Privacy Policy

BlackSpace builds Orbit, software that writes, schedules and publishes social media posts for small businesses. This policy covers blackspace.ai, the Orbit web app and the Orbit mobile app.

Your email address and an authentication record, so you can sign in. Your business profile as you enter it: business name, industry, description, tone of voice, target audience, website, brand hashtags and an optional logo. The posts you create — captions, images and video, scheduled times — and basic usage records of which features ran, so we can find and fix failures.

Only if you choose to connect an account, and only what the permissions you grant allow:

• Your account identifier and username, to show you which account is connected and to publish to the right place.
• An access token, stored so scheduled posts can publish while you are away. It is kept in our database with row-level security that denies all direct access, and it is never sent to your browser or to any other company.
• Your published media and its metrics — reach, likes, comment counts — to show you what worked.
• Comments on your posts, so Orbit can draft replies in your voice. You approve every reply before it is sent.
• Your Facebook Pages, where you connect through Facebook, so you can choose which Page to post to.

We do not collect your followers' personal information, we do not read your direct messages beyond the conversations you explicitly enable, and we never post anything you have not created or approved.

We do not sell your data and we do not share it for advertising. We use these processors, and only for the job described:

• Anthropic (Claude) — your business profile, your notes and your photographs are sent so captions, weekly plans and comment replies can be written. Your uploaded image is included when a caption is written from a photo.
• Google (Gemini) — your brand details and your description of the artwork you want are sent so festival creatives can be generated.
• Supabase — database, authentication and file storage.
• Meta — the posts you publish, sent to Instagram and Facebook on your instruction.

Your posts and business profile are kept while your account is open. Access tokens are deleted as soon as you disconnect a channel. If you delete your account, we remove your profile, posts, media and tokens within 30 days.

Disconnecting a channel in Orbit immediately removes the access token for it. To delete everything, email contact@blackspace.ai or use the data deletion page. Requests sent by Meta on your behalf are handled automatically and given a confirmation code you can use to check the status.

Data is encrypted in transit. Access tokens and connected-account records sit behind database row-level security that denies access by default, so they cannot be read through our public API keys.

Email contact@blackspace.ai for any privacy question, including a copy of everything we hold about you.