What we collect, and what we do with it.

Who we are

Orbit is a restaurant data tool made and run by The Modev Shop, LLC (“we”, “us”). This policy covers the Orbit web app at orbit.modevshop.com, the Orbit browser extension, and these Orbit web pages.

Orbit is used by restaurants (“restaurants” or “you”) and their staff. A restaurant decides which services to connect and what its guests' information is used for. For guest information, we act on the restaurant's behalf.

What we collect

Your account

When you sign in with Google we receive your name, email address, profile photo and whether Google has verified your email. We use these to create your Orbit account and to link it to the restaurants you belong to. Teams that use a shared team password have a sign-in session stored in the browser; we don't store the password in readable form.

Data from services a restaurant connects

Orbit only receives data from a service after someone at the restaurant connects it. The Connections page lists each one in detail.

Orbit also stores the sign-in tokens these services issue, so it can keep syncing. They are encrypted; see Storage and security.

Guest information

Reservations and orders can include guests' names, email addresses, phone numbers, visit dates, party sizes and what they ordered. Orbit uses this to show a restaurant its own guests: who is new, who comes back, and who hasn't been in for a while. Orbit never contacts guests. Having a guest's contact details isn't permission to market to them, and Orbit doesn't treat it as such. If you are a guest, see Your choices.

The browser extension

The Orbit extension for Chrome links one browser to one restaurant in Orbit. It keeps a device token for that link in the browser's extension storage, checks the restaurant's connections with Orbit every few minutes, and shows an alert when one stops syncing. It sends information only to Orbit's server. When you install it, Chrome asks you to let it use www.toasttab.com and auth.toasttab.com, which it needs for its one job: connecting your Toast to Orbit. Only Orbit's own site (orbit.modevshop.com) can send it messages, and only to check that it is installed, link the browser to your restaurant, connect Toast, or run the queued Toast requests. It doesn't read the sign-ins you use for QuickBooks, Google or Meta.

Toast sign-in. When you press Connect Toast, in the extension or in Orbit's setup, the extension asks Toast for a new sign-in token, using the Toast session that is already signed in in that browser. It never reads your Toast password or cookies. It keeps the access token in Chrome's session storage, which Chrome clears when it closes, and uses it to fetch the restaurant's Toast reports (bookings, sales and labor) for Orbit. The sign-in token is sent to Orbit only if the restaurant chooses Orbit's server under Where Toast syncs, so Orbit can keep syncing while the computer is off. Orbit then stores it encrypted with AES-256-GCM. Choosing This browser again deletes Orbit's copy. With the sign-in, the extension also sends the Toast restaurant IDs that login can see, so Orbit can warn you if the sign-in belongs to a different restaurant. When you connect from Orbit's setup, it also tells Orbit which restaurant the Toast page shows (its Toast ID, name and time zone, as Toast's own page shows them), so Orbit can set your restaurant up.

Toast data. When the extension fetches a Toast report for Orbit, it sends Toast's response to Orbit, which stores it like the rest of the restaurant's Toast data (see the table above). Booking reports include guests' names and contact details when guests gave them. The extension makes only the read-only Toast requests on a fixed list built into it, and refuses any other request.

Learn Toast's reports (off by default). If you turn this on, the extension records the structure of the requests Toast's own website makes while you use it: the method, the address with IDs and dates replaced, and the names and types of fields. It never sends values such as names, amounts or IDs.

Read-only Toast user guide. The setup guide opens Toast's settings pages and can fill in the name and email you typed for the Orbit user. It never saves anything in Toast; you review and save each change yourself.

Turning it off. Disconnect the browser in the extension (Settings → Disconnect this browser) or in Orbit (Settings → Browsers); remove the extension's Toast access in Chrome's extension settings; or uninstall the extension, which deletes everything it kept in the browser. To delete what Orbit stored, disconnect Toast in Orbit or email us (see Keeping and deleting data).

Technical information

Our hosting providers keep standard server logs, such as IP address, time of request and the page or API called, to run and secure the service. Orbit's public pages (orbit.modevshop.com and its How it works page) use Google Analytics to count visits, where they came from, and requests for early access; Google sets cookies to do this. They don't use advertising cookies or tracking pixels. The Orbit app itself uses no analytics: it uses your browser's storage only to keep you signed in and remember simple settings.

How we use it

• To run Orbit: sync connected services, compute the restaurant's insights, and show them to the restaurant's team.
• To tell you when a connection needs attention.
• To keep Orbit secure, fix problems, and check that its numbers are correct.
• To answer the restaurant's questions and build insights for it. Orbit, our team and the AI agents a restaurant uses with Orbit, including Anthropic's Claude, work on that restaurant's data, including its Google Analytics reports when they're connected. Results go only to that restaurant. A restaurant's data is never used to train AI models. Research notes we keep leave out guests' names and contact details.
• To respond to you and to meet legal obligations.

We don't sell personal information, use it for advertising, or share one restaurant's data with another restaurant.

Data from Google

What we access. With Google sign-in: your name, email address and profile photo. When a restaurant connects Google Analytics, Orbit requests read-only access (the analytics.readonly scope) and receives the names and IDs of the GA4 properties the Google account can see, plus daily totals for the property the restaurant chooses: visits, new visitors and key events by channel and campaign, and Google Ads cost, clicks and impressions by campaign when Ads is linked to that property. When the restaurant, or an AI agent it uses with Orbit, asks a question, Orbit also runs a report on that property on the spot: visits, events, conversions, revenue and ad results by date, channel, campaign, page or device. These are totals; Orbit doesn't receive data about individual website visitors.

How we use it. Only to show that restaurant its own website and advertising results in Orbit, next to its other data; to answer the questions the restaurant asks about them, including through AI agents it uses with Orbit; and to keep that connection working.

Who sees it. The restaurant's Orbit team, and the AI agents that team uses with Orbit to ask about it. We don't sell it, use it for advertising, share it with other restaurants, or use it to develop, improve or train AI or machine-learning models. People at The Modev Shop, LLC don't read it except when the restaurant asks us to for support, when needed for security, or when the law requires it.

How it's protected. The Google access token is encrypted before it's stored. Report data is stored in Orbit's database, which only Orbit's server code can reach.

Keeping and deleting it. Disconnecting Google Analytics in Orbit revokes Orbit's access with Google and deletes the stored token straight away. You can also remove Orbit's access at myaccount.google.com/permissions. Daily totals already synced stay with the restaurant's data until the restaurant asks us to delete them or closes its account; we then delete them within 30 days.

Data from Meta

What we access. When a restaurant connects Facebook, Orbit asks Meta for read-only access to the Facebook Pages and linked Instagram professional accounts that the person chooses to share. The permissions are pages_show_list, pages_read_engagement, read_insights, instagram_basic, instagram_manage_insights, ads_read and business_management. Meta requires the last two when a Page is managed through a business portfolio, and Orbit uses them only to reach that Page and its Instagram insights. It doesn't read ad accounts or change anything in the portfolio. When a restaurant connects Threads, Orbit asks for threads_basic and threads_manage_insights. Orbit stores daily totals for the account and the account's name and ID. It doesn't read messages, and it doesn't store who viewed, liked or followed.

What Orbit never does. Orbit never posts, comments, replies, sends messages or changes settings on a restaurant's Facebook, Instagram or Threads accounts.

How we use it. Only to show that restaurant its own social results in Orbit next to its bookings and sales, to answer the questions the restaurant asks about them, including through AI agents it uses with Orbit, and to keep the connection working.

Who sees it. The restaurant's Orbit team, and the AI agents that team uses with Orbit. We don't sell it, use it for advertising, share it with other restaurants, or use it to train AI models.

How it's protected. The Facebook Page token and the Threads token are encrypted with AES-256-GCM before they're stored.

Disconnecting and deleting. Disconnecting Facebook in Orbit removes Orbit's permissions at Meta and deletes the stored token straight away. Disconnecting Threads deletes its token. You can also remove Orbit yourself: on Facebook under Settings & privacy → Settings → Business integrations, and on Threads under Settings → Account → Website permissions. To delete the daily totals already synced, email info@modevshop.com and we'll delete them within 30 days.

Who we share it with

We share information only as needed to run Orbit:

• Service providers that host or run Orbit for us: Convex (database and server), Render (these web pages), Google (sign-in, and Analytics on Orbit's public pages), and Anthropic (the AI that answers a restaurant's questions and writes its insights, as described above). They may only use the information to provide their service to us.
• Meta, only if a restaurant turns on booking events. Orbit then sends each new online reservation to Meta as an event, with the guest's email and phone number hashed before they leave Orbit. The restaurant is responsible for having the right to do this.
• The services a restaurant connects, when Orbit calls them to fetch that restaurant's data.
• AI apps a team member connects, such as Claude, ChatGPT or Codex. A team member adds Orbit to the app and signs in with Orbit, choosing one restaurant. The app then receives that person's name and email address, and it can read that restaurant's reports and data, including team members' names, shifts and sales, but not guests' names, email addresses or phone numbers, which Orbit removes. It can post briefs, notes, questions and research back to Orbit. It can't change anything in the services the restaurant connected, or move money. What the app does with this information is governed by its maker's terms and privacy policy, such as Anthropic's or OpenAI's, which the team member accepted when they started using it.
• When the law requires it, or to protect the rights, property or safety of our users, guests or us.
• In a sale or merger of Orbit, under a commitment that this policy continues to apply.

Storage and security

Orbit's data is stored in the United States. Connections use HTTPS. Sign-in tokens for connected services are encrypted with AES-256-GCM before they're stored, and disconnecting a service deletes its token. Orbit's pages and data are behind sign-in, and each restaurant's data is kept separate. No system is perfectly secure; if we learn of a breach that affects your information, we'll tell you and the affected restaurant as the law requires.

Keeping and deleting data

We keep a restaurant's data while it uses Orbit so that comparisons with past weeks and years work. When a restaurant closes its account or asks us to, we delete its data, including guest information and data from connected services, within 30 days, except records we must keep by law. Any backups are removed on their normal schedule after that. Server logs are kept by our hosting providers for a limited time for security.

Your choices

• Restaurants can switch any connection off, disconnect it, and ask us to export or delete their data.
• Team members can ask us for a copy of their account information, or to correct or delete it.
• Any team member can see which AI apps are connected to their restaurant and disconnect any of them in Orbit → Settings → Connections → AI apps. Disconnecting ends the app's access straight away.
• Anyone who connected Facebook, Instagram or Threads can remove Orbit's access in those apps' settings (see Data from Meta) and email us to delete the data Orbit synced from them.
• Guests of a restaurant that uses Orbit can ask that restaurant, or us, to see, correct or delete their information. We'll work with the restaurant to respond.

Depending on where you live, you may have further rights under laws such as the California Consumer Privacy Act. Email us and we'll respond within 30 days. We won't treat you differently for asking.

Children

Orbit is a business tool and isn't meant for anyone under 16. We don't knowingly collect information from children.

Changes to this policy

If we change this policy, we'll update the date at the top. If a change affects how we use information we already have, we'll tell restaurants in Orbit or by email before it takes effect.

Contact

The Modev Shop, LLC
info@modevshop.com