Privacy notice
1. Who we are
CÔNG TY TNHH ERPFIT (“we”) operates orb.vn and the orb apps, and is the controller of the personal data described here. Contact for anything about your data: info@erpfit.com.
2. Who can sign in today
orb is in a closed preview. Only people a team has invited can sign in; signing in with any other Google account is refused and nothing about that account is stored.
3. Signing in with Google
We ask Google only for openid, email and profile, and store:
- your name, email address, whether Google verified it, and the link to your profile picture;
- your Google account id and the tokens Google returns at sign-in — with these scopes they reach your basic profile only, never Gmail, Drive or contacts;
- your session: a random session token, its expiry, the IP address and the browser's user agent it was opened from.
4. Using the model gateway
When orb sends a request through orb.vn, the request — your message and whatever the task needs the model to see, such as file contents, page text or screenshots a tool read — is relayed to OpenRouter, Inc. (USA) and from there to the model provider that answers it. This is a transfer of data outside Vietnam. orb.vn does not store the request or the answer. It stores one usage record per call: time, model, token counts, cost, and the team, user and device it is charged to — and, when orb answered in a chat room bound to your team, that room and a reference to the room member whose message orb answered (their stored chat user id, never their name or message) — that is how team, room and per-person budgets work.
If you set your own model endpoint in the orb app, requests go straight from your computer to that endpoint and never pass through orb.vn.
5. On your own computer
The orb app keeps your conversations, the approvals you gave, and a receipt of every action it took (including its details, such as file paths, web addresses or text it typed) in a database on your device. These are not sent to orb.vn. The app deletes a conversation 90 days after its last message, chat-room messages and display names after 90 days, and receipts and approvals after 12 months. You can delete everything sooner by deleting the app's data folder.
The orb browser extension talks only to the orb app on the same computer. It sends nothing to orb.vn and works on your tabs only during a task you started; risky steps wait for your approval. orb never types a password and never solves a captcha — it hands those to you.
6. Team chat rooms
A team may connect orb to its own chat rooms (for example Zalo groups) as an assistant that says it is an AI. The team is responsible for telling its room members. For a connected room, orb.vn stores only the members' chat user ids and their role in the room, and, when a team admin links a chat user id to that person's own orb account, the link (a team owner or admin linked this way decides for the assistant in the team's rooms); message text and display names stay on the team's own computer running orb.
7. Why we use it, and what we never do
We use this data to provide orb to your team: to sign you in, to run your requests, to meter and cap spending, and to keep the service secure. We do not sell it, do not use it for advertising, and do not use it to train AI models. We share it only with the services named here (Google for sign-in, OpenRouter and the model provider for requests), or with a competent state authority when the law requires.
8. Where it is kept
The orb.vn server and its database run on a machine in Vietnam. Connections to orb.vn use HTTPS. If a security incident affects your personal data, we report it to the competent authority within 72 hours, as the law requires, and tell you when it can harm you.
9. Cookies
Only when you sign in: a session cookie (expires after 7 days without use) and a short-lived cookie that carries the sign-in state to Google and back. No analytics, advertising or tracking cookies.
10. How long
Account data is kept while you are a member of a team on orb; sessions expire after 7 days without use. Usage records are deleted after 24 months. On your computer, the orb app deletes old data on the schedule in section 5.
11. Your rights
Under Personal Data Protection Law 91/2025/QH15 you may ask to know, see, correct or delete your data, restrict or object to its processing, and withdraw your consent. Write to info@erpfit.com; we answer within the time the law sets. You can also remove orb's access at myaccount.google.com/connections, and complain to the competent authority.
12. Changes
When this notice changes in substance, the version at the top changes and we tell the teams using orb.