Skip to content
orbular

Effective 24 October 2026

Privacy Policy

How Orbular handles personal information when you use the service.

1. Who operates Orbular

Orbular is operated by Aditya Tendulkar, a sole trader based in New Zealand. For privacy questions, requests, or concerns, contact hello@adityatendulkar.com.

In this policy, “Orbular”, “we”, “us”, and “our” mean the operator and the Orbular service. “You” means a person who visits the public website or uses an Orbular account or integration.

2. Information we collect and where it comes from

We collect information that you provide, that is created when you use Orbular, or that you choose to connect from another service. This can include:

  • Account and profile information: information from Firebase Google authentication, such as your email address, display name, and profile photo, plus your saved IANA time zone and answers to the onboarding questions.
  • Workspace information: workspaces, membership and role information, invitations, shared documents and attachments, trackers, fields, records, notes, templates, and other content that you or collaborators put into Orbular.
  • Google Calendar information: if you connect Calendar, your Google account email, selected calendar, and an encrypted stored refresh token. When the connection is used, Orbular can read writable calendars and relevant event details such as title, start, end, location, and link, and can create events using the title, date, times, location, and description you submit.
  • Telegram information: Telegram account and chat identifiers, including identifiers for chats or groups you choose, source checklist messages, checklist and reminder content, delivery state, and the Telegram conversations and drafts needed to provide the integration.
  • AI content: prompts, relevant workspace content, tool inputs and results, Telegram messages, bounded recent chat history, and pending drafts when you use Orbular AI or the Telegram assistant. The assistant can use calendar information when you ask it to do so.
  • Billing information: subscription, workspace billing, and Stripe customer or subscription identifiers when paid features are enabled. Stripe handles payment card details through its checkout or billing services. Orbular does not store your full card number.
  • Technical information: cookies and similar browser or session data, device and browser information made available to the hosting or runtime environment, and operational request or error information needed to run, secure, troubleshoot, and improve the service.

Information may also come from workspace members who invite you, share content with you, or use a connected integration. If another person adds your information to a workspace or message, that workspace or chat may be able to show it to you and other authorised participants.

3. How we use information

We use information to:

  • create and secure accounts, authenticate users, and maintain sessions;
  • provide workspaces, trackers, records, documents, attachments, collaboration, invitations, and sharing features;
  • save your preferences, including your time zone, and operate reminders, schedules, and calendar features;
  • connect to Google Calendar when you authorise that optional connection, read the calendar information needed for a requested feature, and create events you request;
  • send invitations and service messages, including by email or Telegram when you enable those integrations;
  • provide AI-assisted tracker, workflow, record, calendar, and Telegram features, including validating, metering, and protecting AI requests;
  • process subscriptions, billing access, refunds or account support, and payment-related webhooks through Stripe when billing is enabled;
  • detect misuse, protect users and workspaces, investigate errors, maintain service continuity and business records, respond to requests, and comply with applicable law; and
  • operate and maintain the service. We do not sell personal information, use it to serve advertising, or train our own AI models on it.

Some information is required for an account or feature to work. Google Calendar, Telegram, AI, and paid subscriptions are optional integrations or features. If you do not provide information or grant a requested permission, the associated feature may not be available.

4. Google sign-in and optional Google Calendar access

Google sign-in is provided through Firebase Authentication. You can also choose to connect Google Calendar separately. The Calendar connection requests OpenID and email identity information, permission to read your writable calendar list, and permission to read and create calendar events. Orbular uses those permissions only to provide the Calendar features you request, such as showing events, creating events, selecting a writable calendar, and supporting calendar-aware reminders or assistant requests.

Orbular stores your Google account email, selected calendar, and an encrypted refresh token so the authorised connection can continue to work. Orbular exchanges access with Google when needed and does not request unrelated Google Drive, Gmail, contacts, or file permissions. Calendar event details may be included in a response to you, sent to a Telegram chat you select, or supplied to the AI workflow described below when you request a calendar or assistant feature.

Orbular's use of information received from Google APIs is governed by the Google API Services User Data Policy, including its Limited Use requirements, and the Google Workspace API User Data and Developer Policy. These policies restrict the permitted purposes, transfers and human access to Google user data. Linking to them does not mean Google has verified or endorsed Orbular.

You can disconnect Google Calendar in Orbular settings. Disconnecting removes the stored Calendar connection and attempts to revoke its token. It does not delete events in Google Calendar, copies already sent to Telegram, or conversation history that already contains calendar information. You can also review or revoke third-party access from Google Account connections. Revocation may stop future access, but does not by itself delete information already held by Orbular, Telegram, or other recipients.

5. AI and Telegram

Orbular's AI features send requests through OpenRouter. Requests can include your prompt, relevant tracker or workspace content, tool definitions and results, calendar events or an agenda, and relevant Telegram conversation history. OpenRouter dynamically selects an endpoint serving the model configured for the feature and can fall back to another available provider. The possible recipients therefore depend on the model, available endpoints and routing at the time of a request, rather than one fixed provider. See OpenRouter's provider directory and provider routing information for its provider set and selection process.

OpenRouter and the selected provider process content under their terms and privacy practices, which can differ in retention, training and other data use. Orbular does not display the selected endpoint before each request or currently enforce a universal no-training or zero-retention setting. Read OpenRouter's data-handling information and the relevant provider's policies. Contact us before submitting sensitive information if you need a fixed recipient or specific data-use safeguards.

When you connect Telegram, Orbular stores account and chat identifiers, checklist and reminder content, delivery state, and the conversation state needed to operate the bot. Stored Telegram AI conversation history and pending AI drafts are retained for up to one year (365 days) from the conversation's recorded retention start. Continued activity does not extend that limit. Expired conversation state is excluded from use and removed by scheduled cleanup. It may be removed earlier because of history-size limits, chat limits, unlinking or a deletion request; this is not a guaranteed one-year message archive.

Conversation expiry does not delete saved tracker records, documents, checklists, reminder schedules or Google Calendar events. It does not control copies or retention periods held independently by Telegram, OpenRouter or downstream AI providers. Telegram processes messages under its own policies.

Telegram messages are visible to the audience of the chat. If you choose a group, that can include group members and administrators, not only you. Calendar information and AI results sent to a chosen chat can therefore be seen, copied, or retained by those participants. Unlinking Telegram pauses delivery but preserves Orbular records and schedules, and does not remove messages or copies already held by Telegram or chat participants.

You are responsible for having the authority to submit workspace, calendar, Telegram, or other people’s information to an AI or integration feature, and for checking the result before relying on it. AI output may be incomplete or wrong.

6. When we share information

We share information only as needed to provide the service, at your direction, or for the purposes described here. Recipients can include:

  • Firebase and Google, for authentication and the Google permissions you authorise;
  • Supabase and its PostgreSQL services, for application data storage;
  • Render, for hosting and running the service;
  • Resend, for invitation emails when that feature is used;
  • Stripe, for optional subscriptions, checkout, billing portal, and payment processing. Stripe handles card details rather than Orbular storing full card numbers;
  • Telegram, for messages, reminders, checklists, chat identifiers, and content you direct to selected chats;
  • OpenRouter and dynamically selected model providers or fallback endpoints, for AI requests you start; and
  • external MCP clients that you or a workspace administrator authorise. An authorised MCP client can read or mutate workspace data according to its granted scope and Orbular permissions. That client may keep its own copies under its own policies.

We may also disclose information where lawfully necessary to comply with law, protect the service or people, or investigate abuse or security incidents. Any disclosure of Google API data must also meet Google's applicable restrictions. If the service is transferred to another operator, we will give appropriate notice and obtain prior explicit consent for Google API data transfers where Google's policies require it. We do not share personal information with unrelated third parties for their own advertising.

7. Overseas processing

Service providers and connected services may process information outside New Zealand. Locations depend on the provider, account configuration, model provider and technical operation; use of Orbular does not mean your information is stored only in New Zealand. Cross-border processing and the safeguards that apply differ between providers. Contact us if you need information about a particular transfer before using an integration. Overseas handling remains subject to our obligations under applicable New Zealand privacy law.

8. Cookies, local storage, and operational logs

Orbular uses necessary cookies for authentication and sessions, active workspace selection, and short-lived security state during flows such as Google OAuth. Your browser may also retain local or session storage for preferences and interface state, such as theme, sidebar or tracker ordering, and a safe sign-in destination. This browser storage is not a substitute for the account data stored by Orbular.

Orbular does not currently add advertising or analytics cookies. Hosting and application systems may keep request and error logs for security, diagnosis, reliability and abuse prevention. The information and retention periods in provider logs depend on the provider and the relevant service.

9. Retention and deletion

We keep personal information only for as long as reasonably needed for the purpose for which it was collected, to provide requested services, maintain security, resolve disputes or meet legal, accounting and tax obligations. Retention depends on the information and the account or workspace involved.

To request account or personal-information deletion, email hello@adityatendulkar.com. We may need to verify your identity and explain any information we must lawfully retain, including transaction or security records. Self-service account deletion is not currently available.

Removing information from Orbular does not necessarily remove copies held independently by Google, Telegram, AI providers, Stripe, Resend, MCP clients, collaborators or chat participants. You may need to contact those recipients separately. Where backups exist, deletion from backup copies may not be immediate. Disconnecting an integration is not the same as deleting content.

10. Access, correction, and complaints in New Zealand

Under the New Zealand Privacy Act 2020, you can request access to personal information we hold about you and ask us to correct it. Email hello@adityatendulkar.com with enough information for us to identify the account and verify your identity. We will respond within the timeframes required by law. If a lawful exception limits access or a correction is not made, we will explain the reason and any right to attach a statement of correction.

If you are not satisfied with our response, please tell us first so we can try to resolve the concern. You can also contact the New Zealand Office of the Privacy Commissioner. Nothing in this policy limits rights you may have under applicable New Zealand law.

11. Security

We use measures appropriate to the service and the information involved, including authenticated access, workspace role checks, short-lived OAuth security state, bounded requests, and encryption for stored Google refresh tokens. Access to workspace content is intended to follow workspace permissions. No online service or storage system is completely secure, and we cannot guarantee that information will never be accessed, lost, altered, or disclosed despite reasonable safeguards.

If you think an account, integration, or workspace has been compromised, contact us promptly at hello@adityatendulkar.com and disconnect the affected integration where possible.

12. Children

Orbular is a general productivity service, not a service directed to children. Do not use it to submit a child’s personal information unless you have the authority to do so. If you believe a child’s information has been provided to us without an appropriate basis, contact us so we can review it.

13. Changes to this policy

We may update this policy when the service, providers, integrations, or legal requirements change. We will publish the updated version on this page and change the effective date. If a change materially affects how we use information, we will take any additional notice steps required by law or reasonably appropriate to the change.

For the terms that govern use of Orbular, see the Terms of Service.