Privacy Policy

1. Introduction

OrbiLattice, Inc. ("OrbiLattice," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our real estate CRM platform and services (collectively, the "Services").

2. Information We Collect

Personal Information

We collect personal information that you provide directly to us, including:

• Account information (name, email address, phone number, password)
• Profile information (company name, role, profile picture)
• Contact information for your clients and leads
• Property information and transaction data
• Payment and billing information
• Communications and support requests

Automatically Collected Information

When you use our Services, we automatically collect:

• Device information (IP address, browser type, operating system)
• Usage data (pages visited, features used, time spent)
• Location information (if enabled)
• Cookies and similar tracking technologies

Third-Party Data Sources

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our Services
• Process transactions and send notifications
• Provide AI-powered features, including lead scoring, property enrichment, and document intelligence
• Respond to your requests and provide support
• Send administrative information, updates, and security alerts
• Analyze usage patterns to improve user experience
• Comply with legal obligations and enforce our terms
• Send marketing communications (with your consent)

4. AI and Machine Learning

Our platform uses artificial intelligence and machine learning to provide intelligent features such as lead scoring, property valuations, and document extraction. We process your data using:

• Proprietary AI models trained on anonymized, aggregated data
• Third-party AI services (OpenAI, Anthropic) with strict data processing agreements
• Confidence-weighted transparency to show reasoning behind AI recommendations

4A. AI Email Processing (GDPR & CCPA Compliance)

When you enable AI-powered email features, we process email content to provide intelligent assistance. This section provides detailed information about how your email data is handled in compliance with GDPR, CCPA, and other privacy regulations.

Legal Basis for Processing

We process email content under the following legal bases:

• Explicit Consent (GDPR Article 6(1)(a)): AI email processing requires your explicit opt-in consent, which can be withdrawn at any time.
• Contract Performance (GDPR Article 6(1)(b)): When AI features are necessary to provide the services you requested.

What Email Data is Processed

• Email body text and subject lines
• Sender and recipient information
• Email thread context (for contextual responses)
• Attachment metadata (not full attachments unless explicitly enabled)

How Email Data is Processed

• Draft Assistance: AI analyzes email content to suggest responses and identify action items.
• Summarization: Email threads are summarized for quick context review.
• Lead Intelligence: Email interactions inform lead scoring and follow-up recommendations.

Third-Party AI Processors

Email content may be sent to the following third-party AI providers for processing:

• OpenAI: GPT-4 and GPT-4o-mini models for text analysis and generation. OpenAI retains API data for 30 days only for abuse monitoring, does NOT train models on your data, and permanently deletes data after 30 days.

Data Minimization

We apply data minimization principles to AI email processing:

• Only the minimum necessary email content is sent for AI analysis
• Payment information, passwords, and highly sensitive data are automatically filtered before AI processing
• Email content is not stored after AI processing is complete

Your Rights Regarding AI Email Processing

• Consent Withdrawal: You may withdraw consent for AI email processing at any time via Settings → AI Privacy & Data. This will immediately disable AI email features.
• Access: Request a copy of any email data processed by AI.
• Deletion: Request deletion of AI interaction history related to emails.
• Object: Object to specific AI processing activities (e.g., lead scoring based on email content).

Audit & Transparency

• All AI interactions are logged with correlation IDs for audit purposes
• You can view your AI interaction history in the Mission Control dashboard
• AI decisions (like lead scores) include explainability information showing reasoning

5. Data Sharing and Disclosure

We may share your information with:

• Service Providers: Third-party vendors who perform services on our behalf (hosting, analytics, payment processing, customer support)
• Integrated Services: Third-party applications you connect to our platform (with your explicit consent)
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• Legal Compliance: When required by law or to protect rights and safety
• With Your Consent: For any other purpose disclosed to you with your consent

6. Data Security

We implement industry-standard security measures to protect your information, including:

• Encryption in transit (TLS 1.3) and at rest (AES-256)
• SOC 2 Type II compliance
• Regular security audits and penetration testing
• Role-based access controls and audit logging
• Multi-factor authentication (MFA)
• Employee security training and background checks

7. Data Retention

We retain your information for as long as necessary to provide our Services and comply with legal obligations. Specifically:

• Account information: Duration of your subscription plus 30 days
• Transaction records: 7 years (legal requirement)
• Usage data and logs: 90 days (except where longer retention is required)
• Backup data: 30 days after primary deletion

8. Your Privacy Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal information
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your information
• Portability: Request transfer of your data in a structured format
• Opt-Out: Opt out of marketing communications or data sales
• Restriction: Request restriction of processing

9. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs)
• Data Processing Agreements (DPAs)
• Compliance with GDPR, CCPA, and other applicable regulations

10. Children's Privacy

11. Changes to This Privacy Policy

12. Contact Us

If you have questions about this Privacy Policy or our privacy practices, contact us: