# RM Orbit privacy notice Effective 21 August 2026. **Short version.** RM Orbit apps are run by Rang & Mall Private Limited from servers in India. We store what you put into each app (mail, files, meetings, documents, invoices, tasks, contacts) plus your account and sign-in records. AI features run on our own servers unless a page says otherwise. We do not run advertising, do not sell data, and do not use your content to train models. You can export or delete your data by asking us. ## 1. Who is responsible Rang & Mall Private Limited (CIN U47912AP2026PTC123400), D.No 32-10-23/13, Flat No S2, Sai Balaji Enclave, Sheelanagar, Pendurthi, Visakhapatnam 530012, Andhra Pradesh, India. Email founder@freedomlabs.in. When you use an Orbit app through your employer's or client organisation's workspace, that organisation decides why your data is processed and we process it on its behalf. Contact the organisation first for access or deletion; we will help them respond. When you use an app on your own, we are the controller (the data fiduciary under Indian law). ## 2. Where data is stored On servers operated by Rang & Mall in India, behind Cloudflare. If you are in the United Kingdom or the European Union, your data is transferred to India, which has no UK or EU adequacy decision. Business customers can sign the UK International Data Transfer Addendum or the EU Standard Contractual Clauses with us. Individual users rely on this notice and on their agreement to the transfer. ## 3. What each app stores | App | What it stores | Where AI runs | | --- | --- | --- | | Gate (sign-in) | Email, name, hashed password, organisation membership, multi-factor enrolments (authenticator app or push device), sign-in history, OAuth consents | No AI | | RM Mail | Your mailboxes: messages, attachments, contacts, labels, rules, drafts; send and receive logs | Local server (triage labels, summaries); can be turned off per mailbox | | RM Meet | Meeting metadata, chat, participants, and, only when a host turns them on, recordings, captions, and notes | Local server (captions, notes) | | RM Drive | Files and folders you upload, share links, data-room viewer events (who opened what, when), file-request uploads, locked-note ciphertext (we hold ciphertext, salt, and iv; we cannot read the note) | Local server (tags, summaries, search embeddings) | | RM Editor-Pro | Boards you draw: strokes, text, shapes, and any images you paste into them; board thumbnails and summaries; version history; who a board is shared with; share links and how many times each was opened. While a board is open, your name and cursor position are shown to the others in it and are not stored | Local server (handwriting transcription, board outlines, summaries) | | RM Sign | Documents sent for signature, signer names and emails, signatures, and the audit trail (time, IP, device) | No AI | | RM Bills | Client names, addresses, tax identifiers, invoices, payments, and portal sign-in links | No AI | | RM Calendar and Folio | Events, availability, bookings, booker names and emails, and, if you connect it, your Google Calendar data | No AI | | Atlas, Writer, Planet, Nest, Learn | Projects and tasks, documents, CRM contacts and companies, chat messages, documentation reading | Local server for summaries and drafting | | RM Cloud console | Client organisation contacts, server inventory, usage and billing figures, support tickets | No AI | | RM Fonts | Nothing about you; a public specimen page | No AI | Across all apps: IP address, browser details, and timestamps in server logs, kept for up to 180 days as Indian cybersecurity rules (CERT-In Directions 2022) require. ## 4. Why we process it To run the app you asked for; to keep accounts secure and detect abuse; to send service messages (sign-in codes, share notifications, invoices, meeting invites); to meet legal duties (tax records, lawful requests); and, with your separate consent only, to send product news. We do not use your data for advertising, do not sell or rent it, and do not use your content to train AI models. ## 5. Who else processes it Listed with purpose and location on the [sub-processors page](/legal/orbit/sub-processors). In short: Cloudflare (network security and delivery), Resend (outbound email from rmmail.in addresses), Google (only if you connect Google Calendar), and the coturn relay we run ourselves for Meet. AI runs on our own servers. ## 6. Sharing you control Share links, data rooms, meeting invites, booking pages, and invoice links disclose data to the people you send them to. Data rooms tell viewers that their viewing is logged before they enter. Disconnect or revoke a share at any time in the app. ## 7. Recording and captions Meet records or transcribes only when a host switches it on. Everyone in the room sees an indicator for the whole duration and a notice on joining. Some places require every participant's consent; hosts are responsible for obtaining it. ## 8. Cookies and tracking Only the cookies or browser storage needed to keep you signed in and to protect forms. No advertising cookies, no third-party analytics. Details on the [cookies page](/legal/orbit/cookies). ## 9. How long we keep data Per the [retention schedule](/legal/orbit/retention). Account data for the life of the account plus 30 days; invoices 8 years (tax law); logs 180 days; recordings 90 days by default. ## 10. Your rights Wherever you live you can ask for a copy of your data, correction, deletion, a stop to a particular use, or withdrawal of consent. Email founder@freedomlabs.in from your account address; we verify identity and respond within 30 days. UK and EU users can also object, restrict, and complain to the ICO or their supervisory authority. Indian users can escalate to the Data Protection Board of India once it is operational. California users: we do not sell or share personal information and we honour Global Privacy Control. See the [grievance page](/legal/orbit/grievance). ## 11. Children Orbit apps are for people aged 18 and over. We do not knowingly hold data about anyone under 18. Tell us and we will delete it. ## 12. Security HTTPS everywhere, hashed passwords, multi-factor authentication available to every account and required for administrators, tenant isolation at the database layer, restricted production access, and incident reporting as the law requires. Report vulnerabilities through the [security page](/legal/orbit/security). ## 13. Changes We post changes here with a new effective date and email account holders before material changes take effect.