Data Processing Agreement

Effective: 2026-04-19. Applies to all Orbyt customers subject to GDPR (EU/EEA/UK), CCPA (California), or similar data-protection laws.

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Orbyt (a product of Purecraft LLC, “Orbyt”) and its customer (“Customer”). It governs the processing of personal data by Orbyt as a data processor acting on behalf of Customer as data controller.

1. Definitions

“GDPR” means the EU General Data Protection Regulation 2016/679. “CCPA” means the California Consumer Privacy Act. “Personal Data” has the meaning given in applicable law. “Sub-processor” means any third party engaged by Orbyt to process Personal Data on Customer’s behalf.

2. Scope and roles

Customer is the data controller and Orbyt is the data processor. Orbyt processes Personal Data solely to provide the Orbyt service, to comply with legal obligations, and on Customer’s documented instructions. Orbyt will not sell Personal Data or use it to train general-purpose AI models.

3. Categories of Personal Data

Personal Data processed by Orbyt typically includes: user account data (name, email, authentication tokens), job-search data entered by the user (applications, contacts, resumes, notes), device and usage telemetry (IP, browser, page views), and billing data processed via Stripe.

4. Sub-processors

Orbyt uses the following sub-processors: Vercel (hosting, U.S.), Supabase (database and auth, U.S.), Stripe (payments, U.S.), Resend (transactional email, U.S.), Upstash (Redis rate limits, U.S.), Sentry (error monitoring, U.S.), Anthropic / OpenAI (on-request AI features, U.S.). Orbyt binds each sub-processor to equivalent data-protection terms.

5. International transfers

Personal Data is stored in the United States. Transfers from the EU/EEA/UK to the U.S. are governed by Standard Contractual Clauses (Module Two: Controller to Processor) and the EU-US Data Privacy Framework where applicable.

6. Security

Orbyt implements appropriate technical and organizational measures including: TLS 1.2+ in transit, AES-256 at rest, Row Level Security on every database table, MFA for all production access, least-privilege IAM, SOC 2 Type II readiness (target Q3 2026), security.txt at /.well-known/security.txt for vulnerability disclosure.

7. Data subject rights

Customer and its end users may at any time: export all data via the app, delete their account (which removes Personal Data within 30 days), and request copies or corrections of Personal Data by emailing legal@orbytjobs.ai.

8. Breach notification

Orbyt will notify Customer without undue delay and in any event within 72 hours of becoming aware of a Personal Data breach affecting Customer data, along with information necessary to meet Customer’s own notification obligations.

9. Audits

Customer may request Orbyt’s latest SOC 2 report (once available) and written confirmation of sub-processor obligations once per year by emailing legal@orbytjobs.ai. On-site audits are permitted with 30 days’ notice and at Customer’s expense.

10. Deletion and return

On termination of the service, Customer may export data via the app. After 30 days, Orbyt will delete Personal Data from production systems. Backups are purged within 90 days of their retention cycle.

11. Contact

For DPA questions or to request a signed copy, email legal@orbytjobs.ai. See also Privacy Policy and Terms of Service.