Privacy policy

01Controller

Eduart Tuda (sole proprietorship Orbi)Oberfeldstrasse 958408 WinterthurSwitzerlandEmail: info@or-bi.ch

No data protection officer and no EU representative has been appointed; there is no legal obligation to do so.

02Two roles: who is responsible for which data

Orbi acts in two different roles. This is the most important statement in this policy.

• Orbi as processor: when a person calls a restaurant, a practice or a hotel that uses Orbi, or writes to that business via WhatsApp or web chat, that business is the controller of their data. We process the data solely on its behalf and according to its instructions, exactly as a telephone answering service or reservation software would. The business decides what the data is used for, sees the transcripts and bookings in its dashboard, and can have them deleted.
• Orbi as controller: we are responsible ourselves for this website, the contact form, activation requests, our customers' accounts and contracts, invoicing, and our own information line (+41 44 505 24 68, which Orbi answers itself).

What this means for you as a caller: the business you contacted is your point of contact for access, correction and deletion. It knows your booking and your messages and can view them in its dashboard. If you contact us instead, we forward your request to the business and help it respond, but we do not act without its instruction, because the data was entrusted to it.

We conclude a data processing agreement with every business (Art. 9 FADP, Art. 28 GDPR). It is available on request. The business remains responsible for informing its customers about the use of Orbi and, where required, for having a legal basis, in particular for health data (see section 4).

03Data for which Orbi itself is the controller

Visiting the website. When you open or-bi.ch or or-bi.al, our web server processes the IP address, browser type, page requested, referring page and time. These entries live in the server's access logs and serve secure operation and troubleshooting. They are deleted after 14 days and are not linked to any other data. There is no visitor analytics and no tracking (see section 8).

Contact form. Name, email address, phone number (optional) and message are stored in our database and delivered by email to our mailbox so that we can reply. The basis is handling your request (pre-contractual steps or legitimate interest).

Activation request. Anyone choosing a plan sends us their name, email address, phone number, business, town, the plan requested and a message. We store the request, send it to our sales mailbox and send you a confirmation in the language of the page. If the request is made from a logged-in account, it is linked to that account. The basis is concluding the contract.

Our information line +41 44 505 24 68. Orbi itself answers this number: you speak with an AI assistant that explains how Orbi works in your business. We process your phone number, the time, duration and language of the call, and the text transcript of the conversation. If you mention your business, industry, town, email address or interest in a plan during the call, this becomes an enquiry in our sales list, which we use, like a contact form, to get in touch, and which we send once by email to our sales mailbox. There is no audio recording (see section 5).

Account and registration. When you create an account we store name, email address, password (only as a bcrypt hash, never in clear text), name and type of business, phone number, town, market (Switzerland or EUR area) and the plan chosen. To confirm the email address and to reset the password we send links containing a random token; only its hash is stored, the link is valid once and expires shortly after sending. The basis is the contract.

Contract, usage and payment. The account includes the plan, subscription status, billing period, usage counters (call minutes, conversations and reminder calls per calendar month) and the Stripe customer ID. Payment runs through Stripe: you enter card and bank details exclusively on Stripe's pages; they never reach our systems. From Stripe we receive name, email address, plan, payment status and invoice events. The basis is the contract and statutory accounting obligations.

Trial. When a prospect receives a trial, we send a link that starts the trial only when a button is pressed (opening the email starts nothing). We store only a hash of the link; it is valid once and expires at the end of the day. During the trial, section 4 applies to the conversations: the prospect is the controller for the people who call its trial number.

Support chat in the dashboard. Questions you ask the Orbi support assistant in the dashboard are sent to Anthropic (section 6) to be answered and are not stored in our database. Your browser remembers a random session identifier (see section 8).

Emails from us. We send confirmation and password links, notices about staff notes (including the content of the customer message concerned), notices that a customer has written in a conversation the staff have taken over, usage notices at 80% and 100% of the allowance, trial invitations and confirmations of requests. They are sent through Brevo; replies land in our mailbox at Virtono and are forwarded to our Google mailbox (section 6). We do not send marketing newsletters.

04Data Orbi processes on behalf of businesses

Here the business you contact is the controller. What arises depends on the channel.

Phone. We process the caller's phone number (caller ID), time, duration, detected language and the text transcript of the conversation (what was said, in text form) as well as the outcome. What you tell the assistant during the call, such as name, callback number, date and time, number of people, requested service or order and special requests, is recorded as a reservation, appointment or order in the business's dashboard. If the assistant cannot answer something, it leaves a note for the staff. The call itself is not stored as an audio recording (section 5).

Reminder calls. Practices and salons can have Orbi call customers the day before an appointment. Orbi always states at the start who is calling and on whose behalf, asks for confirmation or cancellation (by voice or keypad 1/2) and writes the answer back to the appointment as text. If voicemail answers, Orbi leaves only the identification and tries again later. These calls are not recorded either.

WhatsApp. Your WhatsApp number, your messages and the assistant's replies are stored as a conversation history so that the assistant knows the context and staff can read the history and reply themselves. Messages travel via Meta's WhatsApp Business Platform to an automation layer (n8n) that we run ourselves on our server, and from there to Orbi. WhatsApp's own privacy policy applies to your WhatsApp account. Voice messages are converted to text as described in section 5; the recording is then discarded and only the text is stored.

Web chat on the business's website. We store your messages and the replies as well as a random identifier that keeps the history connected. Normally the chat assigns it per browser tab, so it disappears when the tab is closed. If the business offers its customer app on Orbi, the chat instead keeps a random device identifier in your browser's local storage so that you can continue the conversation later on the same device; we store only a one-way fingerprint (hash) of it, not the identifier itself. The chat sets no cookie and no IP address is stored. We only process your name or phone number if you provide them in the chat for a booking. If the business has switched on voice input, you can also speak a message: your browser asks for access to the microphone, the recording (60 seconds at most) is sent to Orbi, converted to text as described in section 5 and deleted immediately afterwards. Only the text you see in the chat as your message is stored.

Customer app and optional account. A business can offer its own app on Orbi, which you can add to your home screen and use without an account. If you create an account, we store your email address and your language and link your conversations with this business to the account, so that you can find them again on other devices. You sign in with a six-digit code or a link that we email to you; both are valid for 10 minutes and only once, and we store them only in a form that cannot be read back. A sign-in stays valid for 180 days or until you sign out (cookie, see section 8). If you allow notifications, your browser gives us an address at its push service; we use it only to show you “New reply from <business>” – the content of the message is never in the notification. With an account, if you have not seen a reply after 10 minutes, we send you a short email notice without the reply's content, at most one per hour; you can switch these emails off in the account at any time. An account always belongs to one business only; that business is the controller.

Knowledge base and business data. Menus, services, room categories, opening hours and knowledge entries that the business maintains in the dashboard form part of the instructions to the assistant. If they contain personal data (for example staff names), that data is processed on the business's behalf too.

Health data in dental practices and clinics. Practices can keep patient records (master data, treatments, findings, invoices) in the dashboard. If the assistant recognises a caller by phone number, it receives an extract of that record as context to conduct the conversation, for example the next appointment. This is sensitive personal data (Art. 5 let. c FADP, Art. 9 GDPR). The practice is responsible for being allowed to collect this data and for informing its patients about Orbi; we process it only on its instruction, store it on our server in Germany and send the extract exclusively to Anthropic to formulate the reply (section 6). A call never creates or changes a record: a call from a wrong number does not make anyone a patient.

Test chat for businesses. The test assistant in the dashboard behaves like the real one but saves nothing as a booking or conversation; the messages are only sent to Anthropic to be answered. Only the number of test messages per month is counted.

You are speaking with an AI assistant. It makes no decisions with legal effect for you: it records what you tell it, and every booking is visible to and editable by the business's staff. No profiling takes place.

05No audio recording: how speech is processed

Orbi stores no call recordings. What remains of a call is the text transcript and the booking that resulted from it, both visible in the business's dashboard.

• Swiss German and German are converted to text primarily on our own hardware in Winterthur (Switzerland), using a speech recognition model specifically adapted to Swiss German. The caller's speech also goes to Deepgram (USA) in two cases: at the start of every call, while it is not yet established which language the conversation is in, for language detection in parallel with our model; and when our hardware is unavailable or does not respond in time — Deepgram then converts the affected parts of the call to text.
• English, Italian and Greek are transcribed by Deepgram (USA). In every case only the caller's speech is transmitted, streamed or as short segments, never the whole call as a file.
• WhatsApp voice messages and recordings from voice input in the web chat are converted in the business's language: German primarily on our own hardware in Winterthur (with Deepgram, USA, in parallel for language detection and as a fallback), English and Italian by Deepgram (USA), Albanian and Greek by Azure Speech (Microsoft, Sweden region), with Deepgram as the fallback for Greek. The recording is used only for the conversion and is not stored; the text remains.
• None of these services keeps the recordings: every request to Deepgram is excluded from its model improvement programme, and Deepgram retains the data only for as long as is needed to process the request; we use Azure Speech in a mode in which Microsoft neither retains nor stores the data provided.
• The assistant's replies are turned into speech by Azure Speech (Microsoft, Sweden region). Only the text of the reply is transmitted.
• The phone line itself is provided by Twilio. Depending on the line, Twilio either streams the audio live to our server without storing it, or short recordings of each utterance are created at Twilio, which we delete immediately after conversion to text, whether it succeeded or not. A safety mechanism deletes, within a few minutes of its creation, any recording that would still exist, and every failure to delete is logged.

The same applies to calls to our own information line.

06Processors and recipients

We use the following service providers. All are contractually bound as processors and may use the data only for the stated purpose. There are no other recipients; we do not sell data and disclose it to authorities only when legally obliged to.

Which push service is used is decided by your browser, not by us. It receives only the push address and an encrypted notice that it cannot read.

Under its commercial terms, Anthropic does not use the transmitted data to train its models. The automation layer for WhatsApp (n8n) and the database are run by us on the Hetzner server; they are not third parties.

07Transfers abroad

From a Swiss perspective, Germany, Ireland, France, Sweden and Romania provide adequate data protection (Annex 1 of the Data Protection Ordinance) and belong to the EU area. The push services of the browser makers (section 6) may process your browser's push address in the USA; the notice itself is encrypted end to end.

Anthropic, Deepgram and Twilio are located in the USA. These transfers are covered by the EU standard contractual clauses with the addendum required for Switzerland, supplemented, where the provider is certified, by the Swiss-U.S. Data Privacy Framework. Copies of the safeguards are available on request.

Businesses that do not want any transfer to the USA cannot use Orbi in this form: Anthropic's language model is the core of the assistant. We prefer to say this here rather than in a contract annex.

08Cookies and local storage

We set only what running the application requires. There are no analytics, advertising or third-party cookies, no tracking pixels and no fonts loaded from foreign servers. That is why there is no cookie banner.

• Local storage (localStorage) in the dashboard: a random identifier for the support chat, not linked to a person.
• Session storage (sessionStorage) in the web chat on a business's website: a random identifier per browser tab that disappears when the tab is closed. If the business offers its customer app, the chat and the app instead keep a random device identifier in local storage (orbi_device_…) so that the conversation can be continued on this device; it disappears when you clear the browser's data for the site.
• A service worker stores application files (scripts, icons) in the browser so it starts faster; it contains no personal data.
• The customer app's service worker also receives the notifications you have allowed and displays them.
• On Stripe's payment pages, Stripe's own cookies and privacy notices apply.

09Retention and deletion

When an account is deleted, all data linked to it, including conversations, bookings, notes, records and settings, is deleted from the database with it.

10Data security

All connections are encrypted with TLS, including the live transmission of call audio and the connection to our speech recognition in Winterthur. Passwords are stored only as bcrypt hashes; confirmation, reset and trial links only as hashes and valid once. Credentials for service providers are stored encrypted in the database. Each business's data is strictly separated by business in the database; every query is bound to the business. Access to the server and the administration interface is limited to the owner and secured with keys and server-side sessions.

11Your rights

You have the right to know whether and which data we process about you (Art. 25 FADP, Art. 15 GDPR), to have it corrected, to have it deleted, to have processing restricted, to receive or transfer your data in a common format (Art. 28 FADP, Art. 20 GDPR) and to object to processing. You may withdraw consent you have given at any time.

Write to info@or-bi.ch or to the postal address in section 1. We reply within 30 days. For security we must be able to verify your identity before providing information. Access is generally free of charge.

If your request concerns data from a call or chat with a business that uses Orbi, it is best to contact that business directly: it is the controller and can see and delete your booking and your messages in its dashboard. If you write to us, we forward your request.

If you have an account in a business's customer app, you can delete it yourself at any time in the account. This immediately removes the account, your email address, all sign-ins, login codes and push addresses. Your conversations stay with the business, but no longer linked to you or your email address; if you want them deleted too, contact the business (or us, and we will forward the request).

You may also complain to the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch); within the scope of the GDPR, to the supervisory authority of your place of residence.

12Minors and changes

Our services are aimed at businesses. We do not knowingly collect data from children; a child calling a restaurant is treated like any other caller, and the business remains the controller.

We update this policy when Orbi changes, for example when a new service provider is added or a channel is dropped. The version published here with the date stated above is the governing one.