Data Processing Agreement

Effective: 2026-06-25. Applies to all Orbyt customers subject to GDPR (EU/EEA/UK), CCPA (California), or similar data-protection laws.

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Orbyt (a product of Purecraft LLC, “Orbyt”) and its customer (“Customer”). It governs the processing of personal data by Orbyt as a data processor acting on behalf of Customer as data controller.

1. Definitions

“GDPR” means the EU General Data Protection Regulation 2016/679. “CCPA” means the California Consumer Privacy Act. “Personal Data” has the meaning given in applicable law. “Sub-processor” means any third party engaged by Orbyt to process Personal Data on Customer’s behalf.

2. Scope and roles

Customer is the data controller and Orbyt is the data processor. Orbyt processes Personal Data solely to provide the Orbyt service, to comply with legal obligations, and on Customer’s documented instructions. Orbyt will not sell Personal Data or use it to train general-purpose AI models.

3. Categories of Personal Data

Personal Data processed by Orbyt typically includes: user account data (name, email, authentication tokens), job-search data entered by the user (applications, contacts, resumes, notes), device and usage telemetry (IP, browser, page views), and billing data processed via Stripe.

4. Sub-processors

Orbyt uses the following sub-processors: Vercel (hosting, U.S.), Supabase (database and auth, U.S.), Stripe (payments, U.S.), Resend (transactional email, U.S.), Upstash (Redis rate limits, U.S.), Sentry (error monitoring, U.S.), Anthropic / OpenAI (on-request AI features, U.S.). Orbyt binds each sub-processor to equivalent data-protection terms.

5. International transfers

Personal Data is stored in the United States. For Customers in the EU/EEA/UK, Orbyt will enter into the European Commission’s Standard Contractual Clauses (Module Two: Controller to Processor) on request at legal@orbytjobs.ai. Orbyt does not currently self-certify under the EU-US Data Privacy Framework.

6. Security

Orbyt implements appropriate technical and organizational measures including: TLS 1.2+ in transit, AES-256 at rest (via Supabase), Row Level Security on every database table, least-privilege access, and security.txt at /.well-known/security.txt for vulnerability disclosure. Orbyt is not SOC 2 certified and does not currently have a scheduled audit; see the Trust Center for current security practices.

7. Data subject rights

Customer and its end users may at any time: export all data via the app, delete their account (which removes Personal Data within 30 days), and request copies or corrections of Personal Data by emailing legal@orbytjobs.ai.

8. Breach notification

Orbyt will notify Customer without undue delay and in any event within 72 hours of becoming aware of a Personal Data breach affecting Customer data, along with information necessary to meet Customer’s own notification obligations.

9. Audits

Customer may request written confirmation of sub-processor obligations once per year by emailing legal@orbytjobs.ai. Orbyt does not currently hold a SOC 2 report. On-site audits are permitted with 30 days’ notice and at Customer’s expense.

10. Deletion and return

On termination of the service, Customer may export data via the app. After 30 days, Orbyt will delete Personal Data from production systems. Backups are purged within 90 days of their retention cycle.

11. Contact

For DPA questions or to request a signed copy, email legal@orbytjobs.ai. See also Privacy Policy and Terms of Service.