Privacy Policy

2.2. USERORBIT BUILDER CHROME EXTENSION

The Userorbit Builder Chrome extension enables authenticated Userorbit workspace members to create, edit, record, and preview product tours and interactive demos inside web applications they choose and are authorized to use.

When a workspace member opens the tour builder or explicitly starts an interactive-demo recording, the extension may Process:

• the current page and frame URLs, page title, viewport, and capture timestamps;
• page content and resources needed to reproduce the selected experience, including HTML/DOM, visible text, styles, images, fonts, media, and embedded frames;
• screenshots of the visible page;
• user-initiated clicks, changed-field interactions, element selectors, labels, geometry, and interaction-replay events recorded while the visible recorder is active;
• tour and demo content and configuration created by the workspace member; and
• a short-lived Userorbit builder token used to authenticate requests.

The extension stores recoverable recording drafts locally in the browser before the member finishes or discards a recording. When the member finishes the recording, captured content and assets are transmitted over HTTPS to Userorbit and the infrastructure and storage providers used to deliver the Service(s). The extension does not collect a member's browsing history in the background.

Interactive-demo recording begins only after the member selects a demo and page, reviews the in-extension capture disclosure, confirms they understand the capture and have permission to record the page, and selects Start Recording. A visible recorder bar remains on the page while recording and provides controls to pause, resume, finish, or discard the recording.

Workspace members must not record passwords, payment or financial data, health data, private communications, or other sensitive information and must have all notices, consents, and authority required to capture the selected page. Customers should use synthetic or sanitized demo data and can mark page regions for masking using Userorbit's available masking controls.

We use extension information only to provide, maintain, secure, support, and improve Userorbit's product-tour and interactive-demo authoring, playback, and publishing features. We do not sell extension information or use or transfer it for personalized advertising, retargeting, credit decisions, or purposes unrelated to these features.

We disclose extension information only to infrastructure and storage providers that Process it on Our behalf to deliver the Service(s); when required by applicable law; when necessary to protect the Service(s), users, or others against security threats, fraud, or abuse; or as otherwise described in this Policy. We do not permit humans to read captured user data except with the user's explicit consent for support, when necessary for security or legal compliance, or after the data has been aggregated and anonymized for permitted internal operations.

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Uploaded tour and demo data follows the retention and deletion controls of the applicable Userorbit workspace and the retention terms in this Policy and Our Terms of Use. Members can delete the applicable tour or demo, and account administrators can request account deletion, subject to legal and contractual retention obligations. Unfinished local recording drafts are removed when the member discards or completes them and may also be removed by the extension's stale-draft cleanup.

2.3. PUBLISHED INTERACTIVE DEMOS

When an End-User opens or interacts with a published interactive demo, We create a demo session and may Process the demo, collection, flow, step, and capture identifiers; the referring page; browser and device information such as the user-agent; event timestamps; and engagement events such as screens viewed, hotspot clicks, steps completed, demo completion, and dismissal. Our hosting and security providers may also Process standard network request information, including IP addresses, to deliver and protect the Service(s).

Published demos do not require an End-User to provide a name or email address by default. A Subscriber may configure a lead form that asks for information such as name, business email address, company, phone number, custom form responses, and consent responses. When an End-User submits that form, the information is provided to the Subscriber and may be stored in the End-User's browser so that a configured demo can prefill the form or recognize a repeat submission.

For this demo-viewer and lead information, the Subscriber is the Controller and Userorbit Processes the information as its Processor to deliver the demo, provide engagement analytics, and operate configured lead-capture features. The Subscriber is responsible for its notices, consents, legal basis, demo configuration, and use of the information. We do not sell this information, use it for Our own advertising, or use it to track End-Users across unrelated websites.

An End-User who wishes to exercise rights concerning information collected through a Subscriber's demo should contact that Subscriber. If the End-User contacts Userorbit, We will direct the request to, or help address it on behalf of, the applicable Subscriber as required by applicable law and Our agreement with that Subscriber.

2.4. SUPPORT, FEEDBACK, ANALYTICS AND AI FEATURES

Support conversations and privacy requests may include Your email address, account or workspace information, message subject and content, attachments You choose to provide, and request status. We use this information to respond, identify the relevant account, resolve issues, and document Our response. Feedback and survey features Process submitted text, responses, contact details and associated account information to provide those features.

When a Subscriber enables product analytics or session replay, Userorbit Processes usage events, timestamps, page and device information, identifiers, and recorded page content and interactions to provide reports and recordings for that Subscriber. Recorded content may contain Personal Data. The Subscriber determines its configuration and purposes and is responsible for the applicable notices, lawful basis and consent. Userorbit acts as its Processor. Session replay is distinct from member-initiated demo recordings described in Section 2.2.

On Our marketing Website(s), optional analytics and session replay help Us understand visits and interactions and improve the Website(s). These tools load only after the applicable cookie choice. Microsoft Clarity provides website session replay, and Google Analytics provides website analytics. Optional support widgets load according to Your separate support preference. See Section 10 for Your choices. We disable optional tracking, replay and chat widgets on Our Privacy requests page.

AI features use OpenAI to generate responses and content, retrieve relevant help articles, and create voice-overs and visuals. Depending on the feature used, information sent for processing may include help article and feedback titles and text, support subjects and messages, help questions, conversation context and tool inputs and outputs, spoken scripts and voice instructions, and image or design prompts and supplied images. These inputs may contain Personal Data or confidential information; text truncation does not anonymize them. Avoid including information that is unnecessary for the requested feature.

Where AI Processes a Subscriber's Customer Data, We Process that data on the Subscriber's behalf to deliver the selected feature. For Our own account, support and privacy-request administration, We act as Controller. You can exercise applicable rights using Our Privacy requests page. Provider and transfer information is available through Our Subprocessors page, and customer processing terms through Our DPA page.

5. LEGAL BASIS FOR PROCESSING (EEA REGION)

5.1. If You are a data subject from the European Economic Area, Our legal basis for collecting and using the Personal Data described above will depend on the Personal Data concerned and the specific context in which We collect it.

5.2. We will normally collect Personal Data from You only where it is needed to perform a contract with You, where the Processing is in Our legitimate interests and not overridden by Your data protection interests or fundamental rights and freedoms, or where We have Your consent. In some cases, We may also have a legal obligation to collect Personal Data from You. If We Process Personal Data with reliance on Your consent, You may withdraw Your consent at any time.

6. INTERNATIONAL TRANSFER

6.1. Personal Data may be Processed in countries other than Your own by Userorbit and its service providers. The providers and their purposes are described on Our Subprocessors page. Our infrastructure includes Heroku hosting in the United States and Amazon Web Services infrastructure in Northern Virginia, United States. Our Cloudflare R2 replay bucket is located in Western Europe (WEUR). These locations describe those components; they do not establish the processing locations of every provider or a service-wide residency guarantee. If You require hosting or processing in a specific region, contact support@userorbit.com. We review constrained hosting requirements case by case and agree the applicable service scope and arrangements before making a commitment.

6.2. Transfers of Personal Data are subject to applicable data protection law. Where that law requires a transfer safeguard, the applicable arrangement must address that requirement. Contact Us to request information about the safeguards applicable to Your data, including relevant contractual terms. Our DPA page provides the request route for customer processing agreements.

7. RETENTION OF PERSONAL DATA

7.1. We retain the Personal Data collected where an ongoing legitimate business requires retention of such Personal Data.

7.2. In the absence of a need to retain Personal Data under Section 7.1. above, We will either delete it or aggregate it, or, if this is not possible then We will securely store Your Personal Data and isolate it from any further Processing until deletion is possible

7.3. Retention depends on the type and purpose of the data. Account and billing information is retained for service administration and applicable legal or accounting requirements. Support, feedback and privacy-request records are retained as needed to handle the matter and document the response. Customer analytics and recordings follow the applicable service retention policy. AI-provider processing may have separate retention terms from the data stored in Your workspace. Contact Us for the terms applicable to Your account or to request deletion. We do not promise that every copy, provider log or backup is deleted immediately when a workspace record is removed.

8. SECURITY OF PERSONAL DATA

We use appropriate technical and organizational measures to protect the Personal Data that We collect and Process. The measures We use are designed to provide a level of security appropriate to the risk of Processing Your Personal Data. If You have questions about the security of Your Personal Data, please contact Us immediately as described in this Policy

9. YOUR RIGHTS

You are entitled to the following rights:

You can request Us for access and correction of Your Personal Data.

9.1. If We have collected and processed Your Personal Data with Your consent, then You can withdraw Your consent at any time. Withdrawing Your consent will not affect the lawfulness of any processing We have conducted prior to Your withdrawal, nor will it affect Processing of Your Personal Data conducted in reliance on lawful processing grounds other than consent.

9.2. You have the right to complain to a data protection authority about Our collection and use of Your Personal Data. For more information, please contact Your local data protection authority as specified by the applicable data protection laws.

9.3. You have the right to opt-out of marketing communications We send You at any time. You can exercise this right by clicking on the "unsubscribe" or "opt-out" link in the marketing e-mails We send You. To opt-out of other forms of marketing (such as postal marketing or telemarketing), please contact Us.

9.4. If You are a resident of the EEA, UK, or Switzerland, You are also entitled to the following rights:

9.4.1. You can request Us for deletion and erasure of Your Personal Data.

9.4.2. You can object to the Processing of Your Personal Data, ask Us to restrict Processing of Your Personal Data or request portability of Your Personal Data.

9.5. If You seek to exercise Your rights under this clause, please use Our Privacy requests page or contact Us at the details provided in clause 13. We may ask for proportionate additional information if We have reasonable doubts about Your identity; identity documents are not requested by default. Where the GDPR applies, We respond within one month of receipt. If an extension is permitted for a complex request, We explain the reason and extension within that month. Other requests follow the deadlines under applicable data protection law.

10. COOKIE POLICY

10.1. Cookies are text files that are placed on Your computer to collect standard internet log information and visitor behaviour information by Us. When You visit the Website(s), We may collect Personal Data automatically from You through cookies or similar technology. Optional cookies and similar storage help Us understand Website use and campaign attribution when You give the relevant consent. Advertising consent is not granted by Our website cookie controls.

10.2. Essential Cookies: We set essential cookies that enable core functionality such as security, network management, and accessibility. You may not opt-out of these cookies. However, You may disable these by changing Your browser settings, but this may affect how the Website(s) functions.

10.3. Optional analytics and session replay use cookies or similar browser storage to associate visits and interactions with a browser and understand Website use. Optional support widgets may use browser storage to maintain a support conversation. These tools may Process identifiers, page and device information and interaction data; such data is not necessarily anonymous.

10.4. Our cookie controls offer Accept all, Reject nonessential and Settings. Optional categories are off until You choose them. Closing or hiding the notice does not give consent. We save Your choice in browser storage for up to six months and You can change it or withdraw consent using Cookie settings in the footer. Rejecting optional cookies does not prevent You from contacting Us by email or making a privacy request.

10.5. Published interactive demos use a session record to associate engagement events with a single viewing session. If an End-User submits a demo lead form, local browser storage may retain the submitted fields for configured prefill or repeat-visitor behavior. Subscribers that embed demos are responsible for describing these technologies in their own notices and obtaining consent where applicable law requires it.

11. PRIVACY OF CHILDREN

11.1. We recognize the importance of children's safety and privacy. We do not request, or knowingly collect, any Personal Data from children under the age of 18. If a parent or guardian becomes aware that his or her child has provided Us with Personal Data, they should write to us at the email address provided in clause 13.

12. NOTICE TO END-USER AND OTHER EXCLUSIONS

12.1. Our Service(s) are intended for use by enterprises. Where the Services are made available to an End-User through a Subscriber, that enterprise is the Controller of the End-User's Personal Data. In such a case, the End-User's data privacy questions and requests should be submitted to the Subscriber in its capacity as the End-User's Controller. If the End-User is an individual who interacts with a Subscriber using Our Services, the End-User will be directed to contact Our Subscriber for assistance with any requests or questions relating to their Personal Data. We are not responsible for Subscribers' privacy or security practices which may be different from this notice. Subscribers to Our Services are solely responsible for establishing policies for and ensuring compliance with all applicable laws and regulations, as well as any and all privacy policies, agreements, or other obligations, relating to the collection of Personal Data in connection with the use of Our Services by End-Users.

12.2. Our Website(s) contain links to other websites. Our Policy applies only to our Website(s), so if You click on a link to another website, You should read their privacy policy. We encourage You to review the privacy statements of any such other websites to understand their Personal Data practices.