Privacy Policy
Last updated 9 October 2026
This policy explains what personal data Orbigate collects, why, who it is shared with, how long it is kept, and the rights you have. It applies to the website orbigate.com, the Orbigate app and the emails it sends.
1. Who we are
Orbigate is run by Eddie Nudel, an individual based in Israel ("we", "us"). We are the controller of the personal data described here.
Contact for anything about privacy, including requests to use your rights: eddie@orbigate.com.
We are not established in the European Union or the United Kingdom. People in the EU, the UK and elsewhere can contact us directly at the address above.
2. What we collect
| Data | Where it comes from |
|---|---|
| Account: name, work email, company name, a hashed password (we never see or store the password itself), the date you accepted these terms, and whether you opted in to product news | You, when you sign up |
| Google or Microsoft sign-in: your name, email and the account ID the provider gives us | Google or Microsoft, when you choose to sign in with them |
| Your workspace: company profile text, home country, search profiles, saved tenders, decision cards, notes, saved partners and email settings | You, while you use the app |
| Usage log: sign-ins, searches (keywords, countries, categories), cards created, errors, and daily counts of cards, translations and drafts | Recorded by the app while you use it |
| Dashboard activity: which screens you open, which buttons you use, and which getting-started steps you complete, with the time. We never record what you type into a field. | Recorded by the app while you use the dashboard |
| Beta feedback: what you send us from the Feedback bubble, with your name, email and the screen you were on | You, if you send feedback |
| Access requests: name, work email, company and your message | You, if you ask for an invitation |
| Invitations: the email address an access code was issued to, and which sign-up reminders we sent | Us, when we give you an access code |
| Emails: whether a digest, deadline or reminder email was sent to you, and your replies if you write to us | The app, and you |
| Technical data: IP address, browser and device details in our hosting provider's server logs | Your browser, automatically |
| Analytics: pages viewed, approximate location, device type, through Google Analytics cookies | Your browser, only if you accept analytics cookies |
Please do not put classified information, export-controlled technical data, or personal data about other people into your company profile or notes. Describe your company at the level you would use in a public brochure.
People named in tender notices
Public tender notices are published by contracting authorities and often include the name, work email and phone number of a contact person, and the names of companies that won contracts. Orbigate shows this information as it was published, so that suppliers can take part in public procurement. If you are named in a notice and want us to stop showing your details, write to us and we will remove them from Orbigate. The original notice stays with its publisher.
3. Why we use it, and our legal basis
| Purpose | Legal basis (GDPR and UK GDPR) |
|---|---|
| Create and run your account, run searches, generate decision cards, translations and drafts, send the emails you turned on (digest, deadline reminders) | Performance of our contract with you (Art. 6(1)(b)) |
| Keep the service secure, stop abuse, enforce daily limits, fix errors, understand which features are used so we can improve them | Our legitimate interests in running a secure, working service (Art. 6(1)(f)) |
| Reminder emails when you have not visited for a few days, up to 4 reminders (day 1, 3, 5 and 10) if you were given an access code and have not created an account, and service announcements | Legitimate interests; you can stop them with one click in every email |
| Product news and offers | Your consent (Art. 6(1)(a)), only if you ticked the box; withdraw any time |
| Google Analytics | Your consent through the cookie banner (Art. 6(1)(a)); withdraw any time under "Cookie settings" |
| Answer access requests, messages and beta feedback | Legitimate interests, or steps before a contract at your request |
| Keep records we must keep, deal with legal claims | Legal obligation (Art. 6(1)(c)) and legitimate interests |
We do not sell your personal data, we do not use it for advertising, and we do not make decisions about you that have legal or similarly significant effects by automated means. The fit scores on decision cards are about tenders, not about you.
4. Who we share it with
We use these service providers, who process data on our behalf under data processing terms:
| Provider | What for | Where |
|---|---|---|
| Netlify, Inc. | Hosting the website and app, running the server code, storing account and workspace data, server logs | United States and global edge network |
| Anthropic, PBC | The AI model that writes decision cards, translations, search help and email drafts. It receives the tender text and, for cards, your company profile and search context. Under Anthropic's commercial terms, this data is not used to train its models. | United States |
| Resend (Plus Five Five, Inc.) | Sending account, digest and reminder emails | United States |
| Google LLC / Google Ireland | Google Analytics (only with your consent), and Google sign-in if you use it | United States and EU |
| Microsoft Corporation | Microsoft sign-in, if you use it | United States and EU |
When you search, your keywords and filters are sent to the public procurement portals we search (for example TED, national portals and SAM.gov). They do not receive your name or email.
We may also disclose data if the law requires it, to protect our rights or the safety of others, or to a successor if Orbigate is transferred to a company we set up or to a buyer, who would be bound by this policy.
5. International transfers
We are based in Israel, which the European Commission and the UK recognise as giving adequate protection to personal data. Our providers in the United States receive data under the EU-US Data Privacy Framework (and its UK extension) where the provider is certified, and otherwise under the European Commission's Standard Contractual Clauses (and the UK addendum).
6. How long we keep it
- Account and workspace: until you delete your account. If an account is not used for 24 months we may delete it after emailing you first.
- Workspace backups (hourly copies so you can restore lost work): deleted with your account.
- Usage log and dashboard activity: 13 months, then deleted automatically.
- Beta feedback: as long as your account exists.
- Access requests: 12 months, then deleted automatically.
- Unused access codes: until the code is used or revoked. Sign-up reminders stop after the fourth, when you create an account, or when you click "Stop these reminders".
- Server logs: as set by Netlify, normally a few days to 30 days.
- Google Analytics: 14 months.
- Emails with us: as long as needed to deal with the matter, and up to 7 years where they relate to a legal claim or a payment.
When you delete your account in the app, your account, workspace, backups, usage counts, dashboard activity, feedback and email history are deleted straight away. Entries in the usage log that name you are removed when they reach the end of the 13-month period, and earlier if you ask.
7. Your rights
Depending on where you live (including under the GDPR, the UK GDPR and Israel's Privacy Protection Law), you have the right to:
- get a copy of your data (in the app: Account › Download my data);
- have wrong data corrected (most of it you can edit yourself in the app);
- have your data deleted (in the app: Account › Delete my account);
- receive your data in a portable format (the download is a JSON file);
- object to processing based on legitimate interests, and to direct marketing at any time;
- restrict processing in some cases;
- withdraw consent at any time, without affecting what was done before.
Write to eddie@orbigate.com for anything you cannot do in the app. We answer within one month. We may ask you to confirm your identity first.
You can also complain to a data protection authority: in the EU, the authority in the country where you live or work; in the UK, the Information Commissioner's Office (ico.org.uk); in Israel, the Privacy Protection Authority. We would appreciate the chance to sort it out with you first.
8. Security
All traffic is encrypted (HTTPS). Passwords are stored only as salted scrypt hashes. Sessions use signed, HTTP-only cookies. Repeated wrong passwords lock the account for 15 minutes. Access to stored data is limited to us. No system is perfectly secure; if a breach puts your data at risk, we will tell you and the relevant authorities as the law requires.
9. Cookies
We use one cookie to keep you signed in, one to remember your cookie choice, one for a few minutes during Google or Microsoft sign-in, and Google Analytics cookies only if you accept them. The app also keeps a copy of your last search and some display settings in your browser's local storage, so it opens faster. Details are in the Cookie Policy.
10. Children
Orbigate is a business service for people aged 18 or over. We do not knowingly collect data from children.
11. Changes to this policy
If we change this policy in a way that matters, we will tell you by email or in the app before the change takes effect, and ask you to accept it again where needed. The date at the top shows the latest version.
Questions: eddie@orbigate.com · Privacy Policy · Terms of Service · Cookie Policy