Privacy Policy
Raise by OrbitAIEffective 10 September 2026Version 1.0
Raise reads the mailbox where your fundraise happens. That deserves a policy you can actually check, so this one names the scopes we ask for, the fields we keep, the providers that touch them, and the two ways to get everything back.
1. Who we are
OrbitAI LLC (“OrbitAI”, “we”, “us”) operates Raise, an agent-first fundraising CRM for founders, available at raise.orbitaicrm.com and as a macOS desktop app. This policy explains what Raise collects, why, who it is shared with, and how to get it back or delete it.
OrbitAI LLC
Limassol, Cyprus
privacy@orbitaicrm.com
For users in the EEA and the UK, OrbitAI LLC is the data controller for your account data and the processor acting on your instructions for the mailbox, calendar and spreadsheet content you choose to connect.
2. What Raise does with data, in one paragraph
You connect a Google account. Raise reads your mail and calendar on a schedule, works out which messages and meetings involve investors you are tracking, and writes that history onto the investor's record in your pipeline. It researches the funds you add using public sources, and grades them against your own company profile. If you link a P&L or MRR spreadsheet, or upload a deck, it keeps the resulting metrics and narrative so it can answer investor questions with current numbers. It does not send email unless you later grant a separate permission for that.
3. What we collect
Account information
- Name and email address
- Your Google account identifier, used for sign-in
- Settings, plan, and the OAuth refresh tokens for the services you connect (encrypted at rest)
Google Workspace data you connect
Raise requests the narrowest scope that does the job. At sign-up that is Gmail read-only.
- Gmail (read-only). We read message metadata (sender, recipients, subject, timestamp, thread) and message bodies in order to match them to investors in your pipeline. For a matched message we store the subject, timestamp, direction, a reference to the message, an AI-written summary, the extracted next step, and the short excerpts needed to show you what was said. Messages that do not match an investor are not stored.
- Google Calendar (optional). Event time, title, attendees and description for meetings matched to investors, so calls appear in the history and pre-call briefs can be prepared.
- Google Sheets (optional). Only the specific spreadsheets you link. We store the cell values from the ranges you map, and the metrics computed from them.
- Your deck (optional). If you upload a deck or link one, we store the extracted narrative: positioning, problem, why-now, traction claims, the ask.
You can disconnect any of these at any time, in Raise or from your Google account permissions page.
Pipeline data you create
- Funds and people you track, and their contact details
- Status and stage, grades and grade overrides, fit scores, next steps and due dates
- Your notes and drop reasons, which we store verbatim and never rewrite
- Round data: target, commitments, valuation, instrument
Company data
Your company profile, previous rounds, key metrics and their history, and data-room facts you confirm.
Fund and investor research
Public, professional information about investment firms and the people who work at them: description, assets under management, stage and geography focus, typical check size, whether they lead rounds, recent publicly reported deals, role, and public professional profile links.
Technical data
IP address, browser and device type, log and error data, and usage metrics, used to run the service, fix faults, and detect abuse.
4. Google API Services Limited Use disclosure
Raise's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically, for data obtained through Gmail, Google Calendar, Google Sheets and Google Drive scopes:
- We use it only to provide and improve the features you see in Raise: detecting investor touches, maintaining your pipeline, preparing briefs, and answering questions from your own metrics.
- We do not use it for advertising, and we serve no ads.
- We do not sell it, and we do not transfer it to anyone except the processors listed below, who act on our instructions to operate the service, or where you direct us to, or where the law requires it.
- We do not use it to train generalised artificial-intelligence or machine-learning models. It is sent to an AI provider only to produce output for you, under terms that prohibit training on it.
- No human at OrbitAI reads your mail except where you have explicitly asked us to (for example, to debug a problem you reported), where it is necessary for security or to investigate abuse, or where the law compels it.
5. How we use it
- Keeping your pipeline current without you logging anything by hand.
- Researching and grading funds against your company profile, with the reasons shown.
- Preparing briefs and digests before calls and on a schedule you set.
- Answering diligence questions from your own synced metrics and deck narrative.
- Running, securing and supporting the service, and meeting legal obligations.
Our legal bases, where the GDPR applies, are: contract (running the service you signed up for), consent (connecting each Google service, which you may withdraw at any time), legitimate interests (security, abuse prevention, product reliability, and researching professional information about investment firms), and legal obligation.
6. AI processing
Raise uses large language models to summarise messages, extract next steps, research and grade funds, and draft answers. Our default provider is Anthropic, including its search-grounding tool for fund research. Google Vertex AI (Gemini) may be used as an alternative backend.
- Content is sent to the provider only to generate output for you.
- We use API endpoints whose terms state that customer content is not used to train the provider's models, and we do not train any model of our own on your data.
- If you supply your own API key, your inference runs on your key and under your own agreement with that provider.
- AI output can be wrong. Grades, scores, summaries and briefs are assistance, not advice, and every field you correct becomes an override that later refreshes will not touch.
8. Who processes data for us
- Supabase — managed Postgres database and authentication
- Railway — backend and scheduled job hosting
- Vercel — hosting for this marketing site
- Anthropic — language model processing (default)
- Google Cloud / Vertex AI — alternative language model backend
- Google — the Workspace APIs you connect
Each acts on our instructions under a data-processing agreement. We do not sell your data, and we do not share it with advertisers or data brokers.
If you run the desktop app in local-first mode, your store is a SQLite file on your own machine. It stays there until you sign in to sync.
9. Security
- OAuth refresh tokens are encrypted at rest, separately from the rest of the record.
- All traffic runs over TLS.
- Database access is restricted and row-scoped to the account that owns the data.
- Access to production is limited to the people who need it, and is logged.
No system is perfectly secure. If you believe you have found a vulnerability, write to security@orbitaicrm.com and we will respond.
10. How long we keep it, and how to get it out
- We keep your data while your account is active.
- JSON export is free on every plan, including after a downgrade and after your round closes. Your pipeline is never held hostage.
- Delete an investor and its record and history go with it.
- Delete your account and we remove your data from active systems within 30 days. Encrypted backups age out within 90 days.
- Disconnect Gmail and we stop reading it immediately; already-matched history stays in your pipeline until you delete it.
- We may keep the minimum records needed for tax, accounting and legal obligations.
11. Your rights
Depending on where you live, you may ask us to give you a copy of your data, correct it, delete it, port it, restrict or object to processing, or withdraw a consent you gave. Most of this you can do yourself inside Raise; for anything else, write to privacy@orbitaicrm.com and we will answer within 30 days.
If you are in the EEA or the UK and you are not satisfied, you may complain to your local supervisory authority; ours is the Office of the Commissioner for Personal Data Protection of Cyprus.
12. If your information is in someone's Raise account
Raise necessarily holds information about people its users correspond with — investors, and the professionals at their firms. We hold professional information for a professional purpose, and we do not build profiles of private individuals.
If you believe information about you is held in Raise and you want to see it or have it removed, write to privacy@orbitaicrm.com. We will locate it and act on legitimate requests, and where the data was added by a customer we will tell you that we have passed the request on to them as the controller of their own records.
14. International transfers
We and our processors operate in the EU and the United States, so your data may be processed outside your country of residence. Where data leaves the EEA or the UK, transfers rely on the European Commission's Standard Contractual Clauses or another lawful mechanism.
15. Children
Raise is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children.
16. Changes to this policy
If we change this policy materially — a new category of data, a new processor, a new purpose — we will update the date at the top and tell you in the product or by email before the change takes effect.
17. Contact
OrbitAI LLC
Limassol, Cyprus
Privacy: privacy@orbitaicrm.com
Security: security@orbitaicrm.com
This policy describes Raise as it is built today, during a free beta. It is a founder-written document, not a lawyer-reviewed one: have counsel read it before you rely on it for a Google OAuth verification submission or a customer's security review.