To conduct scientific research and publish findings based on aggregated and anonymized data, including publications on Structured-Entropy Physics and related research.
8. Business operations: To manage billing, enforce our Terms of Service, exercise our legal rights, and operate our business.

4. How We Share Information

We do not sell your personal information. We may share information as follows:

• Service providers: With third-party vendors who assist in Platform operations, including cloud infrastructure providers, analytics services, payment processors, and communication tools, under contractual obligations to protect your data and use it only for specified purposes.
• AI model providers: Certain AI capabilities involve processing through third-party AI model providers (e.g., large language model APIs). Data transmitted to these providers is governed by our data processing agreements with them. These providers may process your queries and data to generate AI responses.
• Third-party channel platforms: When you access Cirra AI via Slack, Microsoft Teams, Email, Signal, Telegram, or other integrated channels, your interactions are transmitted through those platforms. Orbyfy does not control how those platforms process, store, or use data transmitted through their infrastructure. You are subject to those platforms' own terms and privacy policies.
• Legal requirements: When required by law, subpoena, court order, regulatory request, or governmental authority, or when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business transfers: In connection with a merger, acquisition, reorganization, bankruptcy, dissolution, or sale of assets, your information may be transferred as a business asset. We will notify you of any such change in ownership or control.
• Aggregated and anonymized data: We may share data that has been aggregated and anonymized so that it cannot reasonably identify any individual user or specific project site.
• With your consent: We may share information with third parties when you explicitly consent to such sharing.

5. Data Storage and Security

• Data is stored on cloud infrastructure in the United States.
• We implement commercially reasonable security measures including encryption in transit (TLS/SSL) and at rest, access controls, authentication safeguards, and monitoring.

• No method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, and you transmit data at your own risk.
• We retain data for as long as your account is active or as needed to provide services, comply with legal obligations, resolve disputes, and enforce our agreements. Following account termination, we may retain certain data as required by law or for legitimate business purposes.

6. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete personal data.
• Deletion: Request deletion of your personal data, subject to legal retention requirements and legitimate business needs.
• Data portability: Request your data in a structured, commonly used, machine-readable format.
• Restriction: Request restriction of processing of your personal data under certain circumstances.
• Objection: Object to processing of your personal data for certain purposes.
• Opt-out of communications: Unsubscribe from non-essential communications at any time.
• AI-specific requests: Request information about how your data is used in AI model training. Note that opting out of AI model training may limit or preclude your ability to use the Platform.

To exercise any of these rights, contact us through our Contact page. We will respond within the timeframe required by applicable law. We may need to verify your identity before processing your request.

7. Cookies and Tracking Technologies

The Platform uses cookies and similar technologies for:

• Strictly necessary cookies: Authentication, session management, security, and core Platform functionality. These cannot be disabled.
• Analytics cookies: To understand usage patterns, measure performance, and improve the Platform. We may use third-party analytics providers.
• Functional cookies: To remember your preferences and settings.

You can control non-essential cookies through your browser settings. Disabling certain cookies may affect Platform functionality.

8. Children's Privacy

The Platform is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children under 18. If we become aware that we have inadvertently collected data from a minor, we will take prompt steps to delete it. If you believe a minor has provided us with personal information, contact us through our Contact page.

9. International Data Transfers

If you access the Platform from outside the United States, your data will be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction. By using the Platform, you explicitly consent to this transfer and processing. Orbyfy will take commercially reasonable steps to ensure your data receives a level of protection consistent with applicable data protection standards.

10. Third-Party Links and Services

The Platform may contain links to third-party websites, services, or resources. Orbyfy is not responsible for the privacy practices, content, or security of any third-party services. We encourage you to review the privacy policies of any third-party service you access.

11. Changes to This Policy

We may update this Privacy Policy at any time. We will post the updated Policy on the Platform and update the "Last Updated" date. Material changes may be notified via email or Platform notification. Your continued use of the Platform after changes constitutes your acceptance of the updated Policy. During the beta period, this Privacy Policy may change frequently as our product, data practices, and infrastructure evolve.