Orbit Privacy Notice

Last updated: September 11, 2024

This Privacy Notice applies to Orbit, an artificial intelligence (AI) based browser add-on that allows users to summarize and query web content, including webpages and web-based email services (the “Service”). The Service is owned, licensed, and operated by Mozilla Corporation (referred to herein as "we," "us," "our," or "Mozilla").

This Privacy Notice explains what information we collect, share, and otherwise process, and why. Your use of the Service constitutes your acceptance of this Privacy Notice, which is incorporated by reference in our Terms of Service.

Things you should know

We collect the following information directly from you when you use the Service:

• Inputs and Outputs. The Service is powered by AI models created by third-parties (“Third-Party Models”). It allows you to request summaries of, or ask questions about, web content of your choosing (“Inputs”). We process these Inputs solely to provide you with summaries and answers to your queries (“Outputs”). If you abandon a query or navigate away from a page with the Service in use, all Inputs and Outputs will be discarded by your browser and irretrievably lost.
• Communications. If you contact us in connection with the Service or provide feedback, we may also collect personal information, such as your name or email address, as well as any other personal information you choose to provide to us.

We also automatically receive certain information when you interact with the Service:

• Technical data. We receive basic telemetry data by default, which we use to improve the performance, stability, and security of the Service, including information about your device, including hardware configuration and device operating system; browser information, such as browser type and settings; log files and usage data; and event information, such as errors or crashes. We may also receive additional information about your device, such as country, language, operator and OEM, which we use to prevent fraud and abuse, enforce our terms, and improve the security of the Service.
• Location data. Your IP address is collected as part of our server logs, and automatically deleted after 90 days. We use it to approximate your location to comply with relevant legal and regulatory requirements, as well as for fraud and abuse prevention purposes.

We also receive the following information from third parties when you use the Service:

• Inputs and Outputs. When you use the Service to summarize or query web content, we automatically receive a payload back from the relevant [Third-Party Models] containing the contents of your query; information about the model queried (such as the name and version number); information about technical problems with processing the query, if any; the number of tokens required to process the query; and the model Outputs in response to the query. We do not store this data beyond temporarily caching it to process your query and return the Outputs to you.
• Reports. The Service also allows users to report issues or inaccuracies with the Outputs, which are reviewed by human moderators. If we receive a report, we will retain any personal information shared with us in connection with that report for as long as we need to review, adjudicate, and resolve the case, or as otherwise required by law.

We may also use information about you to find and address violations of our Terms of Service or policies; investigate suspicious activity; detect, prevent, and combat harmful or unlawful behavior; and otherwise maintain the integrity of our Service.

Information We Share.

We use third parties to provide the Service to you, and have contracted with these companies requiring them to protect your information (Third-Party Services):

• Google Cloud Platform. Google Cloud Platform (GCP) is a cloud-computing platform. We use GCP to manage services that facilitate responses to user prompts and page summarization.
• Sentry. We use Sentry for Application Performance Monitoring (APM) and error collection to help improve the quality of the Service. If you opt into additional data collection for error monitoring and performance tracking, we share URL information with Sentry so we can track and fix where issues occur.

Children

The Service is not directed to children under 18 years of age, and we do not knowingly collect or solicit personal information from children. If the Service unknowingly collects personal information from a child under the age of 18 without parental consent, we will delete that information as soon as possible, unless we have a legal obligation to keep it. If you are a parent or guardian and believe your child has uploaded personal information to our site without your consent, you may contact us as described in “How to Contact Us” below.

How to Contact Us

If you have any questions, you can contact us at any time at orbit-support@mozilla.com or through our web form under “Contact Us.” To make requests regarding your personal information, please contact us through our Data Subject Access Request Portal. If you have any other questions regarding personal information or our privacy practices, please contact us at compliance@mozilla.com. We respond to all requests we receive from individuals wishing to exercise their rights in accordance with applicable laws.

Information for EU, EEA, Swiss, California, Connecticut, Virginia and Utah users

These regions have data protection laws that require us to specify the following:

Our Privacy Notice describes the purposes for which we process information about you and the categories of information we process. We do not sell personal data.

Our lawful bases for collecting and processing personal information include:

• Performing our contract with you. Using the Service requires your agreement to the Terms of Service. To provide the services described, we need the content you are asking the Service to summarize or query, and certain technical data, as further described in this Privacy Notice.
• Legitimate interests. As described in this Privacy Notice, we also receive technical and interaction data of users, which may include IP addresses, and certain metrics to improve the security and reliability of our services, prevent fraud and abuse, log and address technical problems, and enforce our Terms of Service and Content Policies.
• Consent. Where we ask for your consent to process your information, you can always withdraw this consent.

The following rights are granted by certain laws such as the General Data Protection Regulation (“GDPR”) in the EU and the California Consumer Privacy Act (“CCPA”) in California:

• The right to know what personal data is collected
• The right to know if personal data is being shared, and with whom
• The right to access your personal data
• The right to exercise your privacy rights without being discriminated against

In many cases, you can access, update, or delete your personal information directly from our product settings.

To make requests regarding your personal data, please contact us through our Data Subject Access Request Portal. If you have any other questions regarding personal data or our privacy practices, please contact us at dpo@mozilla.com, or you can contact our DPO by mail at:

Bird & Bird DPO Services SRL
Avenue Louise 235 b 1
1050 Brussels
Belgium

We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws. You also have the right to lodge a complaint with your local data protection authority.