Privacy Policy

We collect information you provide directly when creating an account:

• Email address and display name
• Instagram session cookies (used only to operate your bot — encrypted at rest, separately from our general database encryption)
• Proxy URLs you configure
• Billing information processed by Stripe (we never store card details)

We also collect automatically:

• Usage data and bot activity logs to power analytics
• IP addresses for security and fraud prevention

Operating your automation also involves data about other Instagram accounts — see Section 2 below.

Operating your bot automation necessarily involves interacting with other Instagram accounts — the people who follow you, accounts you follow, competitor accounts you configure for targeting, and accounts associated with hashtags you track. None of these individuals are Orbora customers, and they have not created an account with us.

For these accounts, we store limited data — such as username, public profile information (bio, follower/following counts, profile picture), and interaction history (e.g. whether they followed back) — for as long as your bot account remains active. This data:

• Is collected only through the automation you configure, from information Instagram already makes publicly available
• Is used solely to operate your automation and power the analytics shown in your own dashboard (e.g. follow-back rate, competitor benchmarking)
• Is never sold, shared with third parties, or combined across different customers' accounts
• Is automatically deleted when you remove the associated bot account or delete your Orbora account

Our legal basis for this processing is legitimate interest (GDPR Art. 6(1)(f)): it is necessary to provide the automation service you've requested, is limited to information Instagram already displays publicly, and is scoped narrowly to what your configuration requires.

If you are one of these individuals — for example, a follower of an Orbora customer — and want data about your account removed, contact us at hello@orbora.io and we will remove it from the relevant customer's account.

Orbora is an independent service and is not affiliated with, endorsed by, or sponsored by Instagram or Meta Platforms, Inc. "Instagram" is a trademark of Meta Platforms, Inc.

We use collected data to:

• Operate, maintain, and improve the Orbora service
• Process payments and manage subscriptions via Stripe
• Send transactional emails (account confirmation, billing receipts)
• Provide customer support
• Detect and prevent abuse, fraud, or violations of our Terms

We do not sell your personal data to third parties.

Your data is stored on servers located in the European Union. We use Supabase for authentication and database storage, and apply industry-standard encryption for data in transit (TLS) and at rest.

Instagram session cookies are encrypted at rest with a dedicated key, separate from our general database encryption, and are never logged or transmitted outside our infrastructure. A database copy alone is not enough to recover a session — the encryption key is needed too.

We use the following third-party services:

• Stripe — payment processing. Subject to Stripe's Privacy Policy.
• Supabase — authentication and database hosting.

We use essential session cookies to keep you logged in. We do not use tracking or advertising cookies. No third-party analytics cookies are set on our site.

If you are located in the EU/EEA, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated data
• Object to or restrict certain processing
• Data portability

To exercise any of these rights, contact us at hello@orbora.io. If you are not an Orbora customer but your Instagram account has interacted with one of our customers' automations, see Section 2 for how to request removal instead.

We retain your account data for as long as your account is active. Upon account deletion, your personal data is removed within 30 days, except where we are required to retain it for legal or financial compliance.

Data about other Instagram accounts (Section 2) follows a shorter, activity-bound retention: it is deleted as soon as the associated bot account is removed, rather than waiting for a full account deletion.

Orbora is not directed at children under 16. We do not knowingly collect data from minors. If you believe a minor has created an account, contact us and we will delete it.

We may update this policy occasionally. We'll notify you of significant changes by email or a prominent notice in the dashboard. Continued use of the service after changes constitutes acceptance.

For privacy-related questions: hello@orbora.io